Chinese Travel Giant Ctrip Fined for Illegal Cross-Border Personal Data Transfer

(CNA, Taipei, 13th) Amid an antitrust investigation, Chinese travel giant Ctrip has been fined 10 million RMB (approximately 47 million NTD) by Shanghai's Cyberspace Administration for illegally transferring personal user data overseas. While this amount is negligible for the highly profitable Ctrip, it effectively confirms users' prior suspicions about personal data leaks.

Shanghai's Internet Information Office announced today that, under the guidance of the national Cyberspace Administration, it recently handled a series of enforcement cases targeting local enterprises for failing to fulfill their primary responsibilities for network data security, lacking adequate security measures, insufficient compliance capabilities in backend data processing, and inadequate compliance audits for data cross-border transfers.

The announcement specifically states that Shanghai Ctrip Business Co., Ltd. was penalized for failing to conduct required data transfer security assessments and for illegally transferring personal information overseas. Under the 'Personal Information Protection Law,' the company has been fined 10 million RMB and ordered to rectify the violations within a specified timeframe.

The notice adds that after the penalty, Ctrip has actively cooperated and fully implemented the required corrective measures.

Shanghai's Cyberspace Administration emphasized that since the beginning of this year, enforcement actions have revealed that some internet companies in the public welfare sector continue to engage in illegal cross-border transfers of personal information. The authority will further strengthen enforcement to crack down on all types of cyber violations that endanger network and data security, infringe upon personal information rights, and disrupt economic and social order.

The Shanghai Cyberspace Administration did not disclose specific details about how Ctrip illegally transferred personal data.

Prior to this, on September 1, 2025, Ctrip signed a marketing cooperation agreement with Cambodia's National Tourism Authority to promote tourism in Cambodia. This triggered strong skepticism among Chinese users regarding the safety of traveling to Cambodia, with concerns that Ctrip might leak user data to local gray-market or illegal industries, potentially leading to online fraud. This sparked a temporary wave of account cancellations. Ctrip later claimed that the partnership did not involve data sharing and would not compromise user privacy.

Ctrip reported a profit of 33.294 billion RMB in 2025, equivalent to over 90 million RMB in daily earnings. After news of the 10 million RMB fine spread, many Chinese netizens criticized the penalty as too lenient, with numerous users expressing fears that their personal data may already have been leaked.

On January 14, China's State Administration for Market Regulation announced it had launched an investigation into Ctrip Group for suspected abuse of market dominance and monopolistic practices. Ctrip holds over 70% of the total market share and has previously been summoned multiple times by local regulators for infringing upon user and merchant rights.