Police in eastern China have arrested 39 people suspected of illegally obtaining and selling the personal information of millions of citizens, raising concerns about online security and privacy.

The suspects collected an estimated 3.7 million items of information from the disease control and prevention center in Hangzhou, Zhejiang province, some of which pertained to children registered for vaccinations, police announced Tuesday in a post on microblog platform Weibo. The data were being sold to businesses such as education agencies and insurance companies for as little as 0.7 yuan ($0.10) apiece.

Police added that a man surnamed Huang, the head of the company that managed the center’s website, had been “driven by the desire to profit” when he directed his staff to indulge in the criminal act. The disease control and prevention center had contracted Huang’s unnamed, financially strapped firm, which specializes in providing health information management services for children up to 6 years old, in 2016 under the condition that it would not record or download any content from the center’s website.

Authorities in Hangzhou said without elaborating that they began investigating the case in March after the city’s internet police noticed the unusual transfer of personal information through their monitoring system. That same month, Hangzhou police also initiated a citywide crackdown to curb the online sale of personal information. Police have since uncovered 37 such cases worth some 7 million yuan.

Huang and his team had raked in over 2 million yuan from selling private information since September 2016, police said. Five of the 39 suspects, including Huang, were transferred to the local procuratorate, where they await legal action.

Businesses or their employees are frequently discovered to be selling personal data, raising questions about digital security in a country where an estimated 751 million people are connected to the internet. In June, 22 people were detained for allegedly selling Apple customers’ personal data valued at over 50 million yuan. And last year, a Southern Metropolis Daily investigation revealed that personal and confidential data could be obtained relatively easily on China’s black market, albeit at a steeper price of around 700 yuan per item.

On May 31, China enacted a new cybersecurity law to better protect net users’ personal information. The law explicitly stipulates that the unlawful collection, distribution, and selling of personal data are criminal offenses.

Contributions: Fan Liya; editor: David Paulk.

(Header image: E+/VCG)