"All the information about buyers and sellers is stored in a database, so agents can trace the clients and call them back," said a real estate agent in Beijing, who asked to be known simply as "Wang".

Wang said agents are required to record the demands and preferences of potential clients they speak to by phone. This enables agents to find apartments suited to the demands of specific customers. "Every time an agent calls a client, a large number of details are entered on the agency's database, so agents will have clearer picture of the customer's needs," he said.

Wang revealed that his fellow agents are required to call at least 10 people each day and take 10 to view the apartments on sale. Otherwise, the agents will be fined 10 yuan ($1.58) to 50 yuan, he said.

"For various reasons, a client might not follow up on promises to view apartments. If the agent thinks the person is not worth following up, they will usually pass the client's number to colleagues," Wang said.

Wang said personal information, such as mobile numbers, is a good means of making extra money. "I can either sell an apartment to the client myself, or share a cut of the proceeds if I give a number to a colleague who then sells an apartment to the client," he said.

Personal information disclosure has now spread from the physical world to cyberspace. In 2011, the Chinese Software Developer Net, the biggest online IT forum for Chinese users, was hacked, resulting in 6 million usernames and passwords being exposed to netizens.

Gathering information is a highly secretive process and it's hard to detect those making use of private information on and off the Internet, said Zhou Qingshan, deputy dean of the information management department at Peking University.

In March 2012, Shanghai police cracked down the online trade of private information about drivers, students and businesses. Each bundle of information could earn the brokers 90 to 100 yuan, according to local media reports.

Currently, many Internet users submit a host of private information online when they register for accounts, but they may not realize how that information is used, said Zhou Hanhua, a researcher at the law institute of the Chinese Academy of Social Sciences.

"Collecting user data and selling the information to a third party can bring great rewards to businesses. That's why many online operators and Internet company employees still secretly collect data," said Zhou.

Legislation urged

The complexity of collecting evidence and proving that it has been used illegally makes the task of defending people's privacy almost impossible. A survey conducted by China Youth Daily in 2012 showed that more than 30 percent of complainants gave up on attempting to claim their rights concerning personal details because of the high costs and the inconvenience of the process. "To some extent, the punishment for violators and the difficulties of fighting fraudsters has lowered confidence in the individual's ability to protect their personal data," said Professor Zhou Qingshan.

Now there are several articles in at least three laws and regulations to govern personal information protection, but the collection of personal data is still reliant on industry self-discipline, said Xie Shoufen, law professor at Fudan University in Shanghai.

In a previous interview with China Daily, CASS researcher Zhou said there is an urgent need to enact laws to protect personal information and impose serious penalties on those who invade Internet privacy. "We only have a legal framework and some basic principles, but they are all difficult to enforce and don't threaten those who engage in this sort of enterprise," he said.

He added that some personal details held on particular websites, such as those run by medical centers, banks and media companies, have been leaked, and what the public knows about the problem might be only the tip of the iceberg.

Peking University's Zhou Qingshan said individuals must be aware of the type of information that can be safely left with a third party or registered online and what cannot. "The protection of personal information has to be achieved through cooperation between the government, legislators and the relevant businesses. The most efficient way of solving the problem of personal data disclosure is to enact clear laws that carry firm punishments," he said.

Experts also said transparent lines of supervision are a necessity to prevent any possible infringements of individual rights.

A draft law on the protection of personal information was completed in 2008, but is still being modified by the legislators. Although the country's top legislature, the National People's Congress, published a proposal on improving the protection of personal information at the end of 2012, no time scale for implementation has yet been unveiled.

"Only if all parties involved do their best to guard private data closely will personal information be safe and people's lives left undisturbed," said Liu Fawang, deputy director of the China Software Testing Center.

Tang Yue and Cao Yin contributed to this story.

 Related:

Software testing a crucial defense