Chinese police have detained more than 11,000 suspects in over 3,700 cases during the past two years for alleged misuse of citizens' personal information.
Wang Shengjun, vice chairman of the Standing Committee of the National People's Congress (NPC), made the statement when briefing lawmakers on cyberspace protection Sunday.
Wang called the task of protecting internet users' personal information "grim."
"Illegal industrial chains have taken shape in some places, which involve illegal collection, theft, sale and use of internet users' personal information," he said.
Some internet companies and public service agencies have stored large amounts of personal information, but security protection lags seriously behind, making them easy targets, according to the report.
"Serious leaks of personal information have led to an increase in fraud targeting victims with high precision," Wang noted.
The report was based on investigations between August and October to assess the Cybersecurity Law that took effect on June 1, and a decision on protection of online information introduced five years ago.
The decision includes an identity management policy requiring users to use their real names to identify themselves to service providers, including internet or telecommunications operators.
Over the past five years, telecommunications operators have suspended services to more than 10 million users who refused to register their real names.
Wang proposed speeding up work on a new law, standardizing the scope and means of verifying identity, better supervision and harsher penalties.
