China Justice Observer

中司观察

EnglishArabicChinese (Simplified)DutchFrenchGermanHindiItalianJapaneseKoreanPortugueseRussianSpanishSwedishHebrewIndonesianVietnameseThaiTurkishMalay

China Imposes Administrative Penalty against Didi for Cybersecurity

Mon, 29 Aug 2022
Categories: China Legal Trends

On 21 July 2022, the Cyberspace Administration of China (CAC) fined Didi Global (hereinafter “Didi”) CNY 8.026 billion and two Didi executives – CEO Cheng Wei and president Liu Qing – CNY 1 million apiece.

In July 2021, the CAC launched an investigation on Didi’s cybersecurity practices and then, based on the issues and clues found in the investigation, filed a case against Didi for the company’s alleged violations.

Didi was founded in January 2013 and listed on the New York Stock Exchange on 30 June 2021. Its principal businesses include online ride-hailing and ride-sharing services.

According to the CAC, Didi had committed a total of 16 violations.

For one thing, Didi had excessively collected personal information and compulsorily collected sensitive personal information. More precisely, it had illegally collected screenshots, copy-and-paste content, and lists of installed apps from users’ phones and excessively gathered passengers’ facial recognition data, ages, occupations, and interpersonal relationships, as well as drivers’ educational background and personal identity information, etc.

For another, Didi failed to fulfill its obligation to inform users about its processing of their personal information. It had analyzed passengers’ travel intentions without explicitly informing them and failed to clarify what it had done with users’ device data and other 18 items of personal information.

The above-mentioned actions violated China’s Cybersecurity Law, Data Security Law, and Personal Information Protection Law.

 

 

Cover Photo by Cheng Huang on Unsplash

Contributors: CJO Staff Contributors Team

Save as PDF

Related laws on China Laws Portal

You might also like

ABLI-HCCH webinar: Cross-Border Commercial Dispute Resolution – Electronic Service of Documents and Remote Taking of Evidence (July 10, 2025)

The Asian Business Law Institute (ABLI) and the Hague Conference on Private International Law (HCCH) will host their fourth joint webinar on July 10, 2024 (5:00–6:10 PM SGT), focusing on electronic service of documents and remote taking of evidence under the Service and Evidence Conventions, featuring expert speakers, with an early bird discount available until June 10.

China Tightens Corporate Personal Data Audit Rules

In February 2025, China's Cyberspace Administration issued the "Measures for the Administration of Personal Information Protection Compliance Audits", effective May 1, 2025, mandating regular audits for companies, especially those processing data of over 10 million individuals, to ensure transparency and legality in personal data handling.

SPC Releases Typical Cases on Telecom Fraud Crimes

In February 2025, China's Supreme People's Court (SPC) released eight typical telecom fraud cases, exposing new criminal methods and highlighting intensified judicial efforts after handling 31,000 such cases in 2023.

SPC Targets Cyber Extortion with Typical Cases

In February 2025, China’s Supreme People’s Court (SPC) released six typical cases showcasing its crackdown on emerging cyber extortion crimes, including spreading rumors and sextortion, to encourage victims to seek legal protection.

China Issues New Rules on Foreign-Related IP Disputes

In March 2025, China issued regulations effective May 1, 2025, to enhance dispute resolution, evidence collection, and countermeasures for foreign-related intellectual property disputes, strengthening services and enterprise capabilities.

SPC Issues China’s First Anti-Anti-Suit Injunction (AASI) in IP Case

In December 2024, China’s Supreme People’s Court (SPC) issued its first anti-anti-suit injunction in a patent dispute, Huawei v. Netgear, prohibiting Netgear from obstructing Huawei’s Chinese litigation, marking a significant step in global standard-essential patent governance.

SPC Launches Diversified Dispute Resolution Case Database

In February 2025, China's Supreme People's Court launched a public “Diversified Dispute Resolution Case Database” with over 200 cases, showcasing mediation and arbitration examples across various dispute types to guide alternative dispute resolution.