In recent years, ordering food by scanning a QR code has rapidly become widespread in the catering industry. However, some consumers have noticed that when ordering by scanning a code, they are often required to "follow the official account and authorize login to the mini-program," and so on. In this way, the merchant obtains the consumer's personal information. Does such a practice constitute infringement? Let's look at a dispute over infringement caused by QR code ordering ↓

　　The party involved, Mr. Kong, said that in July 2021, he and a friend went to a grilled fish restaurant to dine. The waiter told them that the group needed to order by scanning a QR code, so Mr. Kong operated his phone.

　　Party involved, Mr. Kong: After scanning the code, a page for the official account immediately popped up, and inside there was a follow button, because this was mandatory, with no other option available. After clicking follow, upon entering the official account page, a food-ordering mini-program popped up.

　　Mr. Kong said that when he continued to click on the food-ordering mini-program, a window popped up asking the consumer to "authorize." Only after allowing the merchant to obtain information such as the nickname, avatar, region, gender, and mobile phone number of the consumer's login account could the consumer enter the page for placing an order.

　　Mr. Kong believed that the QR code ordering process set up by the merchant forcibly obtained his personal information, and he also found that even if he unfollowed the merchant's official account, he was still a member, and he could not delete on his own the personal information still stored by the merchant. Therefore, Mr. Kong, on the grounds of infringement of personal information rights and interests, sued the catering company in court, demanding that the other party stop the infringing acts.

　　The first-instance court held that the defendant catering company did not constitute infringement, but should respect Mr. Kong's right to decide on his personal information, and ruled that the catering company delete the personal information related to Mr. Kong.

　　Chen Xiaodong, Chief Judge of the First Civil Division of the Beijing Third Intermediate People's Court: The reason was that when Mr. Kong was ordering food, the restaurant should have informed him that manual ordering service was available, and then Mr. Kong clicked on the WeChat official account, which was also Mr. Kong's own act. Therefore, with regard to forced collection of information, the restaurant did not constitute forced collection and did not constitute infringement of Mr. Kong.

　　Mr. Kong was dissatisfied and appealed to the Beijing Third Intermediate People's Court.

　　In the second instance, the catering company argued that when customers place orders, they always provide both online and manual ordering methods, and never misled Mr. Kong into having to order by scanning a QR code.

　　Presiding Judge Chen Xiaodong: When you went to order food, did they tell you that you could order manually?

　　Appellant Mr. Kong: No. Let me add that after the first hearing, they said that after entering the store, they would definitely first tell you to order manually. On the evening of the same day after the hearing, I went to the store again, and I recorded the whole process. I asked how to order food, and the waiter said to order by scanning a QR code.

　　Mr. Kong said that he tried to cancel his membership by unfollowing the merchant's official account in order to delete the personal information stored by the catering company, but this had no effect. In court, the catering company argued that deleting membership information requires consumers to go to the store and submit a written application.

　　Chen Xiaodong, Chief Judge of the First Civil Division of the Beijing Third Intermediate People's Court: The Civil Code has a dedicated chapter and provisions on personal information protection, and the principles for processing personal information are that it must be lawful, legitimate, and necessary. These acts of the restaurant also, to a large extent, violated the personal information protection provisions of the Civil Code.

　　The second-instance court held that, according to the available evidence, on July 27, 2021, the catering company's service staff did not inform Mr. Kong that he could order manually, misleading him into thinking that QR code ordering was the only service method. The QR code ordering process set up by the catering company on its own required Mr. Kong to follow the merchant's official account and authorize it to obtain Mr. Kong's relevant information, which constituted disguised forced collection of consumer personal information, and the catering company constituted infringement.

　　Chen Xiaodong, Chief Judge of the First Civil Division of the Beijing Third Intermediate People's Court: First, the restaurant shall delete the personal information of Mr. Kong that it has collected; second, it shall inform Mr. Kong in writing of the purpose, method, and scope of collecting such information; third, it shall make a written apology to Mr. Kong; fourth, it shall compensate Mr. Kong for corresponding economic losses, including 5,000 yuan in notarization fees.

　　Setting up QR code consumption should not ignore consumers' right to independent choice

　　In response to this phenomenon, experts believe that when merchants set up QR code consumption, they should not ignore consumers' right to independent choice and right to know.

　　Cai Rui, Assistant Researcher at the Civil Law Research Office of the Institute of Law of the Chinese Academy of Social Sciences: On this issue, the Personal Information Protection Law has a specific provision that merchants must obtain the consent of natural persons to process personal information, and may not refuse to provide services on the grounds that the natural person does not consent. In other words, even if the consumer refuses, the merchant still cannot refuse to provide services at this time.

　　Experts introduced that many merchants entrust the development and operation of QR code ordering mini-programs to third-party technology companies, and the consumer personal data collected through QR codes is also obtained by them. Because it is difficult for supervision to precisely reach third-party companies, this exposes consumers to the risk of data leakage. If information is leaked, lost, or abused, it will bring many troubles to consumers: for example, receiving large numbers of spam text messages, calls, and advertisements, or even encountering fraud.

　　Zhu Wei, Deputy Director of the Communication Law Research Center of China University of Political Science and Law: In serious cases, this may involve, for example, telecom fraud. For example, if they know where you ate, they may call and say, you ate at this place, there is a problem with our food, and now we want to refund your money, and ask you to click a link. In fact, consumers originally would not believe such lies, but if they know where you ate and what you consumed, consumers may believe that the refund is real.

　　QR code consumption should not be a single-choice question, and consumers' personal data should be properly protected and used. At present, regulatory authorities in many places have issued compliance guidelines on QR code consumption services to regulate local business practices in QR code consumption services. Experts believe that, on the one hand, merchants should, in accordance with laws and regulations, follow the principles of legality, legitimacy, necessity, and good faith in collecting and processing consumers' personal information. On the other hand, consumers also need to raise their awareness of personal information protection, avoid unnecessary information leakage, be brave enough to say "no" to unreasonable demands from merchants, and safeguard their own lawful rights and interests.