Didi Global data security enforcement case

On 21 July 2022, the Cyberspace Administration of China (CAC) imposed a fine of RMB 8.026 billion — roughly $1.2 billion — on ride-hailing leader Didi Global, closing a year-long cybersecurity review. It was the largest data-protection penalty in Chinese history and one of the first to invoke all three pillars of China's new data regime at once.

Background

Just two days after Didi's $4.4 billion New York IPO on 30 June 2021, the CAC announced a cybersecurity review and, within days, ordered Didi's app removed from Chinese app stores. Twenty-five associated apps were pulled for illegal collection of personal information. The timing — immediately following an overseas listing the regulator had reportedly discouraged — led many observers to read the action as partly a message about data sovereignty and offshore listings.

The violations

The CAC concluded that Didi had committed 16 distinct violations spanning conduct from June 2015 onward, breaching the Cybersecurity Law (2017), the Data Security Law (Sept 2021) and the Personal Information Protection Law (Nov 2021). Regulators said Didi had illegally collected, among other things:

• Screenshots and clipboard contents from users' phones
• Tens of millions of pieces of facial-recognition data and precise location/GPS records
• Driver and passenger identity, occupation, family relationship and travel data
• Data processed in ways that endangered national data security

The CAC framed the conduct as large-scale over-collection affecting Didi's hundreds of millions of users and drivers, rather than a single external intrusion.

Impact

• RMB 8.026 billion (~$1.2 billion) corporate fine.
• Personal fines of RMB 1 million each against Didi's chairman/CEO and president.
• Didi delisted from the New York Stock Exchange in June 2022 amid the pressure and saw its app suspended from Chinese stores for roughly a year.

Why it matters

The Didi case is the landmark enforcement action of China's modern data-protection era. Unlike a breach driven by hackers, it established that excessive, non-consensual data collection is itself a punishable security failure under the CSL/DSL/PIPL framework, with penalties scaled to a percentage of revenue in the GDPR mould. It also signalled that Beijing treats large pools of citizen mobility and biometric data as a matter of national security, with direct consequences for where Chinese tech firms may list and how they may handle data.