"Welcome to the XX Dictionary. Please read and agree to the Terms of Service and Privacy Policy." To keep up with young people's lives and learn more about internet slang, Beijing resident Liu Yu (pseudonym) downloaded an app billed as a "dictionary of internet slang every meme master must have."

　　Liu Yu noticed that the app had "agree" pre-checked by default in its "Privacy Policy" section; if the checkbox was unchecked and the app was refused permission to process personal information, the app would automatically exit; and when deleting the account, it was impossible to withdraw consent already given to process personal information. Liu Yu therefore sued the app operator in court.

　　Recently, the Beijing No. 4 Intermediate People's Court (hereinafter referred to as the "Beijing No. 4 Intermediate Court") concluded the case, finding that the app in question infringed on citizens' personal information rights and interests and should bear tort liability in accordance with the law.

　　Apps collecting personal information beyond the permitted scope and infringing on users' rights and interests has long been a topic of public criticism. In March of this year, in accordance with the Personal Information Protection Law, the Cybersecurity Law, the Telecommunications Regulations and other laws and regulations, the Ministry of Industry and Information Technology organized third-party testing institutions to inspect issues such as the illegal collection and use of personal information that users had reported as prominent. A total of 62 apps and SDKs were found to have infringed on users' rights and interests, and nearly half of them involved personal information issues.

　　China Youth Daily · China Youth Network reporters noted that since the beginning of this year, the communications administrations of Zhejiang, Anhui, Shandong and many other provinces and municipalities have all reported multiple apps for infringing on users' rights and interests and posing security risks. Can users refuse an app's collection and processing of personal information? Can consent be withdrawn after it is given? What are the legal liabilities for apps that collect personal information beyond the permitted scope? Reporters interviewed a number of judges who handled such cases as well as experts and scholars.

　　Notification and consent to users must meet the two requirements of "voluntary" and "explicit"

　　"The processing of personal information shall follow the principles of lawfulness, legitimacy, necessity and good faith, and personal information shall not be processed by means of misleading, fraud, coercion or other such methods." Yu Yingying, the judge in this case and a judge at the Beijing No. 4 Intermediate Court, explained that where personal information is processed based on individual consent, such consent shall be given voluntarily and explicitly by the individual on the premise of full knowledge. In this case, based on Liu Yu's claims, the court focused on examining whether the company's notification and consent to users met the two requirements of "voluntary" and "explicit."

　　A privacy policy concerns the scope and manner in which a personal information processor processes personal information. App developers draft standardized personal information processing policies in advance in order to notify users in bulk, but as personal information processors they should ensure that users are fully informed of the personal information policies drafted in advance and, under such circumstances, voluntarily and proactively perform the affirmative act of "agreeing."

　　In this case, the company did not put in place measures to ensure that users could fully understand the content of its privacy policy, and when the user had not actually read it, upon returning to the interface, "I have read and agree to the Terms of Service and Privacy Policy" was checked, without allowing the user to voluntarily make the choice to agree, which did not meet the "voluntary" and "explicit" requirements.

　　At the same time, after the user clicked the reject button, the dictionary exited. The Beijing No. 4 Intermediate Court held that the Personal Information Protection Law provides: "A personal information processor shall not refuse to provide products or services on the grounds that an individual does not consent to the processing of their personal information or withdraws consent; except where the processing of personal information is necessary to provide the product or service." In this case, after Liu Yu clicked the "reject" button, the dictionary automatically exited and provided no service to the user. According to the evidence in the case, the dictionary has both "word lookup" and "social" attributes. Although on the basis of the basic business function a product may develop other extended functions, such as the dictionary's social functions of posting, liking and commenting, where the basic business is word lookup as indicated by its name, official description and description in app stores, not providing lookup services should constitute a refusal of the basic business and still infringed on Liu Yu's personal information rights and interests.

　　Personal information must not be collected excessively

　　Hu Huaisong, a judge at the Beijing No. 4 Intermediate Court, held that the collection of personal information shall be limited to the minimum scope necessary to achieve the processing purpose, and personal information shall not be collected excessively. The dictionary's name, official description and description in app stores all point to its "dictionary function." Where the basic business function is word lookup, the dictionary's collection of Liu Yu's mobile phone number exceeded the minimum scope.

　　Regarding withdrawal after user authorization, Hu Huaisong held that where personal information is processed based on individual consent, the individual has the right to withdraw consent. Personal information processors should provide convenient ways to withdraw consent, but the version of the dictionary at the time Liu Yu gathered evidence did not provide an option to withdraw consent.

　　The Beijing No. 4 Intermediate Court held that withdrawing consent means the personal information subject withdraws authorization for the personal information processor to process personal information. After the personal information subject withdraws consent, the personal information processor should still provide the basic business function. Account deletion is essentially the termination of an online service contract. If users were required to withdraw consent by deleting their accounts, a situation would arise in which users could not continue to use the product in question unless they agreed to the collection of personal information, which violates the relevant provisions of the Personal Information Protection Law. The Beijing No. 4 Intermediate Court therefore did not accept the company's defense that withdrawal of consent could be exercised by deleting the account.

　　Ultimately, the Beijing No. 4 Intermediate Court dismissed the appeal and upheld the original judgment. The company was ordered to immediately delete the nickname, mobile phone number, password, avatar and device information it had collected from Liu Yu, as well as the user behavior information it had collected about Liu Yu; to apologize to Liu Yu in writing; and to compensate reasonable expenses of 3,080 yuan.

　　China Youth Daily · China Youth Network reporters learned that in the new version of the app released on March 31, 2022, the dictionary added a function for withdrawing authorization.

　　"Currently, some apps have several fairly obvious violations of laws and regulations concerning personal information," analyzed Hu Gang, deputy secretary-general of the Legal Work Committee of the Internet Society of China and a lawyer at Beijing Chaoyang Law Firm. First, forced extraction, meaning that if users do not authorize the provision of their personal information, the app operator refuses to provide the service. Second, bundled authorization, meaning that app operators often seek "package" bundled authorization for a dozen or even dozens of items of users' personal information. Third, extended authorization, "which is in fact also a form of bundled authorization," meaning that when app operators sign standard-form contracts with users, they often note the words "relevant enterprises" in the contract, so that when users complete personal information authorization, other affiliated enterprises can also obtain their personal information.

　　Hu Gang warned that "the scope of this affiliation is very broad. It generally includes not only companies with equity relationships but also companies with business relationships. This means that a single authorization by a user establishes authorization relationships with a group of enterprises and completes the 'sharing' of personal information." Such situations seriously violate the principles expressly stipulated in the Civil Code, the Law on the Protection of Consumer Rights and Interests, the Personal Information Protection Law and other laws, namely the principles of "lawfulness, legitimacy, necessity, good faith, openness and transparency" and the "minimum necessity principle."

　　The key is to give the law "teeth"

　　Hu Gang said that currently some mainstream apps basically all require users to provide a dozen or even dozens of authorizations, which gives them access to almost all the information on users' mobile smart terminals, including personal information and sensitive personal information.

　　Hu Gang said that China has now established a relatively complete and specific system of personal information protection norms composed of laws, administrative regulations, judicial interpretations, departmental rules, normative documents and national standards, but the key is to give the law "teeth." This also requires relevant departments to adhere to strict law enforcement and dynamic supervision, emphasize "bite," and carry out systematic special rectification of obvious violations of laws and regulations.

　　Yu Yingying reminded users that when registering for apps, they should develop the habit of reading user agreements and privacy protection agreements, pay attention to the content in bold and black text in the agreements, and understand the scope of personal information collected by the app. When they find that an app infringes on citizens' personal information rights and interests and privacy rights, they can safeguard their lawful rights and interests through complaints, reports or litigation.

　　In addition, network service providers should follow the principles of lawfulness, legitimacy and necessity when collecting and processing information, and should not force users to authorize, or use improper means such as default authorization, bundled services or forced suspension of use to induce or force users in disguised form to provide personal information. Moreover, the types of personal information collected should be directly related to the business functions of the actual product or service. At the same time, information processors should obtain user authorization in accordance with the law in personal information collection and processing activities and respect and protect users' rights and interests to the maximum extent, otherwise they will bear corresponding legal liability.