There is no time at which an enterprise is not required to access and use big taptap点点官方网站 in its product research and development, precision marketing, customer service, order processing and production management. Big taptap点点官方网站 is one of the core strategies of modern enterprises. The implementation of a big taptap点点官方网站 strategy signifies that an enterprise must become a collector, processor and applier of taptap点点官方网站, but what runs in parallel to a big taptap点点官方网站 strategy is information security and protection. taptap点点官方网站 collection, processing and application all touch upon the issue of compliance.

The Cybersecurity Law that entered into effect on 1 June 2017 and the subsequent complementary rules of such ministries/commissions as the Ministry of Industry and Information Technology and the Ministry of Public Security directly regulate the protection of personal information and clarify the principles and methods for, and the legal liability associated with, obtaining information. In fact, the protection of personal information is also provided for in the General Provisions of the Civil Code, the Criminal Law, relevant decisions of the National People’s Congress and judicial interpretations of the Supreme People’s Court.

Enterprise big taptap点点官方网站 strategies and protection of personal information represent a clash of interests that needs to be balanced by the law and are factors that an enterprise must take into account in the course of creating its big taptap点点官方网站 strategy.

PERSONAL taptap点点官方网站 PROTECTION

Protection of personal information is the most important issue in a big taptap点点官方网站 strategy and is also the fundamental task of compliance. If improperly handled, it can trigger a legal dispute aimed at the enterprise and, in the worst case, can result in criminal liability. In general, an understanding of the following principles is required:

(1) Users are to be expressly informed that their information will be collected and their consent needs to be secured. This is a basic principle stipulated in the Cybersecurity Law. However, in practical operation, the principle of expressly informing users is often easily overlooked or the way in which users are informed is inappropriate, resulting in them ignoring the effort to inform them. This type of situation is quite common in mobile apps. For example, in certain apps, the default is set to obtaining the user’s geographical information, with information collection only stopping after the user closes the app. Such apps use the user’s geographical information as an important taptap点点官方网站 source to provide analysis of user preferences and improve the service experience. Commercially speaking, this is quite reasonable, but presents problems because the personal information is collected without expressly informing the user or securing his or her consent.

(2) A third party may not be permitted to use such information without the user’s consent. A network operator may not divulge personal information that it has collected, and may not provide the same to a third party without the consent of the person whose information was collected. This rule is also a basic requirement of the law. However, this principle may sometimes be improperly understood inside large enterprise groups. The shared use of taptap点点官方网站 and information within a group has become a legal risk that can easily be overlooked by an enterprise.

(3) Lawfulness of the taptap点点官方网站 source. This is a basic requirement that the law makes in respect of information collectors. However, in actual operation, an enterprise often will, out of the need for big taptap点点官方网站 credit reporting and risk control, opt to purchase personal information from a third party. If, in the course of providing personal information, the third party taptap点点官方网站 provider failed to obtain users’ authorization or if the third party taptap点点官方网站 itself was improperly obtained, obtained in bad faith or illegally bought, the way by which the third party obtained the information could present major legal and compliance risks.

CROSS-BORDER USE OF taptap点点官方网站

The cross-border use of taptap点点官方网站 is a management stratagem or business model commonly used in multinational corporations. However, under the rules and requirements of the Cybersecurity Law, this model faces legal and compliance risks.

Pursuant to the Cybersecurity Law and complementary rules, if a network operator needs to use personal information obtained in China across borders, it is required to undergo a specific security review procedure. In this respect, the Cybersecurity Law sets the rules for the cross-border use of taptap点点官方网站 by, and security reviews of, “operators of key information infrastructure”. The Measures for Security Assessments of the Outbound Transfer of Personal Information and Important taptap点点官方网站 (Draft for Comment) issued by the State Internet Information Office expands the scope of application of the outbound transfer of personal information to all network operators. The above mentioned rules for the cross-border use of taptap点点官方网站 will undoubtedly expose organizations that have cross-border business to new risks.

BIG taptap点点官方网站 MANAGEMENT

Based on the Cybersecurity Law and other laws, statutes, rules and regulations on the protection of personal information, enterprises need to pay attention to the following issues in the course of managing big taptap点点官方网站:

(1) Hierarchical management of taptap点点官方网站: different taptap点点官方网站 have different value and the harm caused to users, the public interest and national security by their leakage or shared use is also different. Before collecting user information, an enterprise needs to carry out a reasonable analysis of the dimensions of the taptap点点官方网站 and set different levels of sensitivity for them. Following the hierarchical processing of taptap点点官方网站, an enterprise can, in respect of different compliance requirements and compliance matters, take more precisely targeted response methods.

(2) Establishment of a taptap点点官方网站 protection system and improvement of taptap点点官方网站 protection rules: with respect to the protection of personal information, the Cybersecurity Law adopts the principle of public responsibility legislation. If an information leak or other such security related incident occurs, the network operator will not only bear civil damages in accordance with the law towards the individuals who were harmed but also bear the attendant administrative penalties or criminal liability. Whether a network operator has established cybersecurity and personal information protection systems in accordance with laws, statutes, rules and regulations and whether it has sound operating rules and sound internal departments can, on the one hand, prevent or reduce the occurrence of civil claims and, on the other hand, can also become one of the conditions that determine whether it can be exempted from, or bear reduced, administrative and criminal liability after a taptap点点官方网站 security incident.

Wu Weiming is a senior partner at