Cyber security Photo: IC

A 25-year-old graduate from the prestigious Renmin University of China (RUC) has been detained by police for illegally obtaining personal information of some university students. Experts said the high-profile case has exposed data protection gaps in Chinese universities, whose information is related to talent competition and national security.  

The police made the announcement on Monday after online posts went viral over the weekend. The posts claimed Ma, the graduate, stole photos and personal information of both undergraduate and postgraduate students of the university when he was studying there. Ma allegedly used the information to create a website that rates the physical appearance of female students.

The website collected students' names, student IDs, dates and regions of birth, according to screenshots circulating online.

Ma reportedly joined the Gaoling School of Artificial Intelligence (GSAI) affiliated to the RUC in 2019, has now graduated, and joined Tencent. The information is yet to be confirmed by the RUC.

The RUC said on Sunday night that it has been cooperating with the police on further investigation. 

The university strongly condemned the act of infringing privacy and harming information security in its notice. 

The post about the student's detention was viewed more than 500 billion times within two hours. Most netizens decried Ma's action as "creepy." "It really made the hair stand up on the back of my neck thinking how easily he could obtain so much information about his fellow students, and the fact that such a highly educated person can be ignorant about law," CKeiji, a Sina Weibo user, commented. 

"Hard to imagine what he is capable of given his job involves dealing with information," said another Sina Weibo user.

Liu Changsong, a lawyer with Beijing Mugong Law Firm, told the Global Times on Sunday that the person who sells or provides personal information of a citizen to another person, if the circumstances are serious, shall be sentenced to a fixed-term imprisonment of no more than three years or criminal detention and a fine.

The incident has touched Chinese public's nerve about personal information breach. A Guangzhou company was fined 50,000 yuan ($6,839) last year after more than 10.7 million pieces of personal information stored in the company's database were leaked. 

China's law on personal information protection came into effect in 2021. Activities such as collection, processing and trading of personal information are strictly monitored, and any related infringements are to be punished, according to the law.

Wang Sixin, a law professor at the Communication University of China, told the Global Times that Ma's case has sounded the alarm for universities to strengthen protection of students' personal data. 

Government institutes and companies have fully shored up defenses against data leakage in recent years, but universities are a weak spot, said Wang. He pointed out data protection in universities is of great importance because students' information is crucial for talent competition, and universities' data sometimes also involves national security. 

Some universities are gradually strengthening protection of their data. For example, China's Zhengzhou University published a notice in 2020 to classify their data into three categories: public, internal and sensitive. It said internal and sensitive data can only be transmitted via special and encrypted channels, and cannot be sent via traditional communication platforms such as email or message apps.