Chinese internet users got a wake-up call in November, when a state media report revealed that 468 million pieces of personal data had been leaked.

It sparked a public outcry, revealing growing concerns about privacy and protecting personal information online in a country that is increasingly reliant on technology, and where state surveillance is an everyday part of life.

State broadcaster CCTV reported that the data was illegally mined from financial lending platform databases by a web of small-scale tech firms. Those firms then sold the information to other small-scale lenders for as little as 0.1 yuan (1 US cent) per piece. The worst offender, third-party credit assessment firm Beijing Koala Credit Service, illegally obtained more than 100 million pieces of personal data.

The problem is apparently widespread in China. Ninety-five per cent of respondents to a survey by Southern Metropolis Daily last month said their personal data had been stolen. Nearly half believed e-commerce and financial lending apps had serious privacy issues, and almost 80 per cent were concerned that their facial recognition data could be leaked from apps. The newspaper did not say how many people were surveyed.

The government cracked down on more than 600 apps that collected illegal and excessive amounts of user data without consent last year, but the move did little to stem concerns about information security and privacy in China, where 854 million people are online.

More than 99 per cent of them access the internet on their mobile phones, and they are increasingly reliant on a handful of home-grown tech giants such as Tencent, Baidu and Alibaba, whose apps – covering everything from entertainment and financial services to health care – are now a big part of daily life. Alibaba owns the South China Morning Post.


Data for sale

The rise of the information market dominated by these tech giants has happened naturally, alongside China’s rapid economic development, according to Elaine Yuan, a media and communications professor at the University of Illinois, Chicago.

“They sell information and data – these are their main goods,” she said. For instance, Alibaba has sold data on consumer preferences to brands including PepsiCo and Mattel in exchange for access to its platform.

“The sense of the individual has also been heightened – especially this sense of ‘it’s my data, my privacy’ – so customers have become a legitimate social identity to be protected in the information market,” Yuan said. “If you don’t protect consumer rights, people wouldn’t have the faith to carry on consuming or sharing their data in the information market, which would be very detrimental to economic growth.”

Many people interviewed by the Post were worried about securing their personal information.

Beijing native Natalie Zhao, 24, said data collection by the government and private firms was “pretty scary”, and she would never enable facial recognition on an app.

“For instance, [the popular e-wallets] Alipay and WeChat Pay now have facial recognition payment functions. If someone someday uses my face to impersonate my identity online, I wouldn’t be able to figure out how they got it,” she said. “Besides, no one can guarantee that mass-scale data collection won’t lead to leaks.”

Ann Cao, from Suzhou in Jiangsu province, also avoided facial recognition functions on apps.

“There is low transparency regarding where my data goes to and how it is being used,” the 23-year-old said. “For me, the collection of user data is totally acceptable, but only when the party doing so has specified what data is collected, how the data is used and when the user can opt out,” she said. “To realise this we need a strong legal foundation like the GDPR, and right now I don’t think the enforceable laws or regulations are in place in my country.”

China only started strengthening regulation of data in recent years, with a comprehensive legal framework for individual data protection and rights in the works. But its existing cybersecurity law is not as advanced as the GDPR, or general data protection regulation – Europe’s landmark legislation that took effect in 2018 and gives individuals the right to protect their privacy.


‘Disillusionment’

In China, more people are aware of privacy issues, but they are not proactive about protecting their data, according to tech industry insiders.

Tech blogger Lawrence Li, who is based in Japan, said increased awareness had led to “disillusionment”. “Rather than doubling down on measures to protect themselves like ad blockers and VPNs for encryption, they just believe or assume that all hope is lost,” Li said. “Many people in China are convinced that there’s no chance of escaping data collection from the government.”

Older internet users tended to be hypervigilant about data security because of media coverage, but they were also the most vulnerable to leaks and scams because they were not aware exactly how their data could be stolen, said a former Chinese tech firm employee surnamed Han.

“When my mother first got a smartphone, she was often scared of using it,” said the 26-year-old, who now works in big data for a US tech company. “When I was at home, she would always ask me, phone in hand, if it was OK to click this or that, ‘Will it steal my money or bank card details?’”


Mass surveillance

Paradoxically, some Chinese who worry about their personal data leaking online also support China’s extensive nationwide surveillance system, with its widespread use of facial recognition technology.

China plans to expand its surveillance camera network to 626 million by 2020, and is also home to eight of the world’s top 10 most surveilled cities, according to an August report by Comparitech.

Coogie, a 19-year-old student from Shanghai, never uses public Wi-fi or enables the location tracking functions on her phone, but believes that “surveillance is justified since it ensures social stability”.

There is very little comprehensive data on Chinese attitudes towards mass surveillance, but the available reports suggest that certain demographics are more likely to approve.

A 2017 study of four high schools in China and the United States in the journal Issues in Information Systems found that the Chinese students viewed digital surveillance more favourably than their American counterparts.

More recently, a March 2019 study of more than 1,000 Beijing residents published in Sustainability found those who were female and educated were more likely to believe that video surveillance systems promoted public security, while elderly respondents were more distressed by their presence.

“In a broad sense, the acceptance of pervasive surveillance is not unthinking, and at times is accompanied by doubt or criticism,” said Gabriele de Seta, an internet researcher based in Taipei.

“But I feel that, besides convenience, surveillance is also traded off for security, or simply the feeling of security.”

While notions of privacy have evolved over the years, Yuan from the University of Illinois said Chinese society still “does not perceive privacy as a fundamental right, as most liberal Western societies do”.

She added that most Chinese appeared to be more concerned with “the practical aspects of digital privacy, such as ‘What if they get my data and hurt me?’”.

The state surveillance imposed to ensure social stability may also stifle more constructive debate.

“The lack of individual rights in China is not only real, it runs so deep that it’s almost impossible to have a meaningful discussion about the privacy versus public safety trade-off,” tech blogger Li said.