Where departments performing duties of personal information protection find in performing their duties of personal information protection that there are relatively high risks in personal information processing activities or personal information security incidents have occurred, they may interview the legal representative or person chiefly in charge of the personal information processor according to prescribed authority and procedures, or require the personal information processor to entrust professional institutions to conduct compliance audits of their personal information processing activities. The personal information processor shall take measures to make rectification and eliminate hidden dangers as required.
The department that performs the duty of personal information protection and discovers that the illegal processing of personal information is suspected of a crime in the course of performing its duty, shall promptly transfer the case to the public security organ for handling according to law.