Just after He Xiaoming bought an apartment, she was flooded by phone calls from decoration companies. She didn't have any idea how her personal information became public.

She had to wait two months for the answer: The real estate developer traded her personal information and those of some 500 other buyers for about 800 yuan ($105) a copy.

"It's outrageous," she said. But that was not the first time she had experienced such a shock. Soon after opening a stock market account, she had started getting calls from brokers. And her sister began getting milk powder advertisements from the very next day she became a mother.

But the He Xiaomings can take some comfort now because the country has started the legislation of personal information protection law.

Zhou Hanhua, a researcher with the law institute of the Chinese Academy of Social Sciences, expects the law to be enacted next year, but it might take longer to iron out some details.

"We've finished drafting the law and will submit it to the State Council's Legal Affairs Office," said Qin Hai, deputy director of the policy and planning department of the State Council's Informatization Office (SCIO).

Such a law has become a necessity because of the remarkable increase in the misuse and abuse of personal information, Qin said.

Personal mobile phone numbers, home addresses, medical files, property documents and marital status are all part of the protection list in the draft, Zhou said.

Entrusted by the SCIO, Zhou began drafting the law with other experts in 2003, and finished the first version in 2005. The SCIO based its official draft on that.

Clarified duty

Zhou said the draft clarifies the legal duty of entities, especially enterprises, to protect personal information by following some basic principles.

For example, it says, an entity must specify the purpose personal information will be used for while collecting them. The entity has to make it clear that the information will not be used for any other purpose without the prior consent of the persons.

The draft bans any entity from providing personal information to a third party without the prior approval of the persons. Anyone found violating that could be fined and/or imprisoned, Zhou said.

There are exemptions, though. For instance, such information can be divulged to save a life or in public interest, or for criminal and tax investigations. To ensure press freedom, the media under certain conditions have also been exempted.

"The law has to protect personal rights, but it cannot disrupt the normal flow of information or social governance and supervision," Zhou said.

The draft's review has so far not been included in the legislation agenda of the Standing Committee of the National People's Congress, the country's top legislature.

Experts have hailed the move to have such a law. "It's a milestone in privacy protection in China," Heilongjiang University civil law professor Sun Yi said.

China doesn't have clear legal provisions to protect privacy at present, so victims can't protect themselves even through lawsuits.