MORE THAN 300 MILLION PIECES of delivery information from SF Express, one of the largest express delivery companies in China, are being sold on the internet. The information includes names, telephone numbers and addresses. Beijing News comments:

The protection of personal information faces unprecedented challenges in the information age, as technology makes it much easier to steal and trade massive amounts of personal data. This is only the latest serious personal information leak.

Statistics show China has 52 laws, 42 administrative laws and rules, 50 judicial interpretations, 870 government department rules, 43 social organization rules, and 171 industrial regulations on personal information protection.

But all these institutional arrangements have failed to prevent the rampant growth of the market for personal data that has become almost fearless on the internet. One of the things that needs to be addressed is the laws and rules stress punishment after the event, and they lack effective preemptive force, particularly over the enterprises, whose liabilities as the data collectors and users have long been overdue, if not ignored.

That explains why SF Express' first reaction to the leaking of its customers' privacy has been to pass the buck to the alleged data thieves, and portray itself as an innocent victim.

As previous cases indicate, it is not hackers but internal "ghosts" who are involved in the trade of personal information. The companies should identify the insiders responsible and surrender them to the police, portraying these employees as a few bad apples does not absolve them of their responsibilities to protect the personal information they collect.

Before the legislature revises the laws to highlight the companies' responsibilities in these cases, and hold them accountable for their data leaks, the consumers will continue to be lambs in wolf packs, and the data thieves will continue to play a cat-and-mouse game with the police.