Recently, several universities in mainland China have been exposed for forcibly collecting personal information such as ID numbers, work units, and income of new students and their parents. Some schools even shared forms through class group chats, making hundreds of students’ personal information visible to each other, sparking concerns about excessive data collection and privacy breaches.
According to a report by “Southern Metropolis Daily” on September 18th, a first-year graduate student at Zhejiang Normal University found out while doing online registration that the system required them to fill out 12 items each for their father and mother, including ID numbers, religious beliefs, political affiliations, health conditions, work units, unit addresses, and average monthly incomes.
Initially, all of these data fields were marked as required and couldn’t be skipped. Shortly after the post was made public, some netizens pointed out that the system had changed some fields, such as work unit addresses and monthly incomes, to optional. As of the report’s publication, Zhejiang Normal University had not responded to the issue.
Similar situations have been reported in other universities as well. A medical vocational school in Shandong province was criticized for demanding new students to provide information about their family’s annual income, work units, and positions, stating that failure to do so would result in inability to pay fees or complete registration. A undergraduate institution in Qinhuangdao, Hebei province was also exposed for requesting information about family’s annual income. None of the schools involved had responded to the accusations by the time of publication.
Some netizens questioned, “What do my parents’ occupations, incomes, and my education have to do with each other?” There were also inquiries about the significance of providing such detailed information for university life.
In addition to forced data collection, some universities have been processing student information through group chats and shared forms, directly exposing personal information to other classmates.
In April this year, a university student who signed up for a campus marathon found out that their registration information had been exported and shared in a messaging group. The public form displayed students’ names, ID numbers, phone numbers, clothing sizes, and emergency contact information. After the student raised objections, the ID number field was finally removed.
A university student named “Sweets” told “Southern Metropolis Daily” that class groups often use shared forms to collect phone numbers, ID numbers, home addresses, internship units, and whether students planned to pursue further education. Once filled out, all classmates could access this information.
Another graduate named “Ran Ran” mentioned that the school distributed a form regarding graduates’ destinations to the class group, allowing over 200 people to view detailed information, stating that there was “no privacy at all.”
In 2020, a university in Zhengzhou experienced a data breach involving nearly ten thousand students, including leaked information such as names, ID numbers, majors, and dormitory room numbers, which were later circulated on WeChat and QQ. The school later admitted that the staff lacked awareness of confidentiality, leading to the data leak during the organization of student lists.
Pan Helin, a member of the China Industrial and Information Technology Commission’s Committee of Experts on Information and Communication Economy, stated that schools can collect emergency contact numbers from students on a voluntary basis, but parents’ ID numbers, monthly incomes, and work units are not necessary information and should not be mandatory.
Xia Hailong, a lawyer from Shanghai Shenlun Law Firm, mentioned that even for security reasons, schools should only request students to voluntarily provide family contact information. Faced with mandatory fields such as ID numbers, incomes, and work units, students and parents have the right to refuse.
According to China’s relevant privacy protection regulations, collecting personal data should be directly related to its intended use and limited to necessary scope. However, the cases of forced data collection and public sharing of student information in many universities indicate that these regulations have not effectively prevented such practices.
“Southern Metropolis Daily” commented that despite the implementation of privacy protection regulations for many years, some universities still forcibly and excessively collect parents’ information and share students’ personal information through shared forms, reflecting a lack of basic awareness of legal risks among some administrators. The commentary also questioned why universities freely collect and disclose student information but rarely do the same for faculty and staff, raising concerns about this differential treatment.