Consumer Xue received a fraudulent phone call after online shopping, suspecting that the online shopping platform had leaked his personal information, so he sued a certain online company in court. Recently, the case was concluded at the Hangzhou Internet Court. In December 2021, Xue purchased snacks through an online shopping platform and filled in his personal delivery information according to the platform's requirements. Afterwards, Xue received a phone call from a fraud gang, claiming that a certain network company had leaked user personal information and infringed on their personal information rights and privacy rights. He then sued the court and requested that a certain network company be ordered to apologize and compensate for economic losses and mental comfort. After trial, the court found that the transaction process involved in the case is divided into the online transaction process where users purchase the goods involved in the case on the platform and the offline performance process after the goods are sold, with different information generated and displayed in different stages. The information involved in the case advocated by Xue is significantly different from the transaction order information, but highly consistent with the information shown on the courier manifest provided by Xue. Due to the high probability of outsiders obtaining the information involved in the case due to the courier manifest, there is no illegal handling of Xue's personal information on the platform. Regarding the orders involved in the case, the platform has taken multiple security management measures to prevent the leakage of user personal information and fulfilled the necessary obligation to protect user information security. The platform has followed the principles of legality, legitimacy, and necessity in handling the consignee's name and phone number in the information involved in the case, and complies with relevant legal requirements. In addition, the platform has also taken reasonable and feasible security protection measures that comply with legal regulations and business standards in accordance with the law, fully ensuring the security of the platform; The online trading platform has also taken necessary management and protection measures to ensure the controllability and security of user personal information. After the court's trial, it was found that the personal information processor's tort liability is a new type of special tort liability. The security obligations that personal information processors should fulfill can be divided into two levels: at the macro level, necessary compliance measures should be taken to fulfill the general protection obligation of ensuring personal information security; At the micro level, necessary and reasonable security technical measures and other measures directly related to the specific handling behavior should be taken in each case, including specific security measures to prevent the personal information processed from being abused by third parties within a reasonable, possible, and necessary range. The objective fault standard should be adopted for the elements of infringement liability of personal information processors. If a personal information processor submits the following evidence to prove that their personal information processing behavior is not at fault, the people's court shall support it: the processing behavior did not violate the legal norms of personal information processing rules; Necessary compliance measures for personal information protection related to the handling of the case have been taken; We have fulfilled the duty of safety and security care that should be exercised with reasonable care that matches our professional abilities. When the platform has already fulfilled its responsibilities, it is not advisable to be too harsh on the platform to avoid creating an imbalance between personal information protection and data flow and reasonable utilization. Based on the possible stages of information leakage in this case, as well as the security measures taken by the platform to ensure the safety of user personal information in accordance with relevant regulations and industry requirements, it is sufficient to prove that the platform did not have any fault with the information leakage claimed by Xue. A certain internet company has provided evidence to prove that it was not at fault in the personal information processing activities involved in the case, and