The Vulnerability of Privacy Protection in Chinese Digital Society: A Critical Review through Two Cases

China's emerging data privacy framework presents a significant paradox, diverging from Western models by embedding privacy within a state-centric vision of digital governance. While initiatives like the online real-name system and the mandatory disclosure of IP locations have already compromised user privacy, the state strategically frames its interventions as protective. The latest example is the implementation of the Cyber Trusted Identity ("CTID") system, which allegedly aims at enhancing individual privacy protection and combating online fraud but has sparked much controversy. This paper critically examines this tension, arguing that individual privacy in China's digital society is systematically subordinated to broader state governance objectives. Through qualitative legal analysis and in-depth representative case studies of the Didi cybersecurity review and the implemented CTID system, it investigates how privacy is strategically instrumentalized to achieve dominant broader digital governance objectives, such as data sovereignty strategy and digital surveillance in China's Internet society. The study reveals that the vulnerability of privacy is amplified by key factors like the selective enforcement of data security laws to prioritize state data sovereignty, legal ambiguities that legitimize expanded state oversight, and the deployment of centralized technological tools like the CTID, which solidifies state control over citizens' online activities.