State Cyberspace Administration of China solicits opinions on data security management measures

On the 28th, the National Internet Information Office publicly solicited opinions on the "Data Security Management Measures (Draft for Solicitation of Comments)". The draft for comments proposes that network operators shall not force or mislead personal information subjects to agree to the collection of personal information in the form of default authorization, functional bundling, etc., on the grounds of improving service quality, enhancing user experience, targeted push information, and developing new products.

The draft opinion clarifies that the use of the Internet to carry out activities such as data collection, storage, transmission, processing, and use within the territory of the People's Republic of China (hereinafter referred to as data activities), as well as the protection, supervision and management of data security, applies to these Measures.

In terms of data collection, the draft opinion proposes that network operators who collect and use personal information through websites, applications and other products should separately formulate and make public collection and use rules. Collection and use rules should be clear, specific, simple and popular, and easy to access, highlighting the basic information of network operators; the purpose, type, quantity, frequency, method, and scope of the collection and use of personal information; personal information storage location, period and expiration date Processing methods; personal information subjects withdraw their consent, and the channels and methods for inquiring, correcting, and deleting personal information; complaints and reporting channels and methods, etc. At the same time, network operators must not discriminate against personal information subjects, including service quality, price differences, etc., based on whether the personal information subject is authorized to collect personal information and the scope of authorization.

In terms of data security supervision and management, the draft opinion points out that when data security incidents such as personal information leakage, damage, or loss occur, or the risk of data security incidents increases significantly, network operators should immediately take remedial measures and promptly use phone calls, text messages, and Inform the subject of personal information by mail or letter, etc., and report to the competent supervisory authority of the industry and the network information department as required. If network operators violate the provisions of these Measures, the relevant departments shall, in accordance with relevant laws and administrative regulations, give public exposure, confiscate illegal income, suspend related businesses, suspend business for rectification, close websites, revoke relevant business licenses, or revoke business licenses based on the circumstances. And other punishments; if a crime is constituted, criminal responsibility shall be investigated according to law.

It is understood that the deadline for feedback is June 28, 2019. The public can log on to the Chinese Government's Legal Information Network to comment on the draft. (Finish)