A story about a well-known Beijing academic has gone viral after a female passenger on a subway train accused him of sexual harassment.

The incident, which took place in late May, saw 65-year-old Zhong Jun (not his real name) deny the woman's accusations in a subway train in Beijing and, after she insisted, he slapped her. Finally, Zhong was given five days' detention for slapping the woman, which was later suspended because of his poor health condition.

But for Zhong, the worst was yet to come. Someone posted his personal information including his cellphone number, workplace, e-mail address and photos on social media, and his nightmare began.

Soon after his personal information was leaked, he received thousands of calls and 500-600 texts daily for weeks.

"Till now, I cannot use my cellphone. Many people called, e-mailed, tweeted and texted to curse me," said Zhong in early June.

"Even if I did something wrong, the police and the court should deal with me, not netizens. But now I am under attack from Internet violence," Zhong said, adding that his life was in disarray.

Zhong's experience is not unique in China. Through Renrou Sousuo, or "human flesh search," many people's personal information can be found on the Internet. But after June 1, those who want to spread other people's information online should think again before doing so.

The Cybersecurity Law of China, which was adopted in November last year and came into effect on June 1, is widely considered as the basic law regulating China's cyberspace, stressing the protection of personal information. According to the judicial interpretation of the law by the Supreme People's Court and the Supreme People's Procuratorate, which also became effective on the same day, those who provide other people's personal information, such as their identities, photos, names and personal details to the public at large without gaining their consent, could be jailed for up to three years depending on the seriousness of the circumstances.

Keeping it personal

In fact, the new law not only targets individuals who spread others' information, but also the Internet service providers that have collected large amounts of personal information during their online operations.

"Thanks to the rapid development of information technologies such as big data, Internet Plus and the mobile Internet, China is in the leading position in terms of the utilization of Internet-based applications, such as mobile payment," said Ni Guangnan, Academician of the Chinese Academy of Engineering. "While bringing more convenience to people's lives, these applications also collect users' personal information when used, which poses threats to people's information security."

This problem was further highlighted after Xu Yuyu, an 18-year-old high school graduate in Linyi City of east China's Shandong Province, was cheated of all her university tuition money and later died of heart attack last August. The police found that her information, together with that of many other high school graduates nationwide, was hacked from the online university entrance examination information system of Shandong Province.

According to a report on the transparency of users' personal information protection policies of 1,000 major websites and mobile applications recently issued by the China University of Political Science and Law, more than half of them are rated "low" level, including 157 websites and applications that do not provide privacy policies. This means their users' personal information is under great risk of being leaked.

While enjoying the convenience brought by the rapid development of Internet information, people are also facing increasing challenges in their personal information security. "That's why China needs the law regulated in this sector," said Ni.

Harsh punishment

Experts believe that the Cybersecurity Law will play an important role in protecting personal information and regulating cyberspace as it stresses the obligations of Internet service providers.

According to the law, Internet operators are not allowed to leak, change or damage the personal information they gather, and are not permitted to offer personal information to others without the consent of the people involved. They are also obliged to take measures to ensure the personal information they collect is secure.

Those who violate the provisions and infringe on personal information will face fines of up to 1 million yuan ($148,000), according to the law, and if illegal activities have led to profits, violators will face fines of up to 10 times their illegal earnings.

"The law will play a positive role in protecting the personal information of the public, since it not only clarifies the responsibilities of Internet service providers and operators, but also promises heavy penalties for trading personal information," said Wang Sixin, Professor of Law with the Communication University of China.

As of the end of 2016, China had more than 730 million Internet users, almost the same number as the population of Europe. According to a survey conducted by the Internet Society of China, about 84 percent of Internet users in the country say that they have been affected by personal information leaks. Undoubtedly, the implementation of the law will be the shield protecting Internet users' personal information, according to experts.

Blocking hackers

With the rapid development of Internet technology, hackers are also upgrading their methods of stealing information from the Internet. According to Yang Heqing, Deputy Director of the Office for Economic Law of the Legislative Affairs Commission under the National People's Congress, China has the largest netizen population, and is also one of the countries facing the most serious hacker attacks.

The Annual Report on Internet Security 2016 issued by Chinese IT giant Tencent shows that its anti-virus lab discovered 148 million new types of Internet virus in 2016, 67 percent higher than 2012.

In May, the WannaCry ransomware swept the world. The hackers behind the attack demanded money after encrypting computer users' files and locking them out of their computers. Incomplete statistics show that tens of thousands of computers in over 150 countries have been attacked. In China alone, more than $60,000 had gone from Chinese Internet users to the hacker's pockets within 96 hours after the WannaCry virus broke out.

This globetrotting ransomware was allegedly adapted from stolen cyber weapons developed by the U.S. National Security Agency. Insiders noted that protecting key information infrastructure is the most urgent task worldwide to prevent ransomware like WannaCry from operating. Key information infrastructure refers to the information systems and controlling systems in key industries such as energy, telecommunications, finance, transportation and government e-services. If key information infrastructure was hacked, it would lead to great losses to various aspects of a country, and even the entire world.

The Cybersecurity Law has detailed stipulations on how to protect information in key information infrastructure. According to the law, the operators of such infrastructures are obliged to store locally data and personal information collected and produced by their services in China. If they need to provide the data and information for overseas use due to business needs, a security evaluation must be carried out.

The law also allows police and other law enforcement agencies to take necessary measures, including the freezing of assets, against overseas individuals or organizations that "attack, intrude, interfere with or sabotage the nation's key information infrastructure."

"It complies with international conventions for nations to protect their key information infrastructure," said Zuo Xiaodong, Vice President of the China Information Security Research Institute, a government think tank.

Copyedited by Francisco Little

Comments to yanwei@bjreview.com