Penalties for non-compliance
What are the penalties for non-compliance?
Violation of Anti-Unfair Completion Law, Law on the Protection of Consumer Rights and Interests, Cyber Security Law and related regulations
Sanctions are proportionate to the breach and routinely commence with requests to amend or terminate the non-compliant promotions. Fines ranging from ¥50,000 (approx. US$7,270) to ¥500,000 (approx. US$72,700) can be imposed against the promoter in breach depending on the circumstances. Also consumers who suffered from an infringement arising from an unfair competition can sue the promoter for compensation. Promoters who engage in fraudulent practice in the provision of goods or services must, on the demand of the consumers, compensate the consumers for their losses and damages (three times the value of the goods/services paid by the consumers but not less than ¥500 (approx. US$73)).
In addition, the penalties for non-compliance with certain requirements can be subject to a public announcement by the relevant authorities which can lead to brand and reputational damage.
If the promotion is deemed an illegal lottery, sanctions include criminal detention (1-6 months) or a prison term of up to 5 years, and/or a fine of up to 5 times the value of the illegal gains. In extremely serious cases, the sanctions will be a prison term of not less than 5 years plus a fine of up to 5 times of the illegal gains or confiscation of property.
Data privacy breaches
Sanctions in relation to data privacy breaches follow a graded approach - warning and requirement to comply, then possibly fines of one to ten times the value of the unlawful income and confiscation of unlawful income; or fines of up to ￥1,000,000 (approx. US$145,450) if there is no unlawful income. In severe cases, the sanction could, for example, be suspension of the relevant business, revocation of the business license or the license to conduct the relevant business, and the closure of a website. Persons held responsible will be subject to fines from ￥10,000 (approx. US$1,450) to ￥100,000 (approx. US$14,545), and could be prohibited from engaging in relevant businesses and their conduct could be recorded in their social credit files. For illegal provision or sale of personal data to third parties, the responsible person could be subject to administrative detention with fines of one to ten times the value of the unlawful income and confiscation of unlawful income; or fines of up to ￥1,000,000 (approx. US$145,450) if there is no unlawful income, in cases where no criminal offense is committed. Where the illegal provision or sale of personal data constitutes a criminal offense, the responsible person will be subject to up to 7 years imprisonment, and potentially a concurrent fine will be imposed on the organization if applicable.