The Cyberspace Administration of China has imposed an CNY8.03 billion fine on ride-hailing service company Didi for data security breaches, citing the “egregious nature and grave violations” of the offenses. Chairman and CEO Cheng Wei and President Liu Qing were also fined CNY1 million each. An investigation found that Didi violated China's laws on network and data security and on the protection of personal information. Didi’s illegal acts started in June 2015 and lasted seven years. It was also found to be deliberately hiding from regulatory scrutiny.
Breaches of the law were identified in eight areas, including collecting customers' phone screenshots, excessively accessing users’ smartphone clipboard and application lists, collecting drivers’ ID info and education background, analyzing passengers’ transport and riding intentions, residential location and out-of-town trip information, and accessing unnecessary telephone information during car-pooling rides.
Didi also collected 64.7 billion pieces of personal data, including sensitive data like facial recognition, precise location and ID card numbers. The Cyberspace Administration opened the investigation into Didi last year following its initial public offering on the New York Stock Exchange (NYSE). The company was delisted one year later. The CAC also ordered Didi's apps removed from app stores and temporarily banned registration of new users, the Shanghai Daily reports.
Song Haixin, Senior Lawyer at the Jincheng Tongda & Neal Law Firm in Shanghai, said the Didi case focused on stricter regulation of data security. Instead of just paying lip service, companies must devote large resources to beef up the protection of data and personal information, Song said. “Companies tend to assume that the regulation of app data is usually conducted online. But the details of Didi’s illegal practices show that the regulator conducted on-site investigations of the company, with a very comprehensive review of its management and storage of data,” Song said. “Once investigated, any illegal data practices by a company could be found.” Didi can still not accept new users, the China Daily adds.
