Tag: personal information processors

Article 58

Personal information processors that provide important Internet platform services with a large number of users and complex business types shall perform the following obligations:

(I) Establish and improve the compliance system for personal information protection in accordance with state regulations, and establish an independent organization composed mainly of external members to protect personal information;

(II) Formulate the rules of the platform in accordance with the principles of openness, fairness, and justice, to clarify the norms for the processing of personal information and the obligations of the product or service providers within the platform to protect personal information;

(III) Stop providing services to the product or service providers on the platform that seriously violate laws and administrative regulations in processing personal information;

(IV) Regular release of social responsibility report regarding personal information protection and subject to public supervision.

Article 61

Departments performing duties of personal information protection shall perform the following duties of personal information protection:

(I) carrying out publicity and education on personal information protection, and guiding and supervising personal information processors to protect personal information;

(II) accepting and processing complaints and reports relating to personal information protection;

(III) organizing the evaluation of the protection of personal information such as applications and publish the evaluation results;

(IV) investigating and processing illegal personal information processing activities; and

(V) other duties stipulated by laws and administrative regulations.

Article 62

The State cyberspace administration shall coordinate with the relevant departments in promoting the protection of personal information in accordance with this Law as follows:

(I) formulate specific rules and standards for the protection of personal information;

(II) formulate special personal information protection rules and standards for small personal information processors, sensitive personal information processing, and new technologies and applications such as face recognition and artificial intelligence;

(III) support research, development, and promotion of secure and convenient electronic identity authentication technology, and promote the construction of public services for online identity authentication;

(IV) promote the development of a socialized service system for protecting personal information and support relevant organizations in carrying out assessment and certification services in respect of personal information protection.

(V) improve the mechanism for complaints and whistleblowing reports on personal information protection.

Article 64

Where departments performing duties of personal information protection find in performing their duties of personal information protection that there are relatively high risks in personal information processing activities or personal information security incidents have occurred, they may interview the legal representative or person chiefly in charge of the personal information processor according to prescribed authority and procedures, or require the personal information processor to entrust professional institutions to conduct compliance audits of their personal information processing activities. The personal information processor shall take measures to make rectification and eliminate hidden dangers as required.

The department that performs the duty of personal information protection and discovers that the illegal processing of personal information is suspected of a crime in the course of performing its duty, shall promptly transfer the case to the public security organ for handling according to law.

Article 66

Where personal information is processed in violation of the provisions hereof, or personal information is processed without fulfilling the personal information protection obligations stipulated in this Law, the departments performing duties of personal information protection shall order the processor to make rectification, give a warning and confiscate its illegal gains, or order the application that illegally processing personal information to suspend or terminate the provision of services; if rectification is refused, a fine of not more than RMB 1 million shall be imposed concurrently on the processor; and a fine of not less than RMB 10,000 but not more than RMB 100,000 shall be imposed on the person directly in charge of the processor and other directly liable persons. Where an illegal act specified in the preceding paragraph is committed and the circumstances are serious, the departments performing duties of personal information protection at or above the provincial level shall order the processor to make rectification, confiscate its illegal gains and impose a fine of not more than RMB 50 million or not more than 5% of its turnover of the previous year on the processor, and may also order the processor to suspend relevant business or to suspend business for rectification, and notify the relevant competent departments to revoke the relevant business permit or business license; and a fine of not less than RMB 100,000 but not more than RMB 1 million shall be imposed on the persons directly in charge and other directly liable persons, and such persons may also be prohibited from serving as directors, supervisors, senior managers, and persons in charge of personal information protection of relevant enterprises for a certain period of time.