Source: People’s Daily Online.
Personal privacy information keeps leaking online; apps often force users to authorise access before they can be used, and some residents cannot even enter their own neighbourhood without facial recognition. Rules for handling such matters are on the way.
The Cyberspace Administration of China has published a draft Regulation on the Administration of Network Data Security for public comment, aiming to strengthen data security protection, ensure data flows freely and in an orderly manner according to law, and promote lawful, reasonable and effective use of data.
How should personal information be handled?
The draft states that data processors may not refuse to provide services or interfere with normal use because an individual declines to provide information that is not necessary for the service.
Consent must be sought separately by service type, and blanket clauses may not be used to obtain consent; processing sensitive personal information such as biometrics, religious beliefs, specific identity, medical health, financial accounts and whereabouts requires the individual’s separate consent.
“For personal information of minors under 14, the guardian’s consent is required. Personal information may not be processed by forcing consent on grounds of improving service quality, enhancing user experience or developing new products; consent may not be obtained through misleading, deception or coercion; consent may not be induced or forced in bulk by bundling different services or applying for consent in batches; and after an individual clearly declines, consent may not be sought repeatedly in a way that interferes with normal use.”
When a user terminates a service or cancels an account, the data processor should delete the personal information or anonymise it within 15 working days.
Notably, some apps and property managers have forced facial recognition on users. The draft states that where a data processor uses biological features for personal identity verification, it must assess the necessity and security risks, and may not use face, gait, fingerprint, iris or voiceprint features as the only means of identity verification, so as not to force individuals to consent to the collection of their biological information.
What companies may not do
Beyond rules on personal information processing, the draft imposes many requirements on data processors: no individual or organisation may illegally sell or provide data to others; may not obtain data through theft or other illegal means; and may not infringe others’ reputational rights, privacy, copyright and other lawful rights and interests.
“Any individual or organisation that knows or should know that others are engaged in such activities may not provide them with technical support, tools, procedures, advertising promotion, payment settlement or other services.”
Data processors must protect data from disclosure, theft, tampering, damage, loss and illegal use, respond to data security incidents, guard against criminal activities targeting or exploiting data, and maintain the integrity, confidentiality and availability of data.
“When an important data or personal information leak affecting 100,000 or more people occurs, the data processor must, within eight hours, report the basic facts of the incident to the cyberspace administration of the prefecture-level city and the relevant supervisory authority, including the quantity and type of data involved, the possible impact, and the measures taken or planned,” the draft states.
The draft also regulates web crawlers: where automated tools access and collect data in violation of laws, administrative regulations or industry self-regulation pacts, interfere with the normal functions of network services, or infringe others’ intellectual property and other lawful rights, the data processor must stop the access or collection and take corresponding remedial measures.
Want to talk through what you just read?
We work end to end, from product design to launch. Tell us about your scenario and we can start there.
Shenzhen XZS Technology Co., Ltd. · Tel 0755-82494862 · 13760424861