Abstract: After a third party obtains personal information from the personal information processor, his acts of tort may lead to damages to personal rights and property rights, such as violation of privacy or life and social discrimination. The basis of victims' claims for damages includes tort liability, breach of contract liability and trust relationship between the individual and the information processor. In Chinese law, such claims should be limited to tort liability, so as to balance freedom of behavior and protection of rights and interests. Information processors bear negative and positive security obligations to individuals. The former requires processors to ensure the security of personal information, while the latter requires processors to ensure that third parties do not abuse personal information to infringe on personal rights and interests, and these obligations are stronger than the security obligations of ordinary business operators. The predictability of the occurrence and types of downstream damages is the core element in judging whether personal information processors are responsible for downstream damages. There is a causal relationship between the behavior of the information processor and the downstream damages, but it bears only tort liability for the downstream tort damages with typical social significance, not the liability for damages caused by a third party who intentionally harms the life and health of a natural person. Information processors should bear joint and several liability, share liability and supplementary liability for downstream damages in light of different situations.

Keywords: personal information infringement; identity theft; security obligation; foreseeable; third party behavior intervention

Author:Xie Hongfei, a research fellow at CASS Institute of Law and the Center for Private Law Studies of CASS Institute of Law, and a doctoral supervisor at the University of Chinese Academy of Social Sciences.

Source: 1 (2022) Journal of Law Application.