The Draft is enacted to implement the general provisions set out in the Decision on strengthening the protection of online information (“Decision”) (全国人民代表大会常务委员会关于加强网络信息保护的决定), issued by the Standing Committee of the National People’s Congress on December 28, 2012. (See our Newsletter of January 2013)
The Draft defines “users’ personal information” as any information that the telecommunication service provider (“TSP”) or internet service provider (“ISP”) collect while providing services and that can, individually or together, with other information identify the user. This includes names, dates of birth, ID numbers, addresses, and any information in relation to the service, such as user’s account, and time and place of providing the service.
The Draft establishes the following principles with regard to collecting and using users’ personal information:
- TSP and ISP are not allowed to collect or use the users’ personal information without their consent.
- TSP and ISP must clearly notify the users about the purpose and scope of the information, how it is collected, how long they will keep it for, how users can access or correct it, and the consequence of refusing to provide it.
- TSP and ISP are not allowed to collect any personal information of users that is not necessary for the services provided.
- TSP and ISP are not allowed to obtain the users’ personal information in any way that is fraudulent or misleading, or that violates the applicable laws, regulations and the agreements between the service provider and the user.
- TSP and ISP must keep the users’ personal information strictly confidential while providing the services and must not distort, damage, sell or illegally disclose this information.
- TSP and ISP must adopt comprehensive policies to safeguard the user’s personal information.
The Draft provides that the government authorities are also obliged to keep confidential the personal information obtained while supervising and inspecting TSPs and ISPs.
The Draft establishes the liability for violation of its provisions. TSPs or ISPs that incur a violation of relevant provisions under the Draft might be warned or fined with between RMB 10,000 and RMB 30,000, and ordered to rectify. If such violation constitutes a crime, the TSP or ISP will be prosecuted for criminal liabilities.
Date of issue: April 10, 2013. Deadline for submitting comments: May 15, 2013.