Hotpot restaurant "scan code to order food" collects personal information, court rules to stop infringement
Lawyer: Merchants must obtain explicit consent to obtain consumer information
Are consumers' WeChat avatars, nicknames, regions and genders personal information stipulated by law?
Is it illegal for a restaurant to extract the above information without authorization when "scanning the QR code to order food"?
Recently, the Jingyang District Court of Deyang City heard a case. A consumer was asked to scan the QR code to order food while dining at a hotpot restaurant. The consumption has nothing to do with the merchants infringing on their personal information.
After the trial, the court ruled that the hot pot restaurant should stop the infringement.
In response to such "scan code ordering" problems, Guo Xiaoming, a lawyer at Shanghai Zhonglian (Chengdu) Law Firm, believes that consumers can choose their own way of ordering meals, and businesses must obtain explicit consent to obtain consumer information.
Follow the official account to order food consumers sued for infringement and won the court's support
Luo went to a hot pot restaurant in Deyang urban area for dinner, and the waiter told him that he must pay attention to the WeChat public account of the hot pot restaurant before ordering, otherwise the service could not be provided.
Luo proposed to order with a paper menu, but was rejected by the waiter.
In order to continue the service, the waiter used Luo's mobile phone to follow the store's WeChat public account without consent to order food.
When entering the WeChat public account of “Deyang ××× Hot Pot”, the page prompts “Deyang ××× Hot Pot Application to Obtain: Your Wechat Avatar, Nickname, Region and Gender Information”, although there are two options of “Reject” and “Allow”, But you can only order after clicking "Allow".
Luo believes that the collection of personal information by the hot pot restaurant is neither legal nor justified, nor necessary, and violates his personal information. Therefore, he sued the Jingyang District Court of Deyang, asking the hot pot restaurant to delete personal information and apologize.
The hotpot restaurant believes that the WeChat avatar, nickname, region and gender are online pseudonyms, and there is no risk of infringing on personal information.
The court held that it was not necessary for Luo to provide information unrelated to food and beverage consumption, such as mobile phone number, birthday, name, geographic location, address book, etc.
The official account of the hotpot restaurant forced the collection of Luo's WeChat profile picture, nickname, region and gender information, which violated the legal provisions of the legal, legitimate, and necessary principles for the collection and use of personal information, and violated Luo's personal information.
The Jingyang District Court ruled that the hot pot restaurant should stop the infringement and delete the personal information of Luo within 10 days from the date the judgment took effect.
Relevant path identification personal information should be protected by law
Peng Shiwen, a post judge of the People's Court of Jingyang District, Deyang City, introduced that according to the relevant provisions of the Civil Code and the Personal Information Protection Law, there are actually two paths for the definition of personal information, one is "identification" and the other is "association".
The identification path is from information to individuals, that is, specific natural persons can be identified through relevant information.
The WeChat profile picture, nickname, region and gender information extracted by the defendant in this case, even if several kinds of information are combined, usually cannot identify a specific natural person except for units or individuals with a specific relationship with the plaintiff.
At this time, the information is not legally protected personal information.
The association path is from an individual to information, ie a given individual is known and further information is known "about" that individual.
The information that can be associated with a specific individual is not premised on specificity, and its function is to enrich the existing personality image of a given individual, so that others can know more about the individual.
The plaintiff dined at the defendant’s place and used WeChat to scan the code. The plaintiff was a known and established individual, and the restaurant learned the plaintiff’s WeChat account, nickname, region and other information by extracting information. This information is the plaintiff’s personal information and should be protected in accordance with the law.
In this case, the consumers themselves were at the scene, and the WeChat avatar, nickname, region and gender extracted by scanning the QR code to order food belong to the associated path and identify the personal information, which is "personal information" stipulated by law and should be protected.
Lawyer's point of view
Consumers can choose their own way of ordering. Merchants must obtain consent to obtain consumer information.
Guo Xiaoming, a lawyer from Shanghai Zhonglian (Chengdu) Law Firm, believes that scanning a QR code to order food in restaurants actually involves two legal issues: consumers' right of choice and whether they violate personal privacy.
First of all, consumers have the right to make their own choices when dining in restaurants. They can choose from paper menus, counter orders, and QR codes. Merchants are not allowed to force consumers to scan QR codes to order.
Regarding whether "scanning and ordering" violates personal privacy, Guo Xiaoming believes that this is not absolute, and needs to be comprehensively considered from the two aspects of "consumer authorization and consent" and "merchant's strict protection and management of the information obtained".
According to the relevant provisions of the Personal Information Protection Law, merchants must obtain the explicit consent of consumers when they need to obtain consumer information.
"If consumers agree to order food in this way, and also agree to obtain information including avatars, nicknames, phone numbers, etc., the merchants cannot count as infringement." Guo Xiaoming said.
In addition, when merchants obtain consumer information content, whether it is legitimate, legal and necessary is also one of the issues that needs to be considered.
West China Metropolis Daily - Cover reporter Dai Zhuxin