Illegal Cross-Border Data Transfer: Chinese Travel Giant Ctrip Fined

Amidst an anti-monopoly investigation, Chinese travel giant Ctrip has recently been heavily fined 10 million RMB (approximately 47 million NTD) by the Shanghai Cyberspace Administration for illegally transferring personal information out of the country. Although this is a drop in the bucket for the incredibly profitable Ctrip, it confirms users' previous suspicions that Ctrip had leaked personal data. The Shanghai Internet Information Office announced today (13th) that recently, under the guidance of the National Cyberspace Administration, the Shanghai Cyberspace Administration has handled a number of enforcement cases concerning local enterprises that failed to fulfill their network data security responsibilities, lacked security management and protection measures, had insufficient compliance capabilities in backend data processing, and had lax compliance audits for data transfers abroad. The notice mentioned that, specifically targeting Shanghai Ctrip Business Co., Ltd. for failing to implement data export security assessment requirements and illegally transferring personal information, an administrative penalty of a 10 million RMB fine was imposed in accordance with the 'Personal Information Protection Law', and the company was ordered to rectify the issue within a specified period.