As the internet further penetrates into our personal lives, the trajectory of personal behavior and browsing history during online activities may become part of personal information. The Beijing Internet Court (BIC) recently concluded a case involving a personal information protection dispute between an individual and a network technology company. The court held that the user's browsing history is a record of personal behavior. It is part of the user's personal information, and may also involve the personal information of related video publishers. The principle of honesty and credibility should be applied while protecting personal information.

Case summary

The plaintiff surnamed Zhang requested the online platform to provide all browsing records of his account since its registration at the platform in an editable xlsk file format to a designated email address. It was to include information such as the video name, publication time, publisher’s account name, and his specific watching time. The platform’s operator company A claimed that users can independently access and copy personal information through functions such as "watch history" and "feedback and help". Besides, information such as the video name and publisher's account name is both Zhang's and the video publisher's personal information. To avoid infringement of personal information rights of the video publishers, company A provided Zhang with playback links. Zhang disagreed with this form of provision and sued company A at the BIC.

After trial, the BIC concluded:

The right to access and copy personal information as stipulated in Article 45 of China’s Personal Information Protection Law is a fundamental right of personal information. Except for circumstances mandated by law, the personal information processor should protect the right to access and copy, and cannot refuse to provide it solely because of the existence of other people's personal information. However, if the information belongs simultaneously to multiple subjects’ personal information, an adequate balance of interests should be considered: on the one hand, the legitimate interests of the access subject should be fully reviewed; on the other hand, the legitimate rights of other subjects should not be infringed upon, and the impact on their personal information rights and interests should be minimized.

If the requested content includes divisible personal information, the request of the party should be limited to their own personal information. If not divisible, the processor should consider whether the provision of information is within the scope of all parties’ consent or falls within the situation where consent is not required by law. If the provision will cause severe consequences to others’ personal information rights and interests, the processor should not provide it without the approval of those others.

In this case, the BIC held that in the absence of clear regulations and requirements governing the access and copy method in current laws, personal information processors should be allowed to choose reasonable methods and standards for providing personal information, taking into consideration their data format, storage capacity, and service capabilities, without creating unnecessary obstacles for the requesting party.

Details of the judgement:

Prior to the hearing of first instance at trial, company A provided the plaintiff with the required personal information in the form of tables with links. The BIC deemed it valid and dismissed the plaintiff’s request. The plaintiff appealed. The verdict of the second instance hearing corrected the portion regarding litigation fees while upheld the original judgment.

Tips from the judge:

As a fundamental right, the right to access and copy personal information is an important means of protecting the personal rights and interests of natural persons, and a crucial way to safeguard individuals’ rights, such as the right to be informed, the right to decide, the right to correct and supplement, the right to transfer, and the right to delete their personal information. Except for circumstances mandated by law, the protection of the right to access and copy personal information should not be subject to excessive restrictions. However, in situations where personal information is interdependent, the principle of safeguarding the right to access and copy should be upheld while taking into account the protection of the personal information of other parties based on the principle of good faith. In terms of the form of access and copying, in the absence of clear legal standards, multiple factors should be taken into consideration such as the type of personal information involved, storage methods, and copying costs.

An expert's perspective: 

Xu Ke, director of the digital economy and law innovation research center of the University of International Business and Economics. [Photo/Beijing Internet Court]

According to Xu Ke, director of the digital economy and law innovation research center of the University of International Business and Economics, the Personal Information Protection Law entitles individuals to a series of rights including the right to be informed, and the right to access and copy personal information in order to preserve full protection of personal rights. However, the law does not provide detailed operational regulations on how to exercise those rights. Therefore, how to refine the conditions and methods for exercising them through subsequent judicial action has become an important part of implementing the Personal Information Protection Law.

This case confirms the principle of good faith for individuals exercising their right to access and copy personal information. It clarifies the objects for access and copying, which are generally limited to an individual’s own personal information. If it is inseparable from another’s personal information, that party’s legitimate rights should not be violated, and the impact on them should be minimized. The case also clarifies the ways in which personal information processors should fulfill their obligations.