Introduction:Scanning a QR code to order food when dining out has become the norm nowadays, but did you know that many dining mini-programs forcefully request personal information such as phone numbers? A catering company in Shanghai was fined 50,000 yuan by market regulators for requiring customers to authorize their phone numbers to place orders without explaining the purpose. This article will guide you through relevant personal data protection regulations and how to avoid leaks of your personal information.

With the widespread adoption of mobile payments, QR code ordering has become a basic service in bubble tea shops and restaurants. However, many people using these ordering mini-programs often overlook a key issue — the system usually asks you to authorize your phone number, and sometimes even more personal information. In October this year, the Market Supervision Administration of Putuo District, Shanghai, investigated a case that drew public attention to personal data protection.

The involved catering company had placed QR codes on every dining table, and customers were required to scan them to place orders and make payments. However, to use this service smoothly, customers had to agree to authorize their phone numbers, and the system provided no explanation regarding the purpose or use of this authorization.

More worryingly, the investigation found that the company’s backend system not only stored sensitive information such as members’ names, genders, phone numbers, and card balances, but also allowed system operators to freely access and download this data. These details had no confidentiality measures in place, making it easy for anyone to view them.

In response to this situation, the Market Supervision Administration of Putuo District, Shanghai, determined that the catering company had violated regulations under Article 29 of the Consumer Rights Protection Law, issuing a warning and imposing a fine of 50,000 yuan.

According to Article 29 of the Consumer Rights Protection Law, businesses must adhere to the principles of legality, legitimacy, and necessity when collecting and using consumers’ personal information. They are required not only to clearly state the purpose, method, and scope of collection, but also to obtain the consumer’s consent. Additionally, appropriate technical and management measures should be taken to ensure information security, prevent the leakage or loss of personal data, and immediately initiate remedial mechanisms if issues arise.

However, such misuse of personal data is not an isolated case. Nowadays, whether at bubble tea shops, breakfast stalls, or convenience stores, consumers are often guided to scan codes, follow official accounts, register as members, or even asked to provide information such as names, phone numbers, addresses, or even ID numbers. Many consumers can’t help but wonder: is this information truly necessary for business operations, or is there another motive?

Many people are concerned that their phone numbers and personal data might be used for marketing purposes or even sold to other organizations, leading to constant harassment from calls and messages. In response to such chaos, China officially implemented the Personal Information Protection Law in November this year, which imposes stricter penalties than the Consumer Rights Protection Law, with significantly higher maximum fines.

This case of the Shanghai restaurant being fined serves as a reminder that while enjoying the convenience of technology, we must also stay vigilant and protect our personal information. The next time you scan a code to order food, if the system requests unnecessary personal data authorization, take a moment to ask yourself: is this really necessary?

The above content is compiled by CoffeeHunters, a coffee news website.