Get more with myNEWS
A personalised news feed of stories that matter to you
Learn more
Alibaba Cloud, China’s largest cloud service provider, has been accused by the Zhejiang telecoms regulator of violating China’s Cybersecurity Law following a complaint related to a 2019 data leak. Photo: Bien Perez

Alibaba Cloud data leak ‘violated Cybersecurity Law’ in 2019 and must rectify, local Chinese telecoms regulator says

  • The Zhejiang Communications Administration said last month that Alibaba disclosed user information without consent following a complaint about the 2019 incident
  • Alibaba Cloud said it has already taken corrective measures but did not provide details
The telecoms authority of China’s eastern Zhejiang province has told the cloud computing unit of Alibaba Group Holding that it violated the country’s Cybersecurity Law and should make rectifications following a complaint about a 2019 information leak.
In a letter dated July 5, the Zhejiang Communications Administration (ZCA) said it found Alibaba Cloud “disclosed user registration information to a third-party partner without consent, which violated the Cybersecurity Law”. The letter was issued after the bureau received and processed a complaint against China’s largest cloud service provider.

The authority did not identify the source of the complaint or when it was filed.

The ZCA has not published the letter publicly, but its contents were reported by local Chinese media this week, including the newspaper 21st Century Business Herald. The bureau has confirmed the authenticity of the letter.

China Big Tech ‘less powerful’ under Beijing’s tough new data privacy law

Alibaba Cloud said in a statement that the incident took place during the November 11 Singles’ Day shopping festival in 2019, when “a telemarketing employee violated company discipline, privately obtained client contact information and leaked it to a distributor’s staff member”. Alibaba, the owner of the South China Morning Post, said it discovered the issue during an internal probe.

“The company strictly prohibits employees from disclosing user registration information to third parties. The company has seriously handled the case in accordance with company rules, taken active rectification measures as requested by the ZCA and corrected the shortcomings of personnel management,” Alibaba said, without offering further details.

The case has been made public amid increasing scrutiny in China of Big Tech companies’ data-handling practices. China’s Personal Information Protection Law, which goes into effect in November, and China’s Data Security Law, set to go into effect next month, have introduced stricter legal requirements on data service providers in the country.


Why China is tightening control over cybersecurity

Why China is tightening control over cybersecurity
Under the Cybersecurity Law, which has been in effect since June 2017, an order to take corrective measures is the lightest penalty for infringing on rules protecting user data. According to the law, the regulator is authorised to issue a fine of up to 1 million yuan (US$154,000) and to fine responsible individuals up to 100,000 yuan.

For serious violations, the regulator can levy heavier punishments, including suspending or revoking a business license.

Alibaba Cloud, which controls 40 per cent of China’s public cloud market, has been accused of infringing on client rights before., a geographic location database company, complained that the cloud provider copied some of its product data. The two later settled and issued a joint statement in late July that said some Alibaba Cloud staff had violated corporate norms for product development. Alibaba said it would punish the employees involved and prevent similar incidents in the future.

Additional reporting by Jane Zhang

This article appeared in the South China Morning Post print edition as: Alibaba Cloud told to act after data leak complaint