On the basis of evidence collected, the police found that some employees of financial institutions, telecommunication companies and other organizations with massive personal databases were selling on customers' personal information.

The China Software Testing Centre (CSTC), an institution affiliated with the MIIT, estimates that 70 to 80 percent of personal information thefts in China are perpetrated by insiders, and that currently many service providers give their employees access to customer information without proper authorization.

The buyers include information intermediaries and unlicensed investigation agencies, which profit by reselling the data to others at a higher price, sometimes even 100 times the original price, said Liao Jinrong, Deputy Director of the MPS's Criminal Investigation Department.

An official surnamed Liu with the Baoding City Industry and Commerce Administration in north China's Hebei Province gathered large amounts of registered companies' information and sold each piece of information, such as an address and telephone number, for 5 yuan ($0.79), the Beijing Times reported on April 26.

For shareholders' data, he asked for 20 yuan ($3.17) for each mobile phone number or identification card number.

Between 2010 and this April, Liu made nearly 60,000 yuan ($9,523.81) from the illegal trade in personal information.

Legal efforts

Liu Tao, a researcher with the CSTC, said that the public is mostly concerned about the security of user information obtained by financial and telecom sectors. He compares the information to money put in banks made of paper.

In April, the MIIT, along with 30 other departments, finished drafting guidelines for personal information protection in public and business services and submitted the document to the Standardization Administration for technical approval.

"There is an urgent need for guidelines to protect user information. Such guidelines will offer a reference to enterprises so that they can voluntarily set up systems to prevent user information from being hacked," said Zhu Xuan, Assistant Director of the CSTC.

Zhu added that there are currently few laws and regulations in China protecting personal information, and the establishment of such guidelines will also help to expose enterprises that do not protect their users' information properly.

The new guidelines will clarify basic principles for personal information protection and provide detailed standards on collecting, processing, transferring and deleting this data, said Ouyang Wu, Deputy Director of the MIIT's Department of Information Security Coordination, in an interview with the Beijing Times.

According to the official, the guidelines will be supported by related standards regarding technology safeguards, auditing, management and authentication. "These standards will help determine responsibility before disputes occur and drive enterprises to act in accordance with the guidelines, among those is the 'prevention first' principle," Ouyang said.

The government will also encourage third-party institutions to participate in the investigation of enterprises, he pledged.

According to Ouyang, the national standards for personal information protection are expected to come into being in the first half of this year.

But experts are also worried that the new standards will not have enough influence on the IT industry, as they are not obligatory.

The new guidelines are actually "technical guidance," said Zhu with the CSTC. Technical guidance documents are usually taken as references for industrial operation.

"We should first do market research to gauge public reaction to this," Zhu said. "And we are trying our best to pass a law concerning personal information protection."

Experts have called for new legislation following the mass leaking of personal information in last December.

Zhou Hanhua, a researcher with the Institute of Law of the Chinese Academy of Social Sciences, said China still lacks a comprehensive law to protect personal information.

According to a report provided by Qihoo 360, a leading Internet security service provider in China, in February, more than half of Chinese websites have gaps in their security and as many as 36 percent carry "high-risk vulnerabilities."

"We are in dire need of speeding up information security legislation in order to perfect the web security system and strictly carry out the responsibility system," said Shi Xiaohong, a security expert with Qihoo 360.

The Criminal Law amended in 2009 stipulates that those working in government departments, financial institutions, telecommunications firms, and transport and education departments will face criminal charges if they sell personal information. Under the law, selling or illegally providing personal data to third parties could lead to three years of imprisonment.

However, it fails to clarify whether it applies to other institutions or enterprises that can also easily obtain personal information, such as banks, hospitals and telecom companies.

The country has been considering the law on personal information protection since 2003 but has made slow progress because experts are divided on what information should be protected, according to Ouyang.

Email us at: yinpumin@bjreview.com