China - Stricter Law Enforcement On The Collection of Personal Information By Apps; Highlights In Compliance.
Legal News & Analysis - Asia Pacific - China - Regulatory & Compliance
30 January, 2020
Two years have passed since Cybersecurity Law came in to effect. The rules and regulations on cyber security and information protection, as well as their enforcement, have become increasingly thorough. Apps are a potential disaster area, particularly when App operators over collect personal information, and this is why regulators have reinforced the regulation of Apps by promulgating detailed requirements. They have increased evaluations and made various orders, which are summarized as follows:
1. Rules and Regulations
In addition to Cybersecurity Law and other applicable national standards, in 2019, the Cyberspace Administration of China (“CAC”), the Ministry of Industry and Information Technology (“MIIT”), the Ministry of Public Security (“MPS”) and the State Administration for Market Regulation (“SAMR”) (hereinafter collectively referred to as the “Four Administrations”) promulgated the following regulations (or drafts) specific to personal information collection and use in the field of Apps:
(1)Circular concerning Special Campaigns against the Illegal Collection and Use of Personal Information by Apps1;
(2)Circular concerning App Security Certification2;
(3)Guidelines for Self-Examination of Apps on the Illegal Use of Personal Information3;
(4)Rules on the Determination of Illegal Collection and Use of Personal Information by Apps4;
(5)Information Security Technology --- Basic Rules on Personal Information Collection by Mobile Internet Applications (Apps) (Draft)5.
2. Status of Law Enforcement
The Four Administrations jointly or individually carried out a series of law enforcement campaigns for personal information protection during the period from January to December of 2019. For example:
(1)The Four Administrations carried out special campaigns against the illegal collection and use of personal information by Apps, established special App campaign committees, provided channels for reporting the illegal collection and use of personal information, evaluated hundreds of Apps, and in serious cases ordered the non-compliant Apps to make corrections6;
(2)In the first quarter of 2019, MIIT organized a spot check on 106 Internet services provided by 100 Internet enterprises, and ordered the relevant enterprises to correct their failure to publish rules on the collection and use of users’ personal information, their failure to provide channels for users to access and revise information, and their failure to provide functions for users to cancel their accounts, etc.7 ;
(3)In March, 2019, SAMR carried out a campaign called ‘To Protect Consumers’ --- A Special Law Enforcement Campaign against the Illegal Infringement of Consumers’ Personal Information, with a focus on the illegal infringement of consumers’ personal information in the field of consumption8;
(4)In 2019, MIIT initiated the ‘Special Campaign against the Infringement of Users’ Rights by Apps’9and other campaigns to crack down on the illegal collection of personal information, the illegal use of personal information, the unreasonable request for access from users, the creation of obstacles to prevent account cancellation, and other misconduct, by Apps.
In these enforcements, a number of Apps10were condemned publicly for their non-compliance, including their failure to publish rules on the collection and use of users’ personal information, their failure to provide channels for users to access and revise their information, their failure to provide functions for users to cancel accounts, their unauthorized collection of personal information, their unreasonable requests for access, their unauthorized sharing of information with third parties, etc.
3. Key Regulatory Requirements
In accordance with the said regulations and the enforcement thereof, App operators need to focus particularly on the following requirements:
(3)When applying for a permit to enable access to personal information on a mobile phone, or applying for the collection of sensitive personal information, the App shall notify the user of their purpose simultaneously;
(4)The App shall not collect personal information, or change the ‘allow or deny’ status access to personal information set by the user, without the user’s consent;
(5)When sending targeted pushes by using the user’s personal information and algorithm, the App shall provide an option for the user to reject such targeted pushes;
(6)The App shall provide the user with the means or methods to withdraw their consent to personal information collection;
(7)The App shall provide functions for the user to deregister their account; and
(8)The App shall not force the user to permit the collection of any unnecessary information or enable any unnecessary access on a mobile phone.
4. Compliance Suggestions
In the said law enforcements, all the non-compliant App operators were warned or ordered to make corrections within a required time limit or be shut down or removed from App stores. Personal information protection has become an essential concern of App operators with respect to their compliance.
(1)Confirm and check the entire process of data collection and use in the App, including the type, scope, scenario and reason for collection, and the method and scope of use;
(2)To carefully consider and check the necessity of sharing, contractual arrangement and liability assumption with respect to the sharing of personal information with third parties;
(3)To evaluate and justify relevant arrangement from various aspects such as collection, usage, duration of storage, and place of storage, etc. and
(4)To make corrections and update their privacy policies.
In addition to Apps, we also suggest updating and improving other online tools, including website and WeChat mini programs, by reference to the regulatory requirements on Apps.
We will keep our eye on any further requirements on the compliance of online tools.
Marissa (Xiao) Dong, Partner, Jun He