Internet

Chinese Banking and Insurance Supervisory Commission Notice concerning Further Standardizing Commercial Banks’Internet Lending Operations

Posted on Updated on

YBJBF No. (2021)24

All banking supervisory bureaus, all large-scale banks, shareholding-type banks and foreign invested banks:

In order to promote commercial banks to effectively implement the “Provisional Rules for the Management of Commercial Banks’ Online Lending” (hereafter referred to as “Rules”), further standardize Internet lending operations and activities, stimulate the healthy development of the business, with the agreement of the CBIRC, the following notification is made on related matters:

I, Implementing risk control requirements. Commmercial banks shall strengthen their dominant responsibility in risk control, independently conduct Internet lending risk management, and autonomously complete lending risk assessment and risk control steps with an important influence for risk control, they are strictly prohibited from outsourcing crucial steps in management before, during and after loans.

II, Strengthening capital issue proportion management. Where commercial banks jointly issue capital for Internet loans with cooperating bodies, they shall strictly implement interregional capital issue proportion management requirements, the capital issue proportion from the cooperating party for a “single pen loan” [a loan not repayable in installments] may not be lower than 30%.

III, Strengthening management of concentration of cooperating party. Where commercial banks jointly issue capital for Internet loans with cooperating bodies, the balance of that bank’s lending issued with any one cooperating party may not exceed 25% of the net amount of that bank’s first-tier capital.

IV, Implementing aggregate control and quota management. The balance of Internet loans where commercial banks jointly issue capital with cooperating bodies may not exceed 50% of that bank’s total lending balance.

V, Strictly controlling cross-regional operations. Where banks with local legal personality conduct Internet lending activities, they shall serve local customers, they may not conduct Internet lending operations outside of the jurisdiction where they are registered. Those who do not have physical operational branches, who mainly conduct operations online, and furthermore conform to other CBIRC regulations and conditions are exempt.

VI, Article 2 and Article 5 of this Notification take effect from 1 January 2022, operational inventories will be settled naturally, the transition period for other provisions is consistent with the “Rules”. The CBIRC and its assigned bodies will, according to the principles of “one bank one policy, steady transition”, supervise commercial banks in formulating rectification plans for Internet lending operations that do not meet the requirements of this Notice, and in completing rectification within the notification period. Commercial banks meeting conditions are encouraged to meet targets early.

VII, The CBIRD and its assigned bodies may put forward stricter precautionary supervision and management requirements concerning capital issue proportions, concentration of cooperating bodies, Internet lending amounts and quotas on the basis of the operational management, risk levels and operational conduct status of commercial banks under their jurisdiction, and on the basis of the provisions of this Notice.

VIII, Foreign bank branches, trust companies, consumer finance companies or car finance companies conducting Internet lending operations will refer to and implement the requirements of this Notice and the “Rules”, where the CBIRC provides otherwise, those provisions are followed.

CBIRC General Office

19 February 2021

中国银保监会办公厅关于进一步规范商业银行互联网贷款业务的通知
银保监办发〔2021〕24号

各银保监局,各大型银行、股份制银行、外资银行:

为推动商业银行有效实施《商业银行互联网贷款管理暂行办法》(以下简称《办法》),进一步规范互联网贷款业务行为,促进业务健康发展,经银保监会同意,现就有关事项通知如下:

一、落实风险控制要求。商业银行应强化风险控制主体责任,独立开展互联网贷款风险管理,并自主完成对贷款风险评估和风险控制具有重要影响的风控环节,严禁将贷前、贷中、贷后管理的关键环节外包。

二、加强出资比例管理。商业银行与合作机构共同出资发放互联网贷款的,应严格落实出资比例区间管理要求,单笔贷款中合作方出资比例不得低于30%。

三、强化合作机构集中度管理。商业银行与合作机构共同出资发放互联网贷款的,与单一合作方(含其关联方)发放的本行贷款余额不得超过本行一级资本净额的25%。

四、实施总量控制和限额管理。商业银行与全部合作机构共同出资发放的互联网贷款余额不得超过本行全部贷款余额的50%。

五、严控跨地域经营。地方法人银行开展互联网贷款业务的,应服务于当地客户,不得跨注册地辖区开展互联网贷款业务。无实体经营网点、业务主要在线上开展,且符合银保监会其他规定条件的除外。

六、本通知第二条、第五条自2022年1月1日起执行,存量业务自然结清,其他规定过渡期与《办法》一致。银保监会及其派出机构按照“一行一策、平稳过渡”的原则,督促商业银行对不符合本通知要求的互联网贷款业务制定整改计划,在过渡期内整改完毕。鼓励有条件的商业银行提前达标。

七、银保监会及其派出机构可根据辖内商业银行经营管理、风险水平和业务开展情况等,在本通知规定基础上,对出资比例、合作机构集中度、互联网贷款总量限额提出更严格的审慎监管要求。

八、外国银行分行、信托公司、消费金融公司、汽车金融公司开展互联网贷款业务参照执行本通知和《办法》要求,银保监会另有规定的,从其规定。

中国银保监会办公厅
2021年2月19日

Guiding Opinions concerning Further Perfecting Structures to Restrain Trust-Breaking and Building Long-Term Mechanisms for Sincerity Construction

Posted on Updated on

GBF No. (2020)49

All provincial, autonomous region and municipal People’s Governments, all State Council ministries and commissions, all directly subordinate bodies:

In order to deeply implement the requirements of the Party Centre and the State Council concerning enhancing sincerity construction, earnestly implementing the “Regulations on Optimizing the Commercial Environment” and other such relevant regulations, further clarify the scope of credit information, impose punishment for trust-breaking according to laws and regulations, perfect credit recovery mechanisms for untrustworthy subjects, and raise the rule of law and standardization levels of social credit system construction, with the approval of the State Council, the following Opinions are hereby put forward.

I, General requirements

With Xi Jinping Thought on Socialism with Chinese characteristics for a new era as guidance, comprehensively implement the spirit of the 19th Party Congress and the 2nd, 3rd, 4th and 5th Plenums of the 19th Party Congress, firmly take seeking progress in stability as a general foundation for work, firmly follow rule of law tracks, strive to build long-term mechanisms for sincerity construction, further standardize and complete mechanisms for the establishment, recording, collecting, sharing, publication, punishment and credit recovery of untrustworthy acts according to the general thinking lines of acting according to laws and regulations, protecting rights and interests, exercising caution and moderation, and checklist-based management, push the social credit system to enter a new phase of high quality development, let the social credit system play an even more positive role in supporting “release, management, service” reform and the transformation of government functions, creating a fair and sincere market environment and social environment.

In the process of advancing and practically exploring social credit system construction work, we must grasp the following important principles: first, strictly act according to laws and regulations, the recording to untrustworthy acts, determining name lists of gravely untrustworthy subjects and punishment for untrustworthiness, and other such matters affecting the direct rights and interests of related individuals, enterprises and all other kinds of subjects, must be handled strictly along rule of law tracks. Second, define scopes accurately, accurately determine the assessment scope for credit information and name lists of gravely untrustworthy subjects, reasonably handle punishment measures for untrustworthiness, firmly prevent improper application and even abuse. Third, ensure punishment is matched to the error, implement different kinds and different degrees of punitive measures strictly according to the law, respectively according to the area in which the untrustworthy act took place, the gravity of the circumstances, the extent of its impact, etc, and ensure the lawful rights and interests of credit subjects are protected. Fourth, lean from international experiences, both act on the basis of our country’s national circumstances, and fully consider international precedents, advance social credit construction cautiously in areas of high social attention, where understandings are not yet in agreement, and push related measures to link tracks internationally.

II, Scientifically determine the scope and processes for public credit information entry

(1) Clearly determine the scope for public credit information. The entry of information on particular acts held by public bodies and organizations authorized by laws and regulations to have public affairs management functions, etc. (hereafter jointly named administrative bodies) into public credit information must be strictly based on laws, regulations or Party Centre and State Council policy documents, and a catalogue system implemented to manage it. The leading work unit of the Interministerial Joint Conference for Social Credit System Construction (hereafter simply named Interministerial Joint Conference) compiles and regularly renews a basic nationwide public credit information catalogue according to laws and regulations, and together with relevant departments, the Interministerial Joint Conference’s member work units and other relevant departments may, according to laws and regulations, put forward suggestions for information to be entered into the catalogue, the Interministerial Joint Conference’s leading work unit combs through them and collects a catalogue, solicits opinions from all localities, all relevant departments and related market subjects, sectoral associations and chambers of commerce, legal service bodies, exports, scholars and the social public, and after submission to the Interministerial Joint Conference for deliberation, [the catalogue] is published to society and its implementation organized. All localities may, on the basis of local regulations, and with reference to the formulation procedure for the basic nationwide public credit information catalogue, formulate supplementary public credit information catalogues suited to that locality.

(2) Strictly standardize bases for determining untrustworthy acts. Administrative bodies determining untrustworthy acts must have a document with legal validity as basis. The bases on which an untrustworthy act may be determined include: valid judicial judgment documents or mediation letters, documents on decisions of administrative acts such as administrative punishments, administrative arbitration, etc, as well as other documents where laws, administrative regulations or other Party Centre and State Council policy documents provide they may act as a basis for a basis determining an untrustworthy act. After administrative bodies determine an untrustworthy act, they shall truthfully record the untrustworthy act.

III, Standardize the scope and process for public credit information sharing and openness

(3) Standardize the scope and process for public credit information sharing. Whether public credit information may be shared or in which scope it may be shared, shall be determined on the basis of the principles of legality and necessity, and determined at the time where public credit information catalogues are compiled. Perfect credit sharing mechanisms, promote the interaction and interconnection, and data sharing between the Nationwide Credit Information Sharing Platform, the National Enterprise Credit Information Publication System as well as relevant departments’ credit information systems, collecting departments must be clarified for data that may be shared, ensuring that “what is collected in one window, is fully shared”.

(4) Determine the scope for publication of public credit information according to laws and regulations. Whether public credit information may be published, shall be determined on the basis of the principles of legality and necessity, and determined at the time where public credit information catalogues are compiled. Public credit information publication may not infringe commercial secrets and personal privacy, where laws and regulations provide otherwise, those provisions are followed. Where information related to an individual is published, the basis in law, regulation, State Council decision or degree must be clarified or the individual in question must consent, and the necessary desensitization must be performed.

(5) Strengthen comprehensive management of public credit information publication channels. Departments determining public credit information shall, according to government information openness and other relevant regulations, publish the related information on that department’s portal website, all levels’ governments’ portal websites or other appointed websites. The “Credit China” website, and the National Enterprise Credit Information Publication System must, according to relevant regulations, conduct uniform publication of public credit information that is collected and shall be published, consistency is to be maintained on the content and time period of publication with the department determining public credit information.

IV, Standardize determination standards and procedures for name lists of gravely untrustworthy subjects

(6)  Strictly limit the areas and scopes for the institutions of name lists of gravely untrustworthy subjects. Areas where a name list of gravely untrustworthy subjects ins instituted, must have a basis in laws, regulations or Party Centre or State Council policy documents, no department (work unit) may increase or expand them without authorization. The scope of the institution of name lists of gravely untrustworthy subjects is to be limited strictly to subjects responsible for grave harm to the physical health and life safety of the popular masses, gravely harm fair market competition order and regular social order, refuse to carry out statutory duties with grave influence on the credibility of judicial bodies and administrative bodies, refuse to implement national defence duties and other such grave unlawful and untrustworthy acts, according to the provisions of the “State Council Guiding Opinions concerning Establishing and Perfecting Joint Incentive Structures for Trust-Keeping and Joint Punishment Structures for Untrustworthiness, and Accelerating the Construction of Social Sincerity” (GF No. (2016)33).

(7) Strictly standardize determination standards for name lists of gravely untrustworthy subjects. For name list systems of gravely untrustworthy subjects implemented at the national level, the name list determination standards shall be determined in the form of laws, administrative regulations or Party Centre or State Council policy documents, those temporarily not meeting conditions may be determined by the competent (supervision) department of the area in question through departmental rules, for determination standards, the opinions of the Interministerial Joint Conference leading work unit and other relevant departments, related market subjects, sectoral associations and chambers of commerce, legal service bodies, experts, scholars and the social public shall be fully solicited, the period of public opinion solicitation shall not be less than 30 days. Determination standards shall be published through the “Credit China” website and websites appointed by the competent (supervision) department. Determination standards shall, at the same time, clarify conditions and procedures to leave the name lists as well as relief measures. Departments formulating determination standards shall regularly organize third-party assessment of the outcome of standards implementation and timely revise them. For name list structures for gravely untrustworthy subjects only implemented on a local scale, name list determination standards shall be provided in departmental regulations.

(8) Strictly implement determination procedures for name lists of gravely untrustworthy subjects. Administrative bodies shall, before making determination decisions about name lists of gravely untrustworthy subjects, notify the party concerned about the grounds and basis for the decision, and the rights the party concerned has according to the law; where the party concern raises an objection, this shall be verified and feedback made on the outcome within stipulated time limits. To list a market subject on a name list for gravely untrustworthy subjects, the determining department shall rely on corresponding administrative decision documents, bearing the grounds, basis, untrustworthiness punishment measure notes, withdrawal conditions and procedures as swell as relief measures, when necessary, it is also permitted for the determining department to produce a stand-alone determination decision document about name lists for gravely untrustworthy subjects. In principle, name lists for gravely untrustworthy subjects shall be determined by relevant departments of county-level and higher (including county-level) People’s Governments according to related standards, where laws, regulations and departmental rules provide otherwise, those provisions are followed.

V, Imposing punishment for untrustworthiness according to laws and regulations

(9) Determining punishment measures for untrustworthiness according to laws and regulations. Punitive measures reducing rights or adding to duties of untrustworthy subjects must be based on the facts of the concrete untrustworthy act, directly cite laws, regulations , or Party Centre or State Council policy documents as a basis, ad implement name list structure management. The work unit leading the Interministerial Joint Conference will, together with relevant departments, compile and regularly renew a nationwide basic list of punishment measures against untrustworthiness according to laws and regulations, member work units of the Interministerial Joint Conference and other relevant departments may, on the basis of laws and regulations, put forward suggestions on punitive measures for untrustworthiness to be included in the list, the work unit leading the Interministerial Joint Conference combs through them and collects a general list, solicits opinions from all localities, all relevant departments and related market subjects, sectoral associations and chambers of commerce, legal service bodies, experts, scholars and the social public, and after submission to the Interministerial Joint Conference, publishes [the list] to society and organizes implementation. All localities may, on the basis of local regulations, and with reference to the procedure for the formulation of the basic nationwide list for punitive measures against untrustworthiness, formulate supplementary lists of punitive measures against untrustworthiness suited to these localities. No department (work unit) may coercively require financial bodies, credit service bodies, sectoral associations, chambers of commerce, etc. to punish untrustworthy subjects.

(10) Ensure wrongdoings and punishments are proportional. According to the principles of legality, correlation and balance, according to the list of punishment measures against untrustworthiness, on the basis of the nature of the untrustworthy act and the extent of its gravity, adopt punitive measures of suitable weight, and prevent that small wrongdoings are punished heavily. No department (work unit) may, for the reason of existing regulations not sufficiently strongly punishing untrustworthy acts, expand punitive measures outside the provisions of laws, regulations, or Party Centre or State Council policy documents, or increase punishment on top of statutory punishment standards.

VI, Completing and perfecting credit recovery mechanisms

(11) Establishing and completing a set of credit recovery mechanisms. Related sectoral competent (supervision) departments shall establish credit recovery mechanisms beneficial to self-correction and active self-renewal. Except where laws, administrations, or Party Centre or State Council policy documents clearly provide untrustworthiness information cannot be recovered, where untrustworthy subjects correct the untrustworthy act according to requirements or eliminate the harmful influence, they may in all cases apply for credit recovery. Related departments (work units) shall formulate concrete regulations for credit recovery, clarifying recovery methods and procedures. Where they conform to recovery conditions, they will be timely removed from the name list of untrustworthy subjects according to relevant regulations, the sharing and publication of related untrustworthiness information ceases, or the related untrustworthiness information will be indicated, shielded off or deleted.

(12) Raising credit recovery rates. Strengthen credit recovery information sharing, accelerate the construction and perfection of coordinated and joint “running everything on one network” mechanisms, realistically resolve the problem that “credit recovery is difficult”. Related sectoral competent (supervision) departments as well as the Nationwide Credit Information Sharing Platform and the “Credit China” website shall appoint specialized personnel responsible for credit recovery work, and process credit recovery requests meeting conditions within statutory time limits, they may in no way collect fees from subjects applying for credit recovery.

VII, Strengthening information security and privacy protection

(13) Strengthening credit information security management. All levels’ public credit information systems must, according to the requirement of protecting market subjects’ rights and interests, clarify information inquiry and use privileges and procedures, establish and perfect information inquiry and use registration and inspection structures, and prevent information leaks, where information leaks intentionally or due to work errors, the responsibility of related work units and personnel must be prosecuted strictly, according to laws and regulations. Strictly investigate and prosecute acts of credit information leaks, distortion, damage and theft, or use of credit information to seek improper gain, strictly attack unlawful activities such as the illegal collection, sale or purchase of credit information under the guise of social credit system construction.

(14) Strengthening personal privacy protection. All localities and all relevant departments shall abide by the principles of legality, justification, necessity and minimization, collect and use personal credit information strictly according to the public credit information catalogue, clearly indicate the goal, method and scope of information collection and use and obtain consent from the person in question, where laws or regulations provide otherwise, those provisions are followed. It is prohibited for any work unit or individual to collect and use a person’s credit information without authorization, having coerced authorization or to do so life-long with a one-time authorization. Strengthen investigation and prosecution of the illegal collection, transmission, use, leakage, distortion, damaging, theft or sale of personal credit information and other such act. Related departments must implement focused supervision and management of financial bodies, credit investigation bodies, Internet enterprises, big data enterprises and mobile application software work units, and strictly standardize their personal information collection, storage, use, processing, transmission, provision and publication activities.

VIII, Striving to strengthen credit rule of law construction

(15) Accelerating the progress of credit law and regulation construction. Persist in following rule of law tracks, accelerate the research and advance of legislative processes for laws and regulations in the social credit area, smoothen the relationship between punishment for untrustworthiness and administrative management measures, lay a firm rule of law basis. Where the punitive strength of existing laws and regulations is insufficient, and it is necessary to strengthen punishment, all localities and all relevant departments shall put forward legislative revision suggestions in a timely manner, and ensure punishment for untrustworthiness is conducted strictly according to laws and regulations.

(16) Advancing social credit system construction strictly according to laws and regulations. Strictly standardize credit information, collection and publication scopes according to laws and regulations, strictly standardize determination of name lists of gravely untrustworthy subjects, punishment for untrustworthiness and credit recovery work, ensure that all areas of social credit system construction work operate along rule of law tracks. Minors’ untrustworthy acts, untrustworthy acts resulting from natural disasters, epidemics and other inevitable influences as well as acts with non-subjective intent or minor untrustworthy acts, shall be determined, recorded and punished in a tolerant and cautious manner. Firmly investigate, prosecute and attack all kinds of infringing acts, protect credit information security, commercial secrets and personal privacy according to laws and regulations, and protect the lawful rights and interests of all kinds of credit subjects according to laws and regulations.

IX, Strengthening organizational implementation safeguards.

Implementing dominant responsibilities. All sectoral competent (supervision) departments must realistically fulfil their dominant responsibility in supervising and managing credit in their sector, and perform untrustworthy conduct determination, recording, collection, sharing, publication, punishment and credit recovery work according to laws and regulations, the Interministerial Joint Conference’s leading work units must coordinate with judicial bodies as well as other responsible work units who have already obtained clear authorization in performing related work well. All local levels’ social credit system construction leading work units must realistically implement their comprehensive coordination responsibilities, and strengthen standardization and guidance of social credit system construction work in their areas.

Strengthening responsibility and accountability. With regard to recording, sharing and publication of credit information outside of public credit information catalogues and in violation of laws and regulations, implementing punitive measures outside of the punishment list for untrustworthiness in violation of laws and regulations, as well as acts such as unauthorized determination about name lists of gravely untrustworthy subjects not according to standards and procedures, not processing credit recovery timely or according to regulations, the liability of related work units and personnel must be prosecuted according to laws and regulations

Strengthening propaganda and explanation. All kinds of media are encouraged to vigorously conduct sincerity propaganda and education, deeply report on advanced models of sincerity and promise-keeping, launch constructive public opinion supervision of untrustworthy conduct and incidents, advocate sincerity and promise-keeping. Let relevant departments, sectoral associations and chambers of commerce, experts and scholars, news media, etc. play their role fully, timely explain and interpret credit policies, vigorously respond to concerns from all sides, strengthen positive guidance, and create a benign public opinion environment.

Grasping the moment. All localities and all relevant departments must, according to the requirements of these Opinions, conduct a comb-through and assessment of measures on untrustworthy conduct determination, recording, collection, sharing, publication, punishment and credit recovery measures already published, and those not meeting the requirements of these Opinions must be timely standardized. Set up a transitional period for name list structures of gravely untrustworthy subjects having a clear basis for their continued retention, complete renewal determination standards and procedures of name lists that these Opinions require to be adjusted before the end of 2021, after the transition period, those not conform to the requirements of these Opinions will be abolished without exception.

State Council General Office

7 December 2020

国务院办公厅关于进一步完善失信约束制度

构建诚信建设长效机制的指导意见

国办发〔2020〕49号

各省、自治区、直辖市人民政府,国务院各部委、各直属机构:

为深入贯彻落实党中央、国务院关于推进诚信建设的要求,认真落实《优化营商环境条例》等相关规定,进一步明确信用信息范围,依法依规实施失信惩戒,完善失信主体信用修复机制,提高社会信用体系建设法治化、规范化水平,经国务院同意,现提出如下意见。

一、总体要求

以习近平新时代中国特色社会主义思想为指导,全面贯彻落实党的十九大和十九届二中、三中、四中、五中全会精神,坚持稳中求进工作总基调,坚持遵循法治轨道,着力构建诚信建设长效机制,按照依法依规、保护权益、审慎适度、清单管理的总体思路,进一步规范和健全失信行为认定、记录、归集、共享、公开、惩戒和信用修复等机制,推动社会信用体系迈入高质量发展的新阶段,更好发挥社会信用体系在支撑“放管服”改革和政府职能转变、营造公平诚信的市场环境和社会环境等方面的积极作用。

在社会信用体系建设工作推进和实践探索中,要把握好以下重要原则:一是严格依法依规,失信行为记录、严重失信主体名单认定和失信惩戒等事关个人、企业等各类主体切身利益,必须严格在法治轨道内运行。二是准确界定范围,准确界定信用信息和严重失信主体名单认定范围,合理把握失信惩戒措施,坚决防止不当使用甚至滥用。三是确保过惩相当,按照失信行为发生的领域、情节轻重、影响程度等,严格依法分别实施不同类型、不同力度的惩戒措施,切实保护信用主体合法权益。四是借鉴国际经验,既立足我国国情,又充分参考国际惯例,在社会关注度高、认识尚不统一的领域慎重推进信用体系建设,推动相关措施与国际接轨。

二、科学界定公共信用信息纳入范围和程序

(一)明确界定公共信用信息范围。将行政机关及法律、法规授权的具有管理公共事务职能的组织等(以下统称行政机关)掌握的特定行为信息纳入公共信用信息,必须严格以法律、法规或者党中央、国务院政策文件为依据,并实行目录制管理。社会信用体系建设部际联席会议(以下简称部际联席会议)牵头单位会同有关部门依法依规编制并定期更新全国公共信用信息基础目录,部际联席会议成员单位和其他有关部门可依法依规提出拟纳入目录信息的建议,部际联席会议牵头单位梳理汇总目录,征求各地区、各有关部门和相关市场主体、行业协会商会、法律服务机构、专家学者和社会公众意见,提请部际联席会议审定后向社会公布并组织实施。各地可依据地方性法规,参照全国公共信用信息基础目录的制定程序,制定适用于本地的公共信用信息补充目录。

(二)严格规范失信行为认定依据。行政机关认定失信行为必须以具有法律效力的文书为依据。可认定失信行为的依据包括:生效的司法裁判文书和仲裁文书、行政处罚和行政裁决等行政行为决定文书,以及法律、法规或者党中央、国务院政策文件规定可作为失信行为认定依据的其他文书。行政机关认定失信行为后应当如实记录失信信息。

三、规范公共信用信息共享公开范围和程序

(三)规范公共信用信息共享范围和程序。公共信用信息是否可共享及在何种范围内共享,应当根据合法、必要原则确定,并在编制公共信用信息目录时一并明确。完善信息共享机制,推动全国信用信息共享平台与国家企业信用信息公示系统以及相关部门信用信息系统实现互联互通、数据共享,对于可共享数据要明确采集部门,做到“一口采集、充分共享”。

(四)依法依规确定公共信用信息公开范围。公共信用信息是否可公开应当根据合法、必要原则确定,并在编制公共信用信息目录时一并明确。公共信用信息公开不得侵犯商业秘密和个人隐私,法律、法规另有规定的从其规定。公开个人相关信息的,必须有明确的法律、法规或者国务院决定、命令作为依据或经本人同意,并进行必要脱敏处理。

(五)加强对公共信用信息公开渠道的统筹管理。公共信用信息的认定部门应当按照政府信息公开或其他有关规定,在本部门门户网站、本级政府门户网站或其他指定的网站公开相关信息。“信用中国”网站、国家企业信用信息公示系统要按照有关规定,将所归集的应当公开的公共信用信息进行统一公开,并与公共信用信息认定部门公开的内容、期限保持一致。

四、规范严重失信主体名单认定标准和程序

(六)严格限定严重失信主体名单设列领域范围。设列严重失信主体名单的领域,必须以法律、法规或者党中央、国务院政策文件为依据,任何部门(单位)不得擅自增加或扩展。设列严重失信主体名单的范围,严格按照《国务院关于建立完善守信联合激励和失信联合惩戒制度加快推进社会诚信建设的指导意见》(国发〔2016〕33号)规定,限制为严重危害人民群众身体健康和生命安全、严重破坏市场公平竞争秩序和社会正常秩序、拒不履行法定义务严重影响司法机关和行政机关公信力、拒不履行国防义务等严重违法失信行为的责任主体。

(七)严格规范严重失信主体名单认定标准。在全国范围内实施的严重失信主体名单制度,其名单认定标准应当以法律、行政法规或者党中央、国务院政策文件形式确定,暂不具备条件的可由该领域主管(监管)部门以部门规章形式确定,认定标准应当充分征求部际联席会议牵头单位及其他有关部门、相关市场主体、行业协会商会、法律服务机构、专家学者和社会公众意见,公开征求意见期限不少于30日。认定标准应当通过“信用中国”网站及该领域主管(监管)部门指定的网站公开。认定标准应当一并明确名单移出条件、程序以及救济措施。认定标准制定部门应当定期组织对标准执行效果进行第三方评估并及时修订。仅在地方范围内实施的严重失信主体名单制度,其名单认定标准应当由地方性法规规定。

(八)严格履行严重失信主体名单认定程序。行政机关在作出认定严重失信主体名单决定前,应当告知当事人作出决定的事由、依据和当事人依法享有的权利;当事人提出异议的,应当予以核实并在规定时限内反馈结果。将市场主体列入严重失信主体名单,应当由认定部门依托相应的行政决定文书,载明事由、依据、失信惩戒措施提示、移出条件和程序以及救济措施等,必要时也可由认定部门单独制作认定严重失信主体名单的决定文书。严重失信主体名单原则上应当由县级以上(含县级)人民政府有关部门按照相关标准认定,法律、法规和部门规章另有规定的从其规定。

五、依法依规开展失信惩戒

(九)依法依规确定失信惩戒措施。对失信主体采取减损权益或增加义务的惩戒措施,必须基于具体的失信行为事实,直接援引法律、法规或者党中央、国务院政策文件为依据,并实行清单制管理。部际联席会议牵头单位会同有关部门依法依规编制并定期更新全国失信惩戒措施基础清单,部际联席会议成员单位和其他有关部门可依法依规提出拟纳入清单失信惩戒措施的建议,部际联席会议牵头单位梳理汇总清单,征求各地区、各有关部门和相关市场主体、行业协会商会、法律服务机构、专家学者和社会公众意见,提请部际联席会议审定后向社会公布并组织实施。各地可依据地方性法规,参照全国失信惩戒措施基础清单的制定程序,制定适用于本地的失信惩戒措施补充清单。任何部门(单位)不得强制要求金融机构、信用服务机构、行业协会商会、新闻媒体等惩戒失信主体。

(十)确保过惩相当。按照合法、关联、比例原则,依照失信惩戒措施清单,根据失信行为的性质和严重程度,采取轻重适度的惩戒措施,防止小过重惩。任何部门(单位)不得以现行规定对失信行为惩戒力度不足为由,在法律、法规或者党中央、国务院政策文件规定外增设惩戒措施或在法定惩戒标准上加重惩戒。

六、健全和完善信用修复机制

(十一)建立健全信用修复配套机制。相关行业主管(监管)部门应当建立有利于自我纠错、主动自新的信用修复机制。除法律、法规和党中央、国务院政策文件明确规定不可修复的失信信息外,失信主体按要求纠正失信行为、消除不良影响的,均可申请信用修复。相关部门(单位)应当制定信用修复的具体规定,明确修复方式和程序。符合修复条件的,要按照有关规定及时将其移出严重失信主体名单,终止共享公开相关失信信息,或者对相关失信信息进行标注、屏蔽或删除。

(十二)提高信用修复效率。加强信用修复信息共享,加快建立完善协同联动、“一网通办”机制,切实解决“信用修复难”问题。相关行业主管(监管)部门以及全国信用信息共享平台、“信用中国”网站应当明确专门人员负责信用修复工作,在规定时限内办结符合条件的信用修复申请,不得以任何形式向申请信用修复的主体收取费用。

七、加强信息安全和隐私保护

(十三)加强信用信息安全管理。各级公共信用信息系统要按照保护市场主体权益的要求,明确信息查询使用权限和程序,建立完善信息查询使用登记和审查制度,防止信息泄露,对故意或因工作失误泄露信息的,要依法依规严格追究相关单位和人员责任。严肃查处泄露、篡改、毁损、窃取信用信息或利用信用信息谋私等行为,严厉打击借社会信用体系建设名义非法收集、买卖信用信息的违法行为。

(十四)加大个人隐私保护力度。各地区、各有关部门应当遵循合法、正当、必要、最小化原则,严格按照公共信用信息目录收集使用个人信用信息,明示收集使用信息的目的、方式和范围并经本人同意,法律、法规另有规定的从其规定。禁止任何单位和个人未经授权、强制授权或一次授权终身收集使用个人信用信息。加大对非法获取、传播、利用以及泄露、篡改、毁损、窃取、出售个人信息等行为的查处力度。相关部门要对金融机构、征信机构、互联网企业、大数据企业、移动应用程序运营企业实施重点监管,严格规范其收集、存储、使用、加工、传输、提供和公开个人信息等行为。

八、着力加强信用法治建设

(十五)加快推动信用法律法规建设。坚持遵循法治轨道,加快研究推进社会信用方面法律法规的立法进程,理顺失信惩戒与行政管理措施的关系,夯实法治基础。现行法律、法规对失信行为惩戒力度不足、确有必要加大惩戒力度的,各地区、各有关部门应当及时提出修法建议,确保失信惩戒严格依法依规开展。

(十六)严格依法依规推动社会信用体系建设。依法依规严格规范信用信息采集、共享、公开范围,严格规范严重失信主体名单认定、失信惩戒和信用修复工作,确保社会信用体系建设各项工作在法治轨道运行。对未成年人失信行为、受自然灾害或疫情等不可抗力影响导致的失信行为以及非主观故意、轻微失信行为,应宽容审慎进行认定、记录和惩戒。坚决查处和打击各类侵权行为,依法依规保护信用信息安全、商业秘密和个人隐私,依法依规保护各类信用主体合法权益。

九、加强组织实施保障

落实主体责任。各行业主管(监管)部门要切实履行本行业信用监管主体责任,依法依规做好失信行为认定、记录、归集、共享、公开、惩戒和信用修复等工作,部际联席会议牵头单位要协调司法机关以及其他已获明确授权的责任单位做好相关工作。地方各级社会信用体系建设牵头单位要切实履行统筹协调职责,对本区域内社会信用体系建设工作加强规范指导。

强化追责问责。对在公共信用信息目录外违法违规记录、共享、公开信用信息,在失信惩戒措施清单外违法违规实施惩戒措施,以及不按标准和程序擅自认定严重失信主体名单、不按规定及时办理信用修复等行为,要依法依规追究相关单位和人员责任。

加强宣传解读。鼓励各类媒体积极开展诚信宣传教育,深入报道诚实守信的先进典型,对失信行为和事件开展建设性舆论监督,倡导诚实守信。充分发挥有关部门、行业协会商会、专家学者、新闻媒体等作用,及时阐释和解读信用政策,积极回应各界关切,强化正面引导,营造良好舆论环境。

把握时间节点。各地区、各有关部门要按照本意见要求,对已经出台的失信行为认定、记录、归集、共享、公开、惩戒和信用修复等措施进行梳理评估,对不符合本意见要求的要及时规范。对有明确依据可继续保留的严重失信主体名单制度设置过渡期,在2021年底前按本意见要求对需要调整的名单认定标准和程序进行更新,过渡期后与本意见要求不符的一律废止。

国务院办公厅

2020年12月7日

Implementation Outline for the Construction of a Rule of Law Society (2020-2025) [Excerpts]

Posted on Updated on

A rule of law society is the foundation for building a rule of law country, building a rule of law society is an important component part of realizing the modernization of the national governance system and governance capacity. Building a Socialist rule of law society with faith in the rule of law, fairness and justice, where rights are protected, which is law abiding and sincere, full of vitality, harmonious and orderly is an important step in strengthening the popular masses’ sense of gain, sense of happiness and sense of security. The 19th Party Congress has determined completing a social basis for the rule of law as one important objective in the basic realization of Socialist modernization by 2035, its importance is great, its influence is profound, tasks will be arduous. In order to accelerate the progress of constructing a rule of law society, this Outline is formulated.

I, General requirements

(1) Guiding ideology. Hold high the magnificent banner of Socialism with Chinese characteristics take Marxism-Leninism, Mao Zedong Thought, Deng Xiaoping Theory, the important “Three Represents” thought, the Scientific Development Concept, and Xi Jinping Thought on Socialism with Chinese characteristics in a new era as guidance, comprehensively implement the spirit of the 19th Party Congress and the 2nd, 3rd, 4th and 5th Plenums of the 19thParty Congress, comprehensively implement Xi Jinping Thought on the rule of law, strengthen the “Four Consciousnesses”, uphold the “Four Self-Confidences”, ensure the “Two Safeguards”, unwaveringly march the path of Socialism with Chinese characteristics, persist in the integrated construction of a rule of law country, a rule of law government and a rule of law society, foster and practice the Socialist core value view, carry forward the Socialist rule of law spirit, build a Socialist rule of law culture, strengthen the vigour and initiative in all of society to strictly practice the rule of law, push all of society to respect the law, study the law, abide by the law and use the law, complete social fairness and justice rule of law protection structures, guarantee the people’s rights, raise society’s rule of law levels, and lay down a firm rule of law basis for the comprehensive construction of a Socialist rule of law country and realizing the Chinese Dream of the great rejuvenation of the Chinese nation.

(2) Main principles. Uphold the concentrated and uniform leadership of the Party; uphold the guiding position of the theory of Socialist rule of law with Chinese characteristics; uphold the centrality of the people; uphold respect for and the maintenance of the authority of the Constitution and the laws; uphold the quality of everyone in the face of the law; uphold the unity of rights and duties; uphold the integration of the rule of law, the rule of virtue and self-governance; and uphold the joint construction, joint governance and joint sharing of social governance.

(3) Overall objectives. By the end of 2025, the implementation of the “Eight Five” law popularization plan to be completed; rule of law concepts to have deeply penetrated people’s hearts, structures and standards in the social area to be more completed, clear achievements in the merger of requirements of the Socialist core value view with rule of law construction and social governance, the lawful rights and interests of citizens, legal persons and other organizations to be effectively protection, rule of law levels of social governance to increase clearly, creating a vivid picture of constructing a rule of law society that conforms to national circumstances, reflects the characteristics of the times, and satisfies the popular masses, and laying a firm basis for the basic completion of a rule of law society by 2013.

[…]

III, Completing structures and standards in the social area

[…]

(11) Advancing the construction of social sincerity. Accelerate the construction of the social credit system, and raise all of society’s sincerity awareness and credit levels. Complete corporate social responsibility laws and systems, strengthen corporate social responsibility awareness, stimulate enterprises to do operate in a sincere, trustworthy and lawful manner. Complete law compliance credit records of citizens and organizations, establish a uniform social credit coding system based on citizens’ identity document numbers and organizational codes. Perfect long-term mechanisms for sincerity construction, complete credit assessment systems covering all of society, establish and perfect punishment mechanisms for untrustworthiness. Establish credit recovery mechanisms and appeals structures in integration with reality. Strengthen sincerity construction in sectoral associations and chambers of commerce, perfect sincerity management and self-discipline mechanisms. Perfect the Nationwide Credit Information Sharing Platform and the National Enterprises Credit Publication System, further strengthen and standardize credit information collection and sharing. Strengthen propaganda and education on sincerity awareness, organize sincerity-themed practice activities, create a benign environment for the construction of the social credit system. Advance the publication of laws in the area of credit.

[…]

VI, Governing cyberspace according to the law

Cyberspace isn’t a land outside the law, promoting social governance to expand from actual society into cyberspace, establish and create comprehensive online governance systems, strengthen network management according to the law, network operations according to the law, and network use according to the law, comprehensively advance rule of law building in cyberspace, and create a clear and crisp cyberspace.

(22) Perfecting legal structures for the network. Promote the expansion of exising laws and regulations to cyberspace through a combination of legislation, reform, abolition and interpretation. Perfect laws and regulations in the area of online information services, revise the Internet information service management rules, research and formulate management rules for the credit information of gravely untrustworthy subjects in the Internet information services area, formulate and perfect standards and management rules for online streaming, self-media, Q&As in knowledge communities and other such new media business models as well as algorithmic recommendations, deep fakes and other such new technology applications. Perfect supplementary regulations and standard systems for the cybersecurity law, establish and complete cybersecurity management structures for critical information infrastructure security protection, data security management and cybersecurity review, etc., and expand guidance on standards for the research, development and application of big data, cloud computing, artificial intelligence and other such new technologies. Research and formulate the personal information protection law. Complete laws and regulations for intellectual property rights protection of innovative achievements in Internet technology, commercial models, big data, etc. Revise the law on the prevention of crime by minors, formulate regulations for the online protection of minors. Perfect cross-border e-commerce structures, standardize cross-border e-commerce operators’ activities. Vigorously participate in international norms and standard setting for the digital economy, e-commerce, information technology, cybersecurity and other such areas.

(23) Foster a benign online rule of law awareness. Uphold the integration of governing the network according to the law and enhancing the network through virtue, carry forward the main melody of the times and positive social energy. Strengthen and innovate Internet content construction, realize projects on the Socialist core value view, new media broadcasts on Chinese culture, etc. Enhance online media literacy, advance “blacklist” systems and punitive mechanisms against gravely untrustworthy conduct in the online information service area, and advance the institutionalization of line sincerity. Firmly attack the spread of rumours, obscenity, violence, superstition, heresy and other such harmful information in cyberspace according to the law, establish and complete an integrated system to receive and process reports about online violations of law and harmful information. Strengthen education on online literacy and online rule of law for the whole society, formulate guidelines for online literacy education. Strengthen cybersecurity education for youth, guide the youth to go online rationally. Deeply implement the China Good Netizen Project and the Network Public Interest Project, guide netizens in going online in a civilized manner, express themselves rationally, and create an online environment with a crisp atmosphere.

(24) Ensuring citizens use the web safely and according to the law. Firmly establish correct cybersecurity views, prevent cybersecurity risks according to the law. Implement cybersecurity responsibility systems, clarify the cybersecurity responsibilities of management departments and cybersecurity and informatization enterprises. Establish and perfect unified high-efficiency cybersecurity risk reporting mechanisms, research, judgment and handling mechanisms, and complete cybersecurity investigation structures. Strengthen the protection of lawful rights and interests in cyberspace concerning telecommunications secrecy, commercial secrets, personal privacy as well as reputation rights, property rights, etc. Strictly standardize the collection and use of user identities, telecommunications content and other such personal information activities, strengthen punishment of unlawful and illegal acts concerning the illegal acquisition, leaking, selling or provision of citizens’ personal information. Supervise cybersecurity and informatization enterprises in implementing their dominant responsibility, and implement security management responsibilities provided in laws. Complete emergency response mechanisms for sudden network and information incidents, and perfect cybersecurity and informatization joint law enforcement. Strengthen the construction of capabilities to control and punish online unlawful and criminal activities, investigate and prosecute unlawful and criminal activities such as criminal online finance, online slander, online fraud, online sex, attacks, intrusions, etc. Establish and complete information sharing mechanisms, vigorously participate in international attacks against unlawful and criminal activities online.

法治社会建设实施纲要(2020-2025年)》全文如下。

法治社会是构筑法治国家的基础,法治社会建设是实现国家治理体系和治理能力现代化的重要组成部分。建设信仰法治、公平正义、保障权利、守法诚信、充满活力、和谐有序的社会主义法治社会,是增强人民群众获得感、幸福感、安全感的重要举措。党的十九大把法治社会基本建成确立为到2035年基本实现社会主义现代化的重要目标之一,意义重大,影响深远,任务艰巨。为加快推进法治社会建设,制定本纲要。

一、总体要求

(一)指导思想。高举中国特色社会主义伟大旗帜,坚持以马克思列宁主义、毛泽东思想、邓小平理论、“三个代表”重要思想、科学发展观、习近平新时代中国特色社会主义思想为指导,全面贯彻党的十九大和十九届二中、三中、四中、五中全会精神,全面贯彻习近平法治思想,增强“四个意识”、坚定“四个自信”、做到“两个维护”,坚定不移走中国特色社会主义法治道路,坚持法治国家、法治政府、法治社会一体建设,培育和践行社会主义核心价值观,弘扬社会主义法治精神,建设社会主义法治文化,增强全社会厉行法治的积极性和主动性,推动全社会尊法学法守法用法,健全社会公平正义法治保障制度,保障人民权利,提高社会治理法治化水平,为全面建设社会主义现代化国家、实现中华民族伟大复兴的中国梦筑牢坚实法治基础。

(二)主要原则。坚持党的集中统一领导;坚持以中国特色社会主义法治理论为指导;坚持以人民为中心;坚持尊重和维护宪法法律权威;坚持法律面前人人平等;坚持权利与义务相统一;坚持法治、德治、自治相结合;坚持社会治理共建共治共享。

(三)总体目标。到2025年,“八五”普法规划实施完成,法治观念深入人心,社会领域制度规范更加健全,社会主义核心价值观要求融入法治建设和社会治理成效显著,公民、法人和其他组织合法权益得到切实保障,社会治理法治化水平显著提高,形成符合国情、体现时代特征、人民群众满意的法治社会建设生动局面,为2035年基本建成法治社会奠定坚实基础。

三、健全社会领域制度规范

(十一)推进社会诚信建设。加快推进社会信用体系建设,提高全社会诚信意识和信用水平。完善企业社会责任法律制度,增强企业社会责任意识,促进企业诚实守信、合法经营。健全公民和组织守法信用记录,建立以公民身份证号码和组织机构代码为基础的统一社会信用代码制度。完善诚信建设长效机制,健全覆盖全社会的征信体系,建立完善失信惩戒制度。结合实际建立信用修复机制和异议制度,鼓励和引导失信主体主动纠正违法失信行为。加强行业协会商会诚信建设,完善诚信管理和诚信自律机制。完善全国信用信息共享平台和国家企业信用信息公示系统,进一步强化和规范信用信息归集共享。加强诚信理念宣传教育,组织诚信主题实践活动,为社会信用体系建设创造良好环境。推动出台信用方面的法律。

六、依法治理网络空间

网络空间不是法外之地。推动社会治理从现实社会向网络空间覆盖,建立健全网络综合治理体系,加强依法管网、依法办网、依法上网,全面推进网络空间法治化,营造清朗的网络空间。

(二十二)完善网络法律制度。通过立改废释并举等方式,推动现有法律法规延伸适用到网络空间。完善网络信息服务方面的法律法规,修订互联网信息服务管理办法,研究制定互联网信息服务严重失信主体信用信息管理办法,制定完善对网络直播、自媒体、知识社区问答等新媒体业态和算法推荐、深度伪造等新技术应用的规范管理办法。完善网络安全法配套规定和标准体系,建立健全关键信息基础设施安全保护、数据安全管理和网络安全审查等网络安全管理制度,加强对大数据、云计算和人工智能等新技术研发应用的规范引导。研究制定个人信息保护法。健全互联网技术、商业模式、大数据等创新成果的知识产权保护方面的法律法规。修订预防未成年人犯罪法,制定未成年人网络保护条例。完善跨境电商制度,规范跨境电子商务经营者行为。积极参与数字经济、电子商务、信息技术、网络安全等领域国际规则和标准制定。

(二十三)培育良好的网络法治意识。坚持依法治网和以德润网相结合,弘扬时代主旋律和社会正能量。加强和创新互联网内容建设,实施社会主义核心价值观、中华文化新媒体传播等工程。提升网络媒介素养,推动互联网信息服务领域严重失信“黑名单”制度和惩戒机制,推动网络诚信制度化建设。坚决依法打击谣言、淫秽、暴力、迷信、邪教等有害信息在网络空间传播蔓延,建立健全互联网违法和不良信息举报一体化受理处置体系。加强全社会网络法治和网络素养教育,制定网络素养教育指南。加强青少年网络安全教育,引导青少年理性上网。深入实施中国好网民工程和网络公益工程,引导网民文明上网、理性表达,营造风清气正的网络环境。

(二十四)保障公民依法安全用网。牢固树立正确的网络安全观,依法防范网络安全风险。落实网络安全责任制,明确管理部门和网信企业的网络安全责任。建立完善统一高效的网络安全风险报告机制、研判处置机制,健全网络安全检查制度。加强对网络空间通信秘密、商业秘密、个人隐私以及名誉权、财产权等合法权益的保护。严格规范收集使用用户身份、通信内容等个人信息行为,加大对非法获取、泄露、出售、提供公民个人信息的违法犯罪行为的惩处力度。督促网信企业落实主体责任,履行法律规定的安全管理责任。健全网络与信息突发安全事件应急机制,完善网络安全和信息化执法联动机制。加强网络违法犯罪监控和查处能力建设,依法查处网络金融犯罪、网络诽谤、网络诈骗、网络色情、攻击窃密等违法犯罪行为。建立健全信息共享机制,积极参与国际打击互联网违法犯罪活动。

Internet Public User Account Information Service Management Regulations (Revision Draft – Opinion-seeking Version)

Posted on Updated on

Chapter I: General provisions

Article 1: These Regulations are formulated in order to standardize Internet public account information services, safeguard national security and the public interest, and protect the lawful interests of citizens, legal persons and other organizations, on the basis of the “Cybersecurity Law of the People’s Republic of China”, the “Internet Information Service Management Rules”, the “Online Information Content Ecology Governance Regulations” and other such laws, regulations and relevant State provisions.

Article 2: These Regulations apply to the provision and conduct of Internet public account information services within the territory of the People’s Republic of China.

Internet public accounts as mentioned in these Regulations, refers to online accounts of Internet users registered and operated on Internet sites, application software and other such online platforms, to produce and disseminate written, pictorial, audiovisual and other such information content to the social public.

public account platform as mentioned in these Regulations, refers to online information service providers providing public account registration and operation, information content dissemination and technical protection services to Internet users.

Public account producers and operators as mentioned in these Regulations, refers to natural persons, legal persons and non-legal person organizations registering and operating public accounts and engaging in content dissemination. 

Article 3: The national cybersecurity and informatization department is responsible for Internet public account information service supervision, management and law enforcement work nationwide. Local cybersecurity and informatization departments are, according to their duties and responsibilities, responsible for Internet public account information service supervision, management and law enforcement work within their administrative areas.

Article 4: Public service information service platforms and public account producers and operators shall abide by laws and regulations, fulfil social responsibilities and moral responsibilities, uphold the correct public opinion orientation and value orientation, carry forward the Socialist core value view, produce and disseminate healthy and upward, true and objective excellent information content, create a crisp and bright cyberspace, and stimulate progress of society and civilization. 

All levels’ Party and government bodies, enterprise and undertaking work units, and people’s organizations are encouraged to register and operate public accounts, produce and disseminate high-quality government affairs information or public service information, satisfying public information demand, and promoting economic and social development.

Public service information service platforms are encouraged to vigorously enhance government affairs information publication, public service and social government levels for Party and government bodies, enterprise and undertaking work units, and people’s organizations, provide full and necessary technical support and security protection.

Article 5: Public account information service platforms providing Internet public account information services, shall obtain corresponding qualifications as provided in national laws and regulations.

Public service information service platforms and public account producers and operators shall obtain an Internet news information service licence to provide Internet news information services to the social public.

Chapter II: Public service information service platforms

Article 6: Public service information service platforms shall bear dominant responsibility for information content and public account management, allocate management personnel and technical capabilities suited to the business scale, appoint persons to position responsible for content security, establish, complete and strictly implement management structures for account registration, content examination and verification, information inspection, ecological governance, emergency response, cybersecurity, data security, personal information protection, copyright protection, credit evaluation, etc., and uphold the security of the platform’s information content and public accounts, and the security of data and personal information. 

Public service information service platforms shall, on the basis of relevant laws and regulations and relevant State provisions, formulate and publish management norms and platform conventions for information content production, public account operations, etc., and conclude service agreements with public account producers and operators, clarifying both sides’ content dissemination limitations, account management responsibilities and other such rights and obligations. 

Article 7: Public service information service platforms shall, according to relevant national standards and norms, establish categorized public account registration and categorized production structures, implement categorized management, and file the matter with the provincial, autonomous region or municipal cybersecurity and informatization department of the locality of the public account.

Public service information service platforms shall, on the basis of indicators and dimensions such as an account’s information content quality, the credit evaluation of the account’s subject, etc., establish tiered management structures, and implement tiered account management. 

Public service information service platforms formulating content production and account operations management norms, platform conventions and other such important structures and measures shall file them with the local provincial, autonomous region or municipal cybersecurity and informatization department; when bringing related new technologies, new applications or new functions online, they shall conduct a security assessment according to relevant regulations. 

Article 8: Public service information service platforms shall adopt measures such as composite verification, etc., to conduct real identity information authentication  of Internet users applying to register for a public account, based on mobile telephone number, resident identity card number or unified social credit code and other such methods, and raise the accuracy of authentication. Where users do not provide real identity information, or improperly use real identity information of organizations, bodies or other persons to conduct a false registration, no related service may be provided to them.

Public service information service platforms shall conduct inspection of the legal and regulatory compliance of public account names, portraits, bios, etc. of public accounts registered by Internet users, where they discover an account name, portrait or bio does not conform to the subject’s real identity information, and especially where they use or link to Party or government bodies, enterprise and undertaking work units and other such organizations and bodies or well-known social personalities without authorization, as well as where the corresponding registration information contains unlawful or harmful information, they shall suspend the provision of services and notify the user to correct matters within a limited time, where these refuse to correct the matter, the provision of services shall be terminated.

Public service information service platforms shall prohibit public accounts closed according to the law or to the convention to re-register under a similar name; where an account name with a high degree of connectedness to them is registered, the real identity information, service qualifications, etc. of the account subject shall also be subject to necessary checks.

Article 9: Public service information service platforms shall require public accounts applying to register and engage in the production of information content in areas such as economics, education, health, judicial affairs, etc., require users to provide their specialized background at the time of registration, as well as corresponding materials to prove professional qualifications or service qualifications they have acquired according to laws and administrative regulations, and conduct the necessary checks.

Public service information service platforms shall add a special symbol to public accounts after they are checked and passed, and according to the different subject nature of the user, externally announce content production categories, the name of operating subjects, the registered business address, uniform social credit code, contact method and other such registration information, to facilitate social supervision and inspection. 

Public service information service platforms shall establish dynamic checking and inspection structures, and at suitable times check the veracity and validity of registration information of producers and operators. 

Article 10: Public service information service platforms shall set reasonable upper limits to the number of registered public accounts of the same subject on their platform.  Where users apply to register for multiple public accounts, their subject nature, service qualifications, business scope, credit evaluation etc. shall also be checked.

Public service information service platforms may, on the basis of the service agreement suspend or terminate provision of services to public accounts who have not logged on or have been used for over six months after the Internet user registered.

Public service information service platforms shall complete technical measures to prevent and deal with unlawful registration acts by Internet users such as registration in excess of quota, malicious registration, false registration, etc.

Article 11: Public service information service platforms shall, according to the law and the convention, prohibit public account producers and operators to transfer, lend or illegally trade, sell or buy public accounts in violation of regulations. 

Where public account producers and operators transfer or donate public account use rights to other users, they shall put forward an application with the platform. The platform shall, on the basis of the provisions in the previous Paragraph, authenticate and check the user on the receiving side, and publish the subject change information. Where the platform discovers a producer or operator has transferred a public account without inspection or authorization, it shall timely suspend or terminate the provision of services.

Public account producers and operators voluntarily terminating account operations may apply with the platform for suspension or termination of use. The platform shall suspend or terminate the provision of services according to the service agreement. 

Article 12: Public service information service platforms shall establish public account supervision and assessment mechanisms, and prevent acts of falsification of account subscriptions, user following numbers, content click rates, repost or comment quantities and other such data.

Public service information service platforms shall standardize public account recommendation, subscription and following mechanisms, and complete technological measures to timely discover and deal with unusual changing circumstances in account subscription and following numbers. Without the knowledge and agreement of the Internet user, subscription and following of other users’ public accounts may not be forced.

Article 13: Public service information service platforms shall establish tiered credit management systems, and provide corresponding services on the basis of credit tiers.

Public service information service platforms shall establish and complete mechanisms to warn for, discover, trace, refute, delete and in other ways deal with online rumours and other such false information, and reduce the credit tier or blacklist public account producers and operators who produced and disseminated rumours and other such false information. 

Article 14: Public service information service platforms shall, when conducting content supply and account recommendation cooperation with producers and users, standardize commercial activities such as management of advertising and operations, knowledge payment, e-commerce sales, user gratuities, etc., they may not disseminate false advertising, conduct exaggerated propaganda, commit commercial fraud, etc., preventing operations violating laws and regulations. 

Public service information service platforms shall strengthen copyright protection of originally produced information content, preventing acts of piracy and infringement. Platforms may not abuse their advantaged position to interfere in the lawful and compliant operations of producers and operators, or infringe users’ lawful rights and interests.

Chapter III: Public account information producers and operators.

Article 15: Public account information producers and operators shall, on the basis of categorized platform management norms, at the time of registering the public account, accurately fill out user’s subject nature, registered location, business location, content production category, contact method and other such basic information, enterprises, organizations, bodies and other such Internet users shall also indicate their main activity or business scope.

Public account producers shall aide by platform management norms, platform conventions and service agreements, and engage in information content production and dissemination in the relevant sectoral area on the basis of the registered content production category indicated at the time of public account registration.

Article 16: Public account producers and operators shall bear dominant responsibility for information content production and public account operations and management, and engage in information content production and account operations and activities according to laws and regulations. 

Public account producers and operators shall establish and complete  information content security examination and verification mechanism for the entire process of topic planning, editing and production, dissemination and popularization, interactive comments, etc., strengthen gatekeeping over information content’s orientation, veracity and legality, and maintain a benign order in online communication. 

Public account information producers and operators shall establish and complete security management mechanisms for the entire process of public account registration and use, operations and popularization, etc., manage and operate the account in a civilized, rational and standardized manner, attract the public’s attention, subscription, interaction and sharing with high-quality information content, and maintain a benign social image of the account.

Article 17: Public account producers and operators shall, when reposting information content originally created by other persons, abide by copyright protection-related laws and regulations, indicate the original creator and a traceable information source, and respect and protect the lawful rights and interests of copyright holders. 

Public account producers and operators shall manage messages, posts, comments and other such interactive segments on their account. Platforms may, on the basis of the subject nature and credit tier of the public account, rationally set up management limits, and provide corresponding technological support. 

Where public account producers and operators conduct account operations, content provision and other such cooperation with third-party bodies , both sides shall conduct checks and gatekeeping of the account’s operations and activities, supplied information content, etc.

Article 18: Public account producers and operators may not commit the following acts in violation of laws and regulations:

(1) Not registering with real identity information, or registering with a public account name, portrait, bio, etc. that is not conform with one’s own real identity information;

(2) Maliciously posing as, imitating or misappropriating the public account of an organization, body or other person to produce and disseminate information content;

(3) Providing Internet news information gathering, dissemination and other such services without a licence or in excess of a licence’s scope;

(4) Manipulatively using accounts on multiple platforms, to publish batches of homogenous information content, generating false flow data, and creating false public opinion hot spots;

(5) Using sudden public incidents to incite extreme emotions and acts, or commit online violence harming the reputation of other persons and organizations, influencing social harmony and stability;

(6) Fabricating false information, counterfeiting originally-created content, quoting or concocting untrue information sources, distorting facts and truths, misleading the social public;

(7) Using paid dissemination and deletion of information and other such methods to commit illegal online surveillance, marketing frauds, extortion and blackmail, in pursuit of improper gain;

(8) Registering in batches, hoarding or illegally trading, buying and selling public accounts;

(9) Producing, reproducing or disseminating unlawful information, or not adopting measures to prevent and resist the production, reproduction or dissemination of harmful information;

(10) Other acts prohibited in laws and administrative regulations. 

Chapter IV: Supervision and management

Article 19: Public service information service platforms shall strengthen supervision and management of public service information service activities, and timely discover and deal with information or activities violating laws and regulations. 

Public service information service platforms shall, on the basis of service agreements and platform conventions, adopt measures to deal with public accounts violating these regulations and relegated laws and regulations including warnings and alerts, limiting account functions, suspending content renewal, ceasing advertising dissemination, closing or cancelling accounts, blacklisting, termination of re-registration, etc., preserve relevant records, and timely report the matter to cybersecurity and informatization and other such relevant competent department. 

Article 20: Public service information service platforms and producers and operators shall consciously accept social supervision.

Public service information service platforms shall set up eye-catching and convenient reporting interfaces, publish appeals, complaints and reporting methods and other such information, complete reporting information acceptance, screening, handling and feed-back mechanisms, clarify handling workflows and feed-back time limits, and timely and effectively deal with complaints by producers and operators, and complaints and reports from the public.

Internet sectoral organizations are encouraged to conduct public appraisal, promote strict self-discipline of public service information service platforms and producers and operators, establish authoritative mediation mechanisms with participation from multiple sides, fairly and relationally resolve sectoral disputes, and safeguard users’ lawful rights and interests according to the law.

Article 21: All levels’ cybersecurity and informatization departments will establish and complete coordinated supervision and management work mechanisms together with relevant competent departments, to supervise and guide public service information service platforms and producers and operators to conduct related information service activities according to laws and regulations.

Public service information service platforms and producers and operators shall cooperate with relevant competent departments’ lawful conduct of supervision and inspection, and provide the necessary technical support and assistance. 

Where public service information service platforms and producers and operators violate these Regulations, cybersecurity and informatization departments and relevant competent departments will impose punishment according to relevant laws and regulations within their scope of duties and responsibilities.

Article 22: These Regulations take effect on (day, month) 2020.

互联网用户公众账号信息服务管理规定(修订草案征求意见稿)

第一章 总则
第一条 为规范互联网用户公众账号信息服务,维护国家安全和公共利益,保护公民、法人和其他组织的合法权益,根据《中华人民共和国网络安全法》《互联网信息服务管理办法》《网络信息内容生态治理规定》等法律法规和国家有关规定,制定本规定。

第二条 在中华人民共和国境内提供、从事互联网用户公众账号信息服务,应当遵守本规定。

本规定所称互联网用户公众账号,是指互联网用户在互联网站、应用程序等网络平台注册运营,面向社会公众生产发布文字、图片、音视频等信息内容的网络账号。

本规定所称公众账号信息服务平台,是指为互联网用户提供公众账号注册运营、信息内容发布与技术保障服务的网络信息服务提供者。

本规定所称公众账号生产运营者,是指注册运营公众账号从事内容生产发布的自然人、法人或非法人组织。

第三条 国家网信部门负责全国互联网用户公众账号信息服务的监督管理执法工作。地方网信部门依据职责负责本行政区域内互联网用户公众账号信息服务的监督管理执法工作。

第四条 公众账号信息服务平台和公众账号生产运营者应当遵守法律法规,履行社会责任、道德责任,坚持正确舆论导向、价值取向,弘扬社会主义核心价值观,生产发布健康向上、真实客观的优质信息内容,营造清朗网络空间,促进社会文明进步。

鼓励各级党政机关、企事业单位和人民团体注册运营公众账号,生产发布高质量政务信息或公共服务信息,满足公众信息需求,推动经济社会发展。

鼓励公众账号信息服务平台积极为党政机关、企事业单位和人民团体提升政务信息发布、公共服务和社会治理水平,提供充分必要的技术支持和安全保障。

第五条 公众账号信息服务平台提供互联网用户公众账号信息服务,应当取得国家法律法规规定的相关资质。

公众账号信息服务平台和公众账号生产运营者向社会公众提供互联网新闻信息服务,应当取得互联网新闻信息服务许可。

第二章 公众账号信息服务平台

第六条 公众账号信息服务平台应当履行信息内容和公众账号管理主体责任,配备与业务规模相适应的管理人员和技术能力,设置内容安全负责人岗位,建立健全并严格落实账号注册、内容审核、信息巡查、生态治理、应急处置、网络安全、数据安全、个人信息保护、著作权保护、信用评价等管理制度,维护平台信息内容与公众账号安全、数据和个人信息安全。

公众账号信息服务平台应当依据相关法律法规和国家有关规定,制定并公开信息内容生产、公众账号运营等管理规则、平台公约,与公众账号生产运营者签订服务协议,明确双方内容发布权限、账号管理责任等权利义务。

第七条 公众账号信息服务平台应当按照国家有关标准和规范,建立公众账号分类注册和分类生产制度,实施分类管理,并将公众账号向所在地省、自治区、直辖市网信部门备案。

公众账号信息服务平台应当依据账号信息内容质量、账号主体信用评价等指标维度,建立分级管理制度,实施账号分级管理。

公众账号信息服务平台制定内容生产与账号运营管理规则、平台公约等重要制度措施,应当向所在地省、自治区、直辖市网信部门备案;上线相关新技术新应用新功能,应当按照有关规定进行安全评估。

第八条 公众账号信息服务平台应当采取复合验证等措施,对申请注册公众账号的互联网用户进行基于移动电话号码、居民身份证号码或统一社会信用代码等方式的真实身份信息认证,提高认证准确率。用户不提供真实身份信息的,或冒用组织机构、他人真实身份信息进行虚假注册的,不得为其提供相关服务。

公众账号信息服务平台应当对互联网用户注册的公众账号名称、头像和简介等进行合法合规性核验,发现账号名称、头像和简介与注册主体真实身份信息不相符的,特别是擅自使用或关联党政机关、企事业单位等组织机构或社会知名人士名义的,以及相关注册信息含有违法和不良信息的,应当暂停提供服务并通知用户限期改正,拒不改正的,应当终止提供服务。

公众账号信息服务平台应当禁止被依法依约关闭的公众账号以相同账号名称重新注册;对注册与其关联度高的账号名称,还应当对账号主体真实身份信息、服务资质等进行必要核验。

第九条 公众账号信息服务平台对申请注册从事经济、教育、卫生、司法等领域信息内容生产的公众账号,应当要求用户在注册时提供其专业背景,以及依照法律、行政法规获得的职业资格或服务资质等相关证明材料,并进行必要核验。

公众账号信息服务平台应当对核验通过后的公众账号加注专门标识,并根据用户的不同主体性质,对外公示内容生产类别、运营主体名称、注册运营地址、统一社会信用代码、联系方式等注册信息,方便社会监督查询。

公众账号信息服务平台应当建立动态核验巡查制度,适时核验生产运营者注册信息的真实性、有效性。

第十条 公众账号信息服务平台应当对同一主体在本平台注册公众账号的数量合理设定上限。对申请注册多个公众账号的用户,还应当对其主体性质、服务资质、业务范围、信用评价等进行核验。

公众账号信息服务平台对互联网用户注册后超过六个月不登录、不使用的公众账号,可以根据服务协议采取暂停或终止提供服务。

公众账号信息服务平台应当健全技术手段,防范和处置互联网用户超限量注册、恶意注册、虚假注册等违规注册行为。

第十一条 公众账号信息服务平台应当依法依约禁止公众账号生产运营者违规转让借用或者非法交易买卖公众账号。

公众账号生产运营者向其他用户转让或赠与公众账号使用权的,应当向平台提出申请。平台应当依据前款规定对受让方用户进行认证核验,并公示主体变更信息。平台发现生产运营者未经审核擅自转让公众账号的,应当及时暂停或终止提供服务。

公众账号生产运营者自行停止账号运营,可以向平台申请暂停或终止使用。平台应当按照服务协议暂停或终止提供服务。

第十二条 公众账号信息服务平台应当建立公众账号监测评估机制,防范账号订阅数、用户关注度、内容点击率、转发评论量等数据造假行为。

公众账号信息服务平台应当规范公众账号推荐订阅关注机制,健全技术手段,及时发现、处置账号订阅关注数量的异常变动情况。未经互联网用户知情同意,不得强制订阅关注其他用户公众账号。

第十三条 公众账号信息服务平台应当建立信用等级管理体系,根据信用等级提供相应服务。

公众账号信息服务平台应当建立健全网络谣言等虚假信息预警、发现、溯源、甄别、辟谣、消除等处置机制,对制作发布谣言等虚假信息的公众账号生产运营者降低信用等级或列入黑名单。

第十四条 公众账号信息服务平台与生产运营者开展内容供给与账号推广合作,应当规范管理广告经营、知识付费、电商销售、用户打赏等经营行为,不得发布虚假广告、进行夸大宣传、实施商业欺诈等,防止违法违规运营。

公众账号信息服务平台应当加强对原创信息内容的著作权保护,防范盗版侵权行为。平台不得滥用优势地位干扰生产运营者合法合规运营、侵犯用户合法权益。

第三章 公众账号生产运营者

第十五条 公众账号生产运营者应当根据平台分类管理规则,在注册公众账号时如实填写用户主体性质、注册地、运营地、内容生产类别、联系方式等基本信息,企业、组织机构等互联网用户还应当注明主要经营或业务范围。

公众账号生产运营者应当遵守平台管理规则、平台公约和服务协议,根据公众账号注册时登记的内容生产类别,从事相关行业领域的信息内容生产发布。

第十六条 公众账号生产运营者应当履行信息内容生产与公众账号运营管理主体责任,依法依规从事信息内容生产和账号运营活动。

公众账号生产运营者应当建立健全选题策划、编辑制作、发布推广、互动评论等全过程信息内容安全审核机制,加强信息内容导向性、真实性、合法性把关,维护网络传播良好秩序。

公众账号生产运营者应当建立健全公众账号注册使用、运营推广等全过程安全管理机制,文明理性、规范管理运营账号,以优质信息内容吸引公众关注订阅和互动分享,维护账号良好社会形象。

第十七条 公众账号生产运营者转载他人原创信息内容,应当遵守著作权保护相关法律法规,标注原创作者和可追溯信息来源,尊重和保护著作权人的合法权益。

公众账号生产运营者应当对账号留言、跟帖、评论等互动环节进行管理。平台可以根据公众账号的主体性质、信用等级,合理设置管理权限,提供相关技术支持。

公众账号生产运营者与第三方机构开展账号运营、内容供给等合作,双方均应当对账号运营行为、供给的信息内容等进行审核把关。

第十八条 公众账号生产运营者不得有下列违法违规行为:

(一)不以真实身份信息注册,或注册与自身真实身份信息不相符的公众账号名称、头像、简介等;

(二)恶意假冒、仿冒或盗用组织机构及他人公众账号生产发布信息内容;

(三)未经许可或超越许可范围提供互联网新闻信息采编发布等服务;

(四)操纵利用多个平台账号,批量发布同质信息内容,生成虚假流量数据,制造虚假舆论热点;

(五)借突发公共事件煽动极端情绪行为,或实施网络暴力损害他人和组织名誉,影响社会和谐稳定;

(六)编造虚假信息,伪造原创内容,引用或捏造不实信息来源,歪曲事实真相,误导社会公众;

(七)以有偿发布、删除信息等手段,实施非法网络监督、营销诈骗、敲诈勒索,牟取不当利益;

(八)批量注册、囤积或非法交易买卖公众账号;

(九)制作、复制、发布违法信息,或未采取措施防范和抵制制作、复制、发布不良信息;

(十)法律、行政法规禁止的其他行为。

第四章 监督管理

第十九条 公众账号信息服务平台应当加强对本平台公众账号信息服务活动的监督管理,及时发现和处置违法违规信息或行为。

公众账号信息服务平台应当依据服务协议和平台公约,对违反本规定及相关法律法规的公众账号采取警示提醒、限制账号功能、暂停内容更新、停止广告发布、关闭注销账号、列入黑名单、禁止重新注册等处置措施,保存有关记录,并及时向网信等有关主管部门报告。

第二十条 公众账号信息服务平台和生产运营者应当自觉接受社会监督。

公众账号信息服务平台应当设置醒目、便捷举报入口,公布申诉、投诉、举报方式等信息,健全举报信息受理、甄别、处置、反馈等机制,明确处理流程和反馈时限,及时有效处理生产运营者申诉和公众投诉举报。

鼓励互联网行业组织开展公众评议,推动公众账号信息服务平台和生产运营者严格自律,建立多方参与的权威调解机制,公平合理解决行业纠纷,依法维护用户合法权益。

第二十一条 各级网信部门会同有关主管部门建立健全协作监管等工作机制,监督指导公众账号信息服务平台和生产运营者依法依规从事相关信息服务活动。

公众账号信息服务平台和生产运营者对有关主管部门依法实施的监督检查,应当予以配合,并提供必要的技术支持与协助。

公众账号信息服务平台和生产运营者违反本规定的,由网信部门和有关主管部门在职责范围内依照相关法律法规处理。

第二十二条 本规定自2020年 月 日起施行。

Guidelines for the Construction of the Online Data Security Standards System

Posted on Updated on

(Opinion-seeking draft)

April 2020

Foreword

Following the connection and convergence of information technology and human production and lives, global data have gained the characteristics of explosive growth and massive collection, the big data industry is in a period of brisk development, technological progress and application innovation have accelerated their advance in lockstep, data resources have become national fundamental strategic resources and innovation factors for social production. At present, our country’s telecommunications and Internet sectors are developing rapidly, collecting large amounts of online data, and at the same time as liberating the development potential of the data economy and stimulating the accelerated growth of the data economy, we face severe security risks. This requires that we deeply understand the importance and urgency of online data security, persist in equally stressing security and development, vigorously responding to complex and severe security risks and challenges, and accelerate the construction of a security protection system for online data.

“In safe development, standards go first”, standardization work is an important basis in guaranteeing online data security. In order to implement the requirements of laws and regulations such as the “Cybersecurity Law of the People’s Republic of China”, the “National People’s Congress Standing Committee Decision concerning Strengthening Online Information Protection”, the “Telecommunications and Internet User Personal Information Protection Regulations”, etc., guide online data security standardization work in the telecommunications and Internet sectors, the Ministry of Industry and Information Technology has organized the drafting of the “Guidelines for the Construction of the Online Data Security Standards System” (hereafter simply named “Construction Guidelines”. The “Construction Guidelines” give full rein to the top-level design and fundamental guidance roles of standards, and provides a powerful support for guaranteeing online data security in the telecommunications and Internet sectors, stimulating the rational and orderly flow of online data, and assist the high-quality development of the digital economy. Read the rest of this entry »

Notice concerning Promoting the Accelerated Development of 5G

Posted on Updated on

 

MIIT Communications No. (2020)49

All provincial, autonomous regions, municipal, plan-listed city and Xinjiang Production-Construction Corps controlling departments for industry and information technology, and wireless communications management bodies, all provincial, autonomous region and municipal telecommunications management bureaus, China Telecom Group Co. Ltd., China Mobile Telecommunications Group Co. Ltd., China Unicom Telecommunications Group Co. Ltd., China Tower Co. Ltd., China Broadcast Network Co. Ltd.:

In order to deeply implement the spirit of General Secretary Xi Jinping’s important speech concerning promoting the accelerated development of 5G networks, forcefully advance 5G network construction, usage, popularization, technology development and security protection, give full rein to the effects of scale and driving role of new 5G infrastructure, and support high-quality economic development, hereby, related matters are notified as follows:

Read the rest of this entry »

Determination Rules on Acts of Collecting and Using Personal Information in Violation of Rules and Regulations in Apps

Posted on Updated on

Notice concerning Issuance of the “Determination Rules on Acts of Collecting and Using Personal Information in Violation of Rules and Regulations in Apps”

All provincial, autonomous region, municipal and the Xinjiang Production-Construction Corps cybersecurity and informatization offices, telecommunications management bureaus, public security offices (bureaus), market supervision and management bureaus (offices, committees):

On the basis of the “Announcement concerning a Special Campaign on Collection and Use of Personal Information in Violation of Rules and Regulations in Apps”, in order to provide reference for the determination of acts of collecting and using personal information in violations of rules and regulations in apps, implement laws and regulations such as the “Cybersecurity Law”, etc., the Cyberspace Administration of China, Ministry of Industry and Information Technology, Ministry of Public Security, and State Administration of Market Regulation have jointly formulated the “Determination Rules on Acts of Collecting and Using Personal Information in Violation of Rules and Regulations in Apps”. These are hereby issued to you, please refer to and implement them in integration with supervision, management and law enforcement work realities.

Cyberspace Administration of China Secretariat

Ministry of Industry and Information Technology General Office

Ministry of Public Security General Office

State Administration for Market Regulation General Office

28 November 2019

Determination Rules on Acts of Collecting and Using Personal Information in Violation of Rules and Regulations in Apps

On the basis of the “Announcement concerning a Special Campaign on Collection and Use of Personal Information in Violation of Rules and Regulations in Apps”, in order to provide reference for the determination of acts of collecting and using personal information in violations of rules and regulations in apps, provide guidance for app operators’ self-inspection and self-rectification as well as netizens’ social supervision, and implement laws and regulations such as the “Cybersecurity Law”, these Rules are formulated.

I, The following acts may be determined as “not publishing collection and use norms”

1. There is no privacy policy in the app, or the privacy policy does not contain norms on the collection and use of personal information;

2. When using the app for the first time, users are not prompted to read privacy policies and other such norms on collection and use through a pop-up window and other such clear methods

3. The privacy policy and other such collection and use norms are difficult to access, for instance when after entering the app’s main interface, 4 clicks or other such manipulations are required before it can be accessed;

4. The privacy policy and other such collection and use norms are difficult to read, for instance because characters are too small and closely spaced, colours are too light, they are blurred and unclear, or no simplified Mandarin version is provided.

II, The following acts may be determined as “not indicating the objective, method and scope of collecting and using personal information”

1. Not listing the objective, method and scope of personal information collection and use in the app (including entrusted third parties or embedded third-party code and plug-ins) one by one;

2. When a change occurs in the objective, method and scope of personal information collection and use, not notifying the user in an appropriate manner, appropriate manners include revising the privacy policy and other such collection and use norms and alerting the user to read it;

3. When requesting to activate authorization of collectable personal information, or requesting to collect users’ identity card number, bank account number, geographical tracking and other such sensitive personal information, not simultaneously notifying the user about its objective, or having an unclear or difficult to understand objective.

4. Content related to collection and use norms is obscure and difficult to understand, verbose and overly detailed, which is difficult for users to understand, for instance using large amounts of specialist jargon, etc.

III, The following acts may be determined as “collecting and using personal information without users’ consent”

1. Beginning to collect personal information or activating authorizations for collectable information before obtaining users’ consent;

2. After users clearly indicate they do not consent, still collecting personal information or activating up collectable personal information authorizations, or frequently obtaining users’ consent, interfering with users’ regular use;

3. Actually collecting personal information or activating collectable personal information authorizations in excess of the scope of user authorization;

4. Obtaining users’ consent by way of implicit agreement to privacy policies and other non-explicit methods;

5. Altering the status of collectable personal information authorizations they have set up without users’ consent, for instance automatically restoring user-set up authorization to implicit approval status when updating an app;

6. Using users’ personal information and algorithms to direct push delivery information, without providing an option for non-targeted push delivery information;

7. Misleading users through fraudulent, swindling and other such improper methods into consenting to personal information collection or the activation of collectable personal information authorizations, for instance wilfully hoodwinking or covering up the true objective for the collection of users’ personal information;

8. Not providing users with a way and method to revoke consent for personal information collection;

9. Collecting users’ personal information in violation of the announced collection and use norms. 

IV, The following acts may be determined as “collecting personal information in violation of the principle of necessity, that is not related to the provided service”

1.  Collected categories of personal information or activated collectable personal information authorizations are not related to the existing business functions;

2. Refusing to provide business functions because users do not consent to the collection of unnecessary personal information or the activation of unnecessary authorizations;

3.  Requesting the collection of personal information in excess of the scope the user originally consented to when adding new business functions to the app, refusing to provide the original business functions if the user does not agree, except where the newly added business function supersedes the original business function;

4. The frequency of personal information collection exceeds the actual needs of business functions;

5. Obliging he user to consent to personal information collection for only the purpose of improving of service quality, enhancing user experience, targeting push delivery information, researching and developing new products, etc., 

6. Requiring users to consent once to activating multiple collectable personal information authorizations, where use is impossible if users do not consent.

V, The following acts may be determined as “providing personal information to others without consent”

1. Providing personal information directly from the app customer end to third parties both without user content, and without anonymized processing, including providing personal information to third parties through methods such as embedding third-party code or plug-in components at the customer end, etc.;

2. Providing collected personal information to third parties after data is transmitted to the app’s back-end servers both without user content, and without anonymized processing;

3. Even if functions are provided to correct and delete personal information and cancel user accounts, not timely responding to user’s corresponding operations, requiring manual processing, not completing examination and processing within the committed time limits (the committed time limit may not exceed 15 working days, where there is not committed time limit, 15 working days are taken as limit);

4. Where the executing of correction or deletion of personal information, the cancellation of user accounts and other such user operations has been completed, but it is not completed at the app back-end;

5. Not establishing and publishing personal information security complaints and reporting channels, or not accepting and processing matters within the committed time limits (the committed time limit may not exceed 15 working days, where there is not committed time limit, 15 working days are taken as limit).

关于印发《App违法违规收集使用个人信息行为认定方法》的通知
各省、自治区、直辖市及新疆生产建设兵团网信办、通信管理局、公安厅(局)、市场监管局(厅、委):
  根据《关于开展App违法违规收集使用个人信息专项治理的公告》,为认定App违法违规收集使用个人信息行为提供参考,落实《网络安全法》等法律法规,国家互联网信息办公室、工业和信息化部、公安部、市场监管总局联合制定了《App违法违规收集使用个人信息行为认定方法》。现印发你们,请结合监管和执法工作实际参考执行。
国家互联网信息办公室秘书局
工业和信息化部办公厅
公安部办公厅
市场监管总局办公厅
  2019年11月28日
App违法违规收集使用个人信息行为认定方法
  根据《关于开展App违法违规收集使用个人信息专项治理的公告》,为监督管理部门认定App违法违规收集使用个人信息行为提供参考,为App运营者自查自纠和网民社会监督提供指引,落实《网络安全法》等法律法规,制定本方法。
  一、以下行为可被认定为“未公开收集使用规则”
  1.在App中没有隐私政策,或者隐私政策中没有收集使用个人信息规则;
  2.在App首次运行时未通过弹窗等明显方式提示用户阅读隐私政策等收集使用规则;
  3.隐私政策等收集使用规则难以访问,如进入App主界面后,需多于4次点击等操作才能访问到;
  4.隐私政策等收集使用规则难以阅读,如文字过小过密、颜色过淡、模糊不清,或未提供简体中文版等。
  二、以下行为可被认定为“未明示收集使用个人信息的目的、方式和范围”
  1.未逐一列出App(包括委托的第三方或嵌入的第三方代码、插件)收集使用个人信息的目的、方式、范围等;
  2.收集使用个人信息的目的、方式、范围发生变化时,未以适当方式通知用户,适当方式包括更新隐私政策等收集使用规则并提醒用户阅读等;
  3.在申请打开可收集个人信息的权限,或申请收集用户身份证号、银行账号、行踪轨迹等个人敏感信息时,未同步告知用户其目的,或者目的不明确、难以理解;
  4.有关收集使用规则的内容晦涩难懂、冗长繁琐,用户难以理解,如使用大量专业术语等。
  三、以下行为可被认定为“未经用户同意收集使用个人信息”
  1.征得用户同意前就开始收集个人信息或打开可收集个人信息的权限;
  2.用户明确表示不同意后,仍收集个人信息或打开可收集个人信息的权限,或频繁征求用户同意、干扰用户正常使用;
  3.实际收集的个人信息或打开的可收集个人信息权限超出用户授权范围;
  4.以默认选择同意隐私政策等非明示方式征求用户同意;
  5.未经用户同意更改其设置的可收集个人信息权限状态,如App更新时自动将用户设置的权限恢复到默认状态;
  6.利用用户个人信息和算法定向推送信息,未提供非定向推送信息的选项;
  7.以欺诈、诱骗等不正当方式误导用户同意收集个人信息或打开可收集个人信息的权限,如故意欺瞒、掩饰收集使用个人信息的真实目的;
  8.未向用户提供撤回同意收集个人信息的途径、方式;
  9.违反其所声明的收集使用规则,收集使用个人信息。
  四、以下行为可被认定为“违反必要原则,收集与其提供的服务无关的个人信息”
  1.收集的个人信息类型或打开的可收集个人信息权限与现有业务功能无关;
  2.因用户不同意收集非必要个人信息或打开非必要权限,拒绝提供业务功能;
  3.App新增业务功能申请收集的个人信息超出用户原有同意范围,若用户不同意,则拒绝提供原有业务功能,新增业务功能取代原有业务功能的除外;
  4.收集个人信息的频度等超出业务功能实际需要;
  5.仅以改善服务质量、提升用户体验、定向推送信息、研发新产品等为由,强制要求用户同意收集个人信息;
  6.要求用户一次性同意打开多个可收集个人信息的权限,用户不同意则无法使用。
  五、以下行为可被认定为“未经同意向他人提供个人信息”
  1.既未经用户同意,也未做匿名化处理,App客户端直接向第三方提供个人信息,包括通过客户端嵌入的第三方代码、插件等方式向第三方提供个人信息;
  2.既未经用户同意,也未做匿名化处理,数据传输至App后台服务器后,向第三方提供其收集的个人信息;
  3.App接入第三方应用,未经用户同意,向第三方应用提供个人信息。
  六、以下行为可被认定为“未按法律规定提供删除或更正个人信息功能”或“未公布投诉、举报方式等信息”
  1.未提供有效的更正、删除个人信息及注销用户账号功能;
  2.为更正、删除个人信息或注销用户账号设置不必要或不合理条件;
  3.虽提供了更正、删除个人信息及注销用户账号功能,但未及时响应用户相应操作,需人工处理的,未在承诺时限内(承诺时限不得超过15个工作日,无承诺时限的,以15个工作日为限)完成核查和处理;
  4.更正、删除个人信息或注销用户账号等用户操作已执行完毕,但App后台并未完成的;
  5.未建立并公布个人信息安全投诉、举报渠道,或未在承诺时限内(承诺时限不得超过15个工作日,无承诺时限的,以15个工作日为限)受理并处理的。

Personal Information Protection Law (Expert Suggestion Draft)

Posted on Updated on

Editorial note:

This suggestion draft is one of the outcomes of the National Social Science Fund Major Project “Important Legislative Questions for Internet Security” (14ZDC021) at Renmin University of China Law School, of which Professor Zhang Xinbao is lead expert, its objective is to provide reference for legislation, its authors are Zhang Xinbao and Ge Xin. On deficiencies in the suggestion draft, the submission of valuable opinions and suggestions is welcomed, to be sent to gexinde@126.com. After further revision and perfection, the suggestion draft and statement of grounds for legislation will be published in the near future by Renmin University of China Press, further attention is respectfully invited. Read the rest of this entry »

Management Rules for Credit Information of Gravely Untrustworthy Subjects in Internet Information Services (Opinion-seeking Draft)

Posted on Updated on

Article 1: In order to stimulate the construction of credit in the Internet information services area, ensure the lawful rights and interests of citizens, legal persons and other organizations, on the basis of the “Cybersecurity Law of the People’s Republic of China”, the “Planning Outline for the Construction of a Social Credit System”, the “State Council Guiding Opinions concerning Establishment and Perfection of Joint Incentive Structures for the Trustworthy and Joint Punishment Structures for the Untrustworthy, and Accelerating the Advance of Social Credit Construction”, the “State Council General Office Guiding Opinions concerning Accelerating the Advance of Social Credit System Construction and Building Novel Management Mechanisms Based on Credit” and the “State Council Notice  concerning Authorizing the Cyberspace Administration of China to Take Responsibility for Internet Information Content Management Work”, these Rules are formulated. Read the rest of this entry »

State Council General Office Guiding Opinions concerning Accelerating the Advance of Social Credit System Construction and Building Credit-Based Novel Supervision and Management Mechanisms

Posted on Updated on

GBF No. (2019)35

All provincial, autonomous region and municipal People’s Governments, all State Council Ministries and Commissions, all directly subordinate bodies:

In order to strengthen the construction of the social credit system, deeply advance the “release, management and service” reform, further give rein to the fundamental role of credit in innovating supervision and management mechanisms, raising supervision and management capacities and levels, even better incite the vigour of market subjects, and promote high-quality development, with the agreement of the State Council, the following Opinions are hereby put forward.

I, General requirements.

With Xi Jinping Thought on Socialism with Chinese characteristics for a new era as guidance, deeply implement the spirit of the 19th Party Committee and its 2nd and 3rd Plenums, according to the basic principles of acting according to laws and regulations, reform and innovation, coordinated and joint governance, with strengthening credit supervision and management as rallying points, innovate supervision and management concepts, supervision and management structures, and supervision and management methods, establish and complete novel supervision and management methods running throughout the whole lifecycle of market subjects, connecting supervision and management links ex ante, ad interim and ex post, incessantly enhance supervision and management capabilities and levels, further standardize market order, optimize the commercial environment, and promote high-quality development.

II, Innovating credit supervision and management in the ex-ante link

(1) Establishing and completing credit commitment structures. When handling administrative licencing affairs using credit commitment structures, where applicants’ commitments conform to approval conditions and they have submitted the relevant materials, this shall be handled immediately. Where applicants’ credit situation is relatively good, and a part of the application materials is incomplete but they commit in writing to provide this within the provided time period, they shall be accepted with priority, and the handling process is to be accelerated. The circumstances of honouring written commitments will be entered into credit records, to act as an important basis for ad interim and ex post supervision and management, applicants not honouring them will be subject to punishment in view of the circumstances. We must accelerate combing through administrative licensing items amenable to the introduction of credit commitments, formulate credit commitment letters with standardized templates, and rely on all levels’ credit portal websites to publish them. Market subjects are encouraged to actively issue credit commitments to society. Sectoral associations and chambers of commerce are supported in the establishment and completion of intra-sector credit commitment structures, strengthening sectoral self-discipline. (All localities and all departments are respectively responsible according to their duties)

(2) Exploring the introduction of business people’s pre-access sincerity education. Fully utilized all levels’ and all categories’ government service windows, to broadly launch education on legal compliance and sincerity among market subjects. When handling work related to registration, examination and approval, filing, etc. for market subjects, timely introduce standardized, regularized and convenient legal knowledge and credit knowledge education, raising business people’s consciousness on doing business according to the law and sincerely. The launch of credit education must not be fee-paying, and must also not be a necessary condition for market access. (All localities and all departments are respectively responsible according to their duties)

(3) Vigorously expand credit reporting applications. All kinds of market subjects are encouraged to more broadly and actively use credit reports in their production and commercial activities. In processes such as government procurement, tendering and bidding, administrative examination and approval, market access, credential verification, etc., fully give rein to the role of credit reports issues by public credit service bodies and third-party credit service bodies. Explore the establishment of nationwide uniform credit report standards, promote cross-regional mutual recognition of credit report results. (NDRC, PBoC take the lead, all localities and all departments are respectively responsible according to their duties)

III, Strengthening credit supervision and management in the ad interim segment

(4) Comprehensively establish market subject credit records. Establish credit information collection catalogues on the basis of lists of powers and responsibilities, timely, accurately and comprehensively record market subjects’ credit activities in the process of handing registration, qualification verification, daily supervision and management,  public service, etc., especially file and record untrustworthiness records, ensure that these can be consulted, verified and traced. ((All localities and all departments are respectively responsible according to their duties). Perfect uniform social credit code structures for legal persons and non-legal person organizations, use the uniform social credit code as a marker to integrate and shape integrated market subject credit records, and publish these according to laws and regulations through channels such as the “Credit China” website, he national enterprise credit information publication system or the China governmental web, as well as other related portal websites. Complete the 12315 market supervision and management complaint reporting hotline and informatized platform integration work, forcefully launch consumer complaints publication, stimulate businesspeople to implement their leading responsibility for consumer rights defence. (NDRC takes the lead, all departments are respectively responsible according to their duties).

(5) Establishing and completing voluntary credit information registration mechanisms. Encourage market subjects to voluntarily register credit information on qualifications and licences, market operations, contract fulfilment, social welfare, etc. on the “Credit China” website or other channels, to make public credit commitments concerning the veracity of the information, authorize the website to integrate, share and apply corresponding information.  Verified voluntarily registered information may be an important basis to conduct credit evaluation and generate credit reports. (NDRC takes the lead, all departments are respectively responsible according to their duties.

(6)  Deeply conducting comprehensive credit evaluation. The nationwide credit information sharing platforms must strengthen coordination and cooperation with relevant departments, integrate all kinds of credit information according to laws and regulations, conduct full-coverage, standardized, and public interest-type comprehensive public credit evaluation of market subjects, regularly report evaluation results to corresponding government department, financial bodies, sectoral associations and chambers of commerce for reference and use, and publish them to society according to relevant regulations. Promote relevant departments’ use of comprehensive public credit evaluation results, integrate departmental and sectoral management data, establish sectoral credit evaluation models, and provide ever more accurate bases for credit supervision and management. (NDRC takes the lead, all departments are respectively responsible according to their duties)

(7) Forcefully advancing tiered and categorized credit supervision and management. Divide supervision and management across tiers and categories on the basis of fully grasping credit information, and comprehensively deliberating the situation of credit, and on the basis of comprehensive public credit evaluation results and sectoral credit evaluation results, etc., and adopt differentiated supervision and management measures based on the height of the credit tier. “Double random and one public” supervision and management must be integrated with credit tiers, the proportion and frequency of spot checks may be reasonably lowered for market subjects with relatively good credit and relatively low risk, reducing influence to their regular production and operations; for market subjects with ordinary credit risks, spot checks are conducted with conventional proportions and frequencies; for law-breaking, untrustworthy, and relatively high-risk market subjects the proportion and frequency of spot checks will be appropriately increased, implementing strict management and punishment according to laws and regulations. (All localities and all departments are respectively responsible according to their duties)

IV, Perfecting credit supervision and management in the ex-post segment

(8) Completing determination mechanisms for the counterparts for joint punishment for trust-breaking. Relevant departments will establish and complete name list systems for the counterparts of joint punishment for trustworthiness according to laws and regulations, on the basis of untrustworthiness records obtained and determined during the ex ante and interim supervision and management segments. Market subjects with unlawful and untrustworthy acts of a malicious nature, with grave circumstances and relatively large social harm will be listed on the name list for joint punishment counterparts for untrustworthy acts according to procedure and on the basis of corresponding judicial verdicts, administrative punishments, administrative coercive measures, etc. Accelerate the perfection of relevant management rules, clarify determination bases, standards, procedures, dissent appeals and withdrawal mechanisms. For the formulation of management rules, the opinions from the social public must be fully solicited, and published standards and their concrete determination procedures will be made published to society in an appropriate manner. Relevant departments will be supported to establish name list systems for focus attention targets on the basis of requirement, for market subjects where untrustworthy acts exist but the degree of gravity has not reached the determination standard for joint punishment of untrustworthiness, it is permitted to implement strict supervision measures corresponding to the degree of their untrustworthiness. (All departments are respectively responsible according to their duties)

(9) Supervising rectification of untrustworthy market subjects within a limited time. Untrustworthy market subjects shall earnestly rectify matters within the provided time limits; where the rectification is insufficient, the determining department will initiate procedures for prompting talks or warning talks according to laws and regulations, according to the principle of “who determines, has the talk”, and supervise untrustworthy market subjects’ fulfilment of related duties and deletion of the harmful influence. Talk records are included into the credit record of the untrustworthy market subject, and are entered into the national credit information sharing platform after uniform collection. Forcefully advance special campaigns on untrustworthiness issues in focus areas, and adopt powerful and effective measures to accelerate the progress of rectification. (All departments are respectively responsible according to their duties)

(10) Deeply conducting joint punishment for untrustworthiness. Accelerate the construction of cross-regional, cross-sectoral, and cross-area joint punishment mechanisms for untrustworthiness, and resolve the problem that untrustworthy acts emerge repeatedly, or emerge in other areas at the roots. Establish joint punishment measure lists according to laws and regulations, dynamically renew them and publish them to society, and create a large structure for joint punishment for untrustworthiness with multi-barrelled roles for administrative, market and sectoral punishment measures, and broad participation from social forces. Focus on implementing punishment measures for untrustworthiness with great punitive strength and good supervision and management effects, including constraining targets of joint punishment for untrustworthiness according to laws and regulations from issuing shares, tendering and bidding, applying for funding projects from the finance administration, enjoying fiscal preferences and other such administrative punishment measures, restrict them from obtaining credit lines, traveling on aircraft, traveling on high-grade trains and seats and other such market punishment measures, as well as reporting for criticism, public denunciation and other such administrative punishment measures. (NDRC takes the lead, all localities and all departments are respectively responsible according to their responsibilities)

(11) Determinedly implementing market and sector ban mechanisms according to laws and regulations. Implement strict supervision and management, and strengthen punishment with the focus on food and drug products, ecology and the environment, engineering quality, safe production, care for the elderly and children, urban operational security and other such areas directly connected with the security of the popular masses’ lives and assets. Firmly implement market and sectoral ban measures within a certain time period according to laws and regulations, even up to permanent expulsion from markets, against market subjects and their relevant responsible persons who refuse to implement a judicial verdict or an administrative punishment decision, do not improve after repeated violations, resulting in major losses. (NDRC takes the lead, all localities and all departments are respectively responsible according to their duties)

(12) Lawfully investigate liability for law-breaking and untrustworthiness. Establish and complete liability investigation mechanisms, impose untrustworthiness punishment against the legal representative or main responsible persons and actual controlling persons of  market subjects listed on the joint punishment target list for untrustworthiness according to laws and regulations, and enter corresponding untrustworthy act on their personal credit record. Where unlawful or untrustworthy conduct occurs in organize undertaking work units or State-owned enterprises, it must be reported to the higher-level competent work unit and auditing department; where unlawful or trust-breaking conduct occurs among work personnel, they must be reported to their work unit and the related discipline inspection, supervision, organization and personnel departments. (All localities and all departments are respectively responsible according to their duties)

(13) Exploring the establishment of credit recovery mechanisms. Where untrustworthy market subjects correct the untrustworthy act and eliminate harmful influence within the provided time limit, they may conduct credit recovery through methods such as issuing credit commitments, completing credit rectification, passing credit inspections, accepting specialized training, submitting credit reports, participating in public interest and charity activities, etc. After recovery is completed, all localities and all departments must timely cease the publication of their untrustworthiness reports according to procedure, and terminate the implementation of joint punishment measures. Accelerate the establishment and perfection of mechanisms for coordination and joint action, handling all affairs through one network, and provide high-efficiency and convenient credit recovery services to untrustworthy market subjects. Third-party credit service bodies meeting conditions are encouraged to provide credit reports, credit management consulting and other such services. (NDRC takes the lead, all localities and all departments are respectively responsible according to their duties) 

V, Strengthening support and safeguards for credit supervision and management

(14) Striving to enhance credit supervision and management informatization construction levels. Give full rein to the information collection and sharing role of the nationwide credit information sharing platform and the national “Internet Plus Supervision and Management” system, ensure that government departments’ credit information “is fully collected where it shall be collected”, enhance the interconnection and interaction of local credit information platforms and sectoral credit information systems, create smooth government and enterprise data circulation mechanisms, create “one network” completely covering credit information of all localities, all departments and all kinds of market subjects. Rely on the national credit information sharing platform and the national “Internet Plus Supervision and Management” system to share basic market subject information, law enforcement supervision, management and punishment information, untrustworthiness joint punishment information etc. with related departmental operations systems according to requirement, add applications in the process of credit supervision and management and other such processes, support the creation of a credit supervision and management coordination mechanism with synchronized data, uniform measures and consistent standards. (NDRC and State Council General Office take the lead, all localities and all departments are respectively responsible according to their duties)

(15) Forcefully advancing credit supervision and management information openness and publication. On the basis of integrated publication of administrative licensing and administrative punishment information, entrust the “Credit China” website, the Chinese government network and other channels with further researching and promoting the open uploading of information on administrative obligations, administrative affirmations, administrative collection, administrative fees, administrative rulings, administrative compensation, administrative rewards, administrative supervision and inspection, and other such administrative acts within seven working days, promote the publication of information in judicial verdicts and law enforcement activities related to untrustworthy persons subject to enforcement and untrustworthy persons making false complaints of whom the information should be published, ensuring that “what shall be published, is fully published”. (All localities and all departments are respectively responsible according to their duties)

(16) Fully giving rein to the supporting role of “Internet Plus” and big data in credit supervision and management. Rely on the national “Internet Plus Supervision and Management” system and other such systems to effectively integrate public credit information, market credit information, complaints reporting information and related Internet and third-party information, fully use big data, artificial and other such new-generation information technologies to realize that credit supervision and management data can be compared, processes can be traced, and issues can be monitored. All localities and all departments are encouraged to, in integration with reality, cooperate with big data bodies according to laws and regulations to exploit credit information, grasp market subjects’ business situations and the characteristics of their laws in a timely and dynamic manner. Fully use the national “Internet Plus Supervision and Management” system and other such systems to establish early risk assessment and early warning mechanisms, to discover and prevent symptomatic, cross-sectoral and cross-regional risks early. Use big data to actively discover and distinguish clues for violations of laws and regulations, effectively prevent acts violating laws and regulations harming the public interests and the security of the masses’ lives and assets. It is encouraged to enhance law enforcement supervision and management efficiency through the Internet of Things, the Internet of Vision and other such non-contact supervision and management measures to enhance the efficiency of law enforcement, supervision and management, realize the standardization, accuratization and smartification of supervision and management, reduce human factors, realize fair supervision and management, stop problems such as wilful inspections, multi-headed supervision and inspection, etc., realize “entering the door once, inspecting multiple matters”, and reduce disturbance to supervision and management targets. (State Council General Office, NDRC, State Administration of Market Regulation take the lead, all departments are respectively responsible according to their duties.

(17) Realistically strengthening the protection of  credit information security and market subjects’ rights and interests. Strictly investigate and prosecute acts where credit information is leaked or distorted in violation of regulations, or credit information is used in pursuit of private gain, etc. Strengthen the construction of basic credit information security infrastructure and security protection capabilities. Establish and complete credit information objection and complaint structures, information providing and collecting work units must as quickly as possible examine and verify information to which market subjects have raised an objection and feed back the results, information verified as containing errors must be timely corrected or deleted. Where market subjects’ lawful rights and interests were harmed after they were erroneously assigned to the untrustworthiness joint punishment target list, or untrustworthiness joint measures were erroneously adopted, relevant departments and work units must vigorously adopt measures to eliminate the harmful influence. (All localities and al departments are responsible on the basis of their duties)

(18) Vigorously guiding sectoral organizations and credit service bodies to coordinate supervision and management. Relevant department-authorized sectoral associations and chambers of commerce are supported to assist in the conduct of sectoral credit construction and credit supervision and management, sectoral associations and chambers of commerce are encouraged to establish member credit records, conduct credit commitments, credit training, sincerity propaganda, sincerity advocacy etc., make sincerity into an important component for sectoral rules and sectoral conventions, and guide their sectors in strengthening awareness about doing business lawfully and sincerely. Promote the development of information services for credit inquiry, credit grading, credit insurance, credit guarantees, contract fulfilment guarantees, credit management consulting and training, etc., and realistically let third-party credit service bodies play a specialized role in aspects such as credit information collection, processing, use, etc. Relevant departments are encouraged to launch cooperation’s with third-party credit service bodies in areas such as credit record integration, credit information sharing, credit big data analysis, credit risk early warning, examination and verification of cases of untrustworthiness, tracing and monitoring of untrustworthy activities, etc. (NDRC, Ministry of Civil Affairs, People’s Bank of China are respectively responsible according to their duties)

VI, Strengthening organization and implementation of credit supervision and management

(19) Strengthening organizational leadership. All localities and all departments must make building credit-based novel supervision and management mechanisms into an important measure in deeply advancing the “release, manage, serve” reform, put it in an ever more prominent position, strengthen organizational leadership, detail divisions of work and responsibilities, and promote implementation in a forceful, orderly and effective manner. Perfect supplementary structures to credit supervision and management, and strengthen links with other elements of “release, manage, serve” reform. Departments responsible for market supervision and management and sectoral supervision and management must realistically bear their dominant responsibility in sectoral credit construction and credit supervision and management, fully give rein to the roles of sectoral organizations and third-party credit service bodies, create beneficial conditions for public supervision, integrate and create joint forces for credit supervision and management with joint participation from all of society. (NDRCD takes the lead, all departments and all localities are respectively responsible according to their duties) 

(20) Launching trials and demonstrations. Organize and launch credit construction and credit supervision and management trials and demonstrations revolving around credit commitments, credit recovery, untrustworthiness joint punishment, credit big data exploitation and use and other such focus work. On the basis of exploration and innovation in all localities and all departments, timely summarize, abstract and exchange good methods and good experiences in launching credit construction and credit supervision and management, and reproduce and broaden them on an ever greater scale (NDRC takes the lead, all localities and all departments are respectively responsible according to their duties)

(21) Accelerating the establishment of rules and structures. Promote the formulation of social credit system construction-related laws, accelerate the research and promulgation of public credit information management regulations, unified social credit code management rules and other such regulations. Establish and complete nationwide uniform credit supervision and management norms and standards, timely publish related local regulations, government rules and normative documents, and upgrade methods effective in credit supervision and management practice into structures and norms. Grasp the formulation of national standards urgently needed in credit supervision and management. (NDRC, Ministry of Justice take the lead, all localities and all departments are respectively responsible according to their duties)

(22) Conducting propaganda and explanation. All localities and all departments must, through all kinds of channels and methods, conduct policy propaganda and explanation work in a thorough and detailed manner for market subjects, to let businesspeople fully understand and vigorously cooperate with credit-based novel supervision and management measures. Strengthen guidance and training for grass-roots and first-line supervision and management personnel. Organize news media to report broadly, vigorously propagate credit supervision and management measures and their results, and create a benign social atmosphere. (NDRC takes the lead, all localities and all departments are respectively responsible according to their duties)

State Council General Office

9 July 2019      

国务院办公厅关于加快推进社会信用体系建设 构建以信用为基础的新型监管机制的指导意见
国办发〔2019〕35号

各省、自治区、直辖市人民政府,国务院各部委、各直属机构:
为加强社会信用体系建设,深入推进“放管服”改革,进一步发挥信用在创新监管机制、提高监管能力和水平方面的基础性作用,更好激发市场主体活力,推动高质量发展,经国务院同意,现提出如下意见。
一、总体要求
以习近平新时代中国特色社会主义思想为指导,深入贯彻落实党的十九大和十九届二中、三中全会精神,按照依法依规、改革创新、协同共治的基本原则,以加强信用监管为着力点,创新监管理念、监管制度和监管方式,建立健全贯穿市场主体全生命周期,衔接事前、事中、事后全监管环节的新型监管机制,不断提升监管能力和水平,进一步规范市场秩序,优化营商环境,推动高质量发展。
二、创新事前环节信用监管
(一)建立健全信用承诺制度。在办理适用信用承诺制的行政许可事项时,申请人承诺符合审批条件并提交有关材料的,应予即时办理。申请人信用状况较好、部分申报材料不齐备但书面承诺在规定期限内提供的,应先行受理,加快办理进度。书面承诺履约情况记入信用记录,作为事中、事后监管的重要依据,对不履约的申请人,视情节实施惩戒。要加快梳理可开展信用承诺的行政许可事项,制定格式规范的信用承诺书,并依托各级信用门户网站向社会公开。鼓励市场主体主动向社会作出信用承诺。支持行业协会商会建立健全行业内信用承诺制度,加强行业自律。(各地区各部门按职责分别负责)
(二)探索开展经营者准入前诚信教育。充分利用各级各类政务服务窗口,广泛开展市场主体守法诚信教育。为市场主体办理注册、审批、备案等相关业务时,适时开展标准化、规范化、便捷化的法律知识和信用知识教育,提高经营者依法诚信经营意识。开展诚信教育不得收费,也不得作为市场准入的必要条件。(各地区各部门按职责分别负责)
(三)积极拓展信用报告应用。鼓励各类市场主体在生产经营活动中更广泛、主动地应用信用报告。在政府采购、招标投标、行政审批、市场准入、资质审核等事项中,充分发挥公共信用服务机构和第三方信用服务机构出具的信用报告作用。探索建立全国统一的信用报告标准,推动信用报告结果实现异地互认。(发展改革委、人民银行牵头,各地区各部门按职责分别负责)
三、加强事中环节信用监管
(四)全面建立市场主体信用记录。根据权责清单建立信用信息采集目录,在办理注册登记、资质审核、日常监管、公共服务等过程中,及时、准确、全面记录市场主体信用行为,特别是将失信记录建档留痕,做到可查可核可溯。(各地区各部门按职责分别负责)完善法人和非法人组织统一社会信用代码制度,以统一社会信用代码为标识,整合形成完整的市场主体信用记录,并通过“信用中国”网站、国家企业信用信息公示系统或中国政府网及相关部门门户网站等渠道依法依规向社会公开。完成12315市场监管投诉举报热线和信息化平台整合工作,大力开展消费投诉公示,促进经营者落实消费维权主体责任。(发展改革委、市场监管总局负责)
(五)建立健全信用信息自愿注册机制。鼓励市场主体在“信用中国”网站或其他渠道上自愿注册资质证照、市场经营、合同履约、社会公益等信用信息,并对信息真实性公开作出信用承诺,授权网站对相关信息进行整合、共享与应用。经验证的自愿注册信息可作为开展信用评价和生成信用报告的重要依据。(发展改革委牵头,各部门按职责分别负责)
(六)深入开展公共信用综合评价。全国信用信息共享平台要加强与相关部门的协同配合,依法依规整合各类信用信息,对市场主体开展全覆盖、标准化、公益性的公共信用综合评价,定期将评价结果推送至相关政府部门、金融机构、行业协会商会参考使用,并依照有关规定向社会公开。推动相关部门利用公共信用综合评价结果,结合部门行业管理数据,建立行业信用评价模型,为信用监管提供更精准的依据。(发展改革委牵头,各部门按职责分别负责)
(七)大力推进信用分级分类监管。在充分掌握信用信息、综合研判信用状况的基础上,以公共信用综合评价结果、行业信用评价结果等为依据,对监管对象进行分级分类,根据信用等级高低采取差异化的监管措施。“双随机、一公开”监管要与信用等级相结合,对信用较好、风险较低的市场主体,可合理降低抽查比例和频次,减少对正常生产经营的影响;对信用风险一般的市场主体,按常规比例和频次抽查;对违法失信、风险较高的市场主体,适当提高抽查比例和频次,依法依规实行严管和惩戒。(各地区各部门按职责分别负责)
四、完善事后环节信用监管
(八)健全失信联合惩戒对象认定机制。有关部门依据在事前、事中监管环节获取并认定的失信记录,依法依规建立健全失信联合惩戒对象名单制度。以相关司法裁判、行政处罚、行政强制等处理结果为依据,按程序将涉及性质恶劣、情节严重、社会危害较大的违法失信行为的市场主体纳入失信联合惩戒对象名单。加快完善相关管理办法,明确认定依据、标准、程序、异议申诉和退出机制。制定管理办法要充分征求社会公众意见,出台的标准及其具体认定程序以适当方式向社会公开。支持有关部门根据监管需要建立重点关注对象名单制度,对存在失信行为但严重程度尚未达到失信联合惩戒对象认定标准的市场主体,可实施与其失信程度相对应的严格监管措施。(各部门按职责分别负责)
(九)督促失信市场主体限期整改。失信市场主体应当在规定期限内认真整改,整改不到位的,按照“谁认定、谁约谈”的原则,由认定部门依法依规启动提示约谈或警示约谈程序,督促失信市场主体履行相关义务、消除不良影响。约谈记录记入失信市场主体信用记录,统一归集后纳入全国信用信息共享平台。大力推进重点领域失信问题专项治理,采取有力有效措施加快推进整改。(各部门按职责分别负责)
(十)深入开展失信联合惩戒。加快构建跨地区、跨行业、跨领域的失信联合惩戒机制,从根本上解决失信行为反复出现、易地出现的问题。依法依规建立联合惩戒措施清单,动态更新并向社会公开,形成行政性、市场性和行业性等惩戒措施多管齐下,社会力量广泛参与的失信联合惩戒大格局。重点实施惩戒力度大、监管效果好的失信惩戒措施,包括依法依规限制失信联合惩戒对象股票发行、招标投标、申请财政性资金项目、享受税收优惠等行政性惩戒措施,限制获得授信、乘坐飞机、乘坐高等级列车和席次等市场性惩戒措施,以及通报批评、公开谴责等行业性惩戒措施。(发展改革委牵头,各地区各部门按职责分别负责)
(十一)坚决依法依规实施市场和行业禁入措施。以食品药品、生态环境、工程质量、安全生产、养老托幼、城市运行安全等与人民群众生命财产安全直接相关的领域为重点,实施严格监管,加大惩戒力度。对拒不履行司法裁判或行政处罚决定、屡犯不改、造成重大损失的市场主体及其相关责任人,坚决依法依规在一定期限内实施市场和行业禁入措施,直至永远逐出市场。(发展改革委牵头,各地区各部门按职责分别负责)
(十二)依法追究违法失信责任。建立健全责任追究机制,对被列入失信联合惩戒对象名单的市场主体,依法依规对其法定代表人或主要负责人、实际控制人进行失信惩戒,并将相关失信行为记入其个人信用记录。机关事业单位、国有企业出现违法失信行为的,要通报上级主管单位和审计部门;工作人员出现违法失信行为的,要通报所在单位及相关纪检监察、组织人事部门。(各地区各部门按职责分别负责)
(十三)探索建立信用修复机制。失信市场主体在规定期限内纠正失信行为、消除不良影响的,可通过作出信用承诺、完成信用整改、通过信用核查、接受专题培训、提交信用报告、参加公益慈善活动等方式开展信用修复。修复完成后,各地区各部门要按程序及时停止公示其失信记录,终止实施联合惩戒措施。加快建立完善协同联动、一网通办机制,为失信市场主体提供高效便捷的信用修复服务。鼓励符合条件的第三方信用服务机构向失信市场主体提供信用报告、信用管理咨询等服务。(发展改革委牵头,各地区各部门按职责分别负责)
五、强化信用监管的支撑保障
(十四)着力提升信用监管信息化建设水平。充分发挥全国信用信息共享平台和国家“互联网+监管”系统信息归集共享作用,对政府部门信用信息做到“应归尽归”,推进地方信用信息平台、行业信用信息系统互联互通,畅通政企数据流通机制,形成全面覆盖各地区各部门、各类市场主体的信用信息“一张网”。依托全国信用信息共享平台和国家“互联网+监管”系统,将市场主体基础信息、执法监管和处置信息、失信联合惩戒信息等与相关部门业务系统按需共享,在信用监管等过程中加以应用,支撑形成数据同步、措施统一、标准一致的信用监管协同机制。(发展改革委、国务院办公厅牵头,各地区各部门按职责分别负责)
(十五)大力推进信用监管信息公开公示。在行政许可、行政处罚信息集中公示基础上,依托“信用中国”网站、中国政府网或其他渠道,进一步研究推动行政强制、行政确认、行政征收、行政给付、行政裁决、行政补偿、行政奖励和行政监督检查等其他行政行为信息7个工作日内上网公开,推动在司法裁判和执行活动中应当公开的失信被执行人、虚假诉讼失信人相关信息通过适当渠道公开,做到“应公开、尽公开”。(各地区各部门按职责分别负责)
(十六)充分发挥“互联网+”、大数据对信用监管的支撑作用。依托国家“互联网+监管”等系统,有效整合公共信用信息、市场信用信息、投诉举报信息和互联网及第三方相关信息,充分运用大数据、人工智能等新一代信息技术,实现信用监管数据可比对、过程可追溯、问题可监测。鼓励各地区各部门结合实际,依法依规与大数据机构合作开发信用信息,及时动态掌握市场主体经营情况及其规律特征。充分利用国家“互联网+监管”等系统建立风险预判预警机制,及早发现防范苗头性和跨行业跨区域风险。运用大数据主动发现和识别违法违规线索,有效防范危害公共利益和群众生命财产安全的违法违规行为。鼓励通过物联网、视联网等非接触式监管方式提升执法监管效率,实现监管规范化、精准化、智能化,减少人为因素,实现公正监管,杜绝随意检查、多头监管等问题,实现“进一次门、查多项事”,减少对监管对象的扰动。(国务院办公厅、发展改革委、市场监管总局牵头,各部门按职责分别负责)
(十七)切实加大信用信息安全和市场主体权益保护力度。严肃查处违规泄露、篡改信用信息或利用信用信息谋私等行为。加强信用信息安全基础设施和安全防护能力建设。建立健全信用信息异议投诉制度,对市场主体提出异议的信息,信息提供和采集单位要尽快核实并反馈结果,经核实有误的信息要及时予以更正或撤销。因错误认定失信联合惩戒对象名单、错误采取失信联合惩戒措施损害市场主体合法权益的,有关部门和单位要积极采取措施消除不良影响。(各地区各部门按职责分别负责)
(十八)积极引导行业组织和信用服务机构协同监管。支持有关部门授权的行业协会商会协助开展行业信用建设和信用监管,鼓励行业协会商会建立会员信用记录,开展信用承诺、信用培训、诚信宣传、诚信倡议等,将诚信作为行规行约重要内容,引导本行业增强依法诚信经营意识。推动征信、信用评级、信用保险、信用担保、履约担保、信用管理咨询及培训等信用服务发展,切实发挥第三方信用服务机构在信用信息采集、加工、应用等方面的专业作用。鼓励相关部门与第三方信用服务机构在信用记录归集、信用信息共享、信用大数据分析、信用风险预警、失信案例核查、失信行为跟踪监测等方面开展合作。(发展改革委、民政部、人民银行按职责分别负责)
六、加强信用监管的组织实施
(十九)加强组织领导。各地区各部门要把构建以信用为基础的新型监管机制作为深入推进“放管服”改革的重要举措,摆在更加突出的位置,加强组织领导,细化责任分工,有力有序有效推动落实。完善信用监管的配套制度,并加强与其他“放管服”改革事项的衔接。负有市场监管、行业监管职责的部门要切实承担行业信用建设和信用监管的主体责任,充分发挥行业组织、第三方信用服务机构作用,为公众监督创造有利条件,整合形成全社会共同参与信用监管的强大合力。(发展改革委牵头,各地区各部门按职责分别负责)
(二十)开展试点示范。围绕信用承诺、信用修复、失信联合惩戒、信用大数据开发利用等重点工作,组织开展信用建设和信用监管试点示范。在各地区各部门探索创新的基础上,及时总结、提炼、交流开展信用建设和信用监管的好经验、好做法,在更大范围复制推广。(发展改革委牵头,各地区各部门按职责分别负责)
(二十一)加快建章立制。推动制定社会信用体系建设相关法律,加快研究出台公共信用信息管理条例、统一社会信用代码管理办法等法规。建立健全全国统一的信用监管规则和标准,及时出台相关地方性法规、政府规章或规范性文件,将信用监管中行之有效的做法上升为制度规范。抓紧制定开展信用监管急需的国家标准。(发展改革委、司法部牵头,各地区各部门按职责分别负责)
(二十二)做好宣传解读。各地区各部门要通过各种渠道和形式,深入细致向市场主体做好政策宣传解读工作,让经营者充分理解并积极配合以信用为基础的新型监管措施。加强对基层和一线监管人员的指导和培训。组织新闻媒体广泛报道,积极宣传信用监管措施及其成效,营造良好社会氛围。(发展改革委牵头,各地区各部门按职责分别负责)
国务院办公厅
2019年7月9日

Regulations on Internet Security Supervision and Inspection by Public Security Bodies

Posted on Updated on

Ministry of Public Security of the People’s Republic of China Decree

No. 151

The “Regulations on Internet Security Supervision and Inspection by Public Security Bodies” were passed at the Minister’s business meeting of the Ministry of Public Security on 5 September 2018, are hereby promulgated, and take effect on 1 November 2018.

Minister: Zhao Kezhi

15 September 2018

Regulations on Internet Security Supervision and Inspection by Public Security Bodies

Chapter I: General provisions

Article 1: These Regulations are formulated in order to standardize public security bodies’ Internet security supervision and inspection work, prevent online law-breaking and crime, safeguard cybersecurity, protect the lawful rights and interests of citizens, legal persons and other organizations, on the basis of the “People’s Police Law of the People’s Republic of China”, the “Cybersecurity Law of the People’s Republic of China” and other such laws and administrative regulations. 

Article 2: These Regulations apply to public security bodies conducting security supervision and inspection of Internet service providers’ and network-using work units’ fulfilment of cybersecurity duties provided in laws and administrative regulations. 

Article 3: Internet security supervision and inspection work is conducted by county-level or higher local People’s Government public security body cybersecurity protection departments. 

Higher-level public security bodies shall implement guidance and supervision of lower levels’ public security bodies’ conduct of Internet security supervision and inspection work.

Article 4: Public security bodies conducting Internet security supervision and inspection shall abide by the policies of scientific management, ensuring and stimulating development, strictly abide by statutory powers and procedures, incessantly improve law enforcement methods, and comprehensively implement law enforcement responsibilities. 

Article 5: Public security bodies and their work personnel shall strictly preserve the secrecy of personal information and privacy, commercial secrets and State secrets they learn in the process of fulfilling Internet security supervision and inspection duties and responsibilities, they may not leak this, sell it or illegally provide it to others.

Public security bodies and their work personnel can only use information they learn in the process of fulfilling Internet security supervision and inspection duties as required for maintaining cybersecurity, and may not use it for other purposes.

Article 6: Public security bodies shall timely notify relevant controlling departments and work units about cybersecurity risks they discover in the process of Internet security supervision and inspection work, which may harm national security, public security or social order.

Article 7: Public security bodies shall establish and implement rules for Internet security supervision and inspection work, and consciously accept supervision by inspection counterparts and the popular masses.

Chapter II: Supervision and inspection counterparts and content.

Article 8: Internet security supervision and inspection will be conducted by public security bodies of the locality of Internet service providers’ network service operations bodies and network using work units’ network management bodies. Where an Internet service provider is an individual, it may be implemented by the public security body of their regular place of residence.

Article 9: Public security bodies shall, on the basis of cybersecurity protection requirements and the concrete circumstances of cybersecurity risks and vulnerabilities, conduct supervision and inspection of the following Internet service providers and network-using work units.

(1) Those providing Internet access, Internet data centre, content distribution and domain name services;

(2) Those providing Internet information services;

(3) Those providing public network access services;

(4) Those providing other Internet services. 

Focus supervision and inspection shall be conducted of those who have not conducted the services provided in the previous Paragraph for a full year, those where a cybersecurity incident, breach of law or crime occurred within two years, or those who have been subject to administrative punishment by a public security body for not fulfilling statutory cybersecurity duties.

Article 10: Public security bodies shall, on the basis of the actual circumstances of Internet service providers’ and network-using work units fulfilling their statutory cybersecurity duties, and according to relevant State regulations and standards, conduct supervision and inspection of the following content:

(1) Whether or not they have conducted network work unit filing formalities, and have reported the access work unit, basic user information and changes therein;

(2) Whether or not they have formulated and implemented cybersecurity management rules and operating rules, and appointed a person responsible for cybersecurity;

(3) Whether or not they have adopted technical measures to record and preserve user registration information and network use record information according to the law;

(4) Whether or not they have adopted technical measures to defend against computer viruses, cyberattacks, cyber intrusions, etc.;

(5) Whether or not they have adopted corresponding prevention measures against the publication or transmission of information prohibited in laws and administrative regulations according to the law in public information services;

(6) Whether or not they have provided technical support and assistance to public security bodies lawfully maintaining cybersecurity, preventing and investigating terror activities, or investigating crimes according to statutory provisions;

(7) Whether or not they have fulfilled cybersecurity multi-level protection duties as provided in laws and administrative regulations.

Article 11: Apart from the content listed in Article 10 of these Regulations, public security bodies shall also conduct supervision and inspection of the following content, on the basis of the category of provided Internet services:

(1) Where Internet access services are provided, supervising and inspecting whether they have recorded and preserved network address, allocation and use details;

(2) Where Internet data centre services are provided, supervising and inspecting whether they have recorded user information of the host entrustment, host rental and virtual space rental they provide;

(3) Where Internet domain name services are provided, supervising and inspecting whether they have recorded network domain name application and modification information, and whether or not they have adopted measures to deal with unlawful domain names according to the law.

(4) Where Internet information services are provided, supervising and inspecting whether they have adopted user-disseminated information management measures according to the law, whether or not they have adopted measures to deal with already published or transmitted information of which the dissemination or transmission is prohibited by laws and administrative regulations, and maintained related records;

(5) Where Internet content distribution services are provided, supervising and inspecting whether or not they have recorded circumstances concerning content distribution network and content source network links;

(6) Where Internet public access services are provided, supervising and inspecting whether or not they have adopted technical network and information security protection measures conform to national standards.

Article 12: During periods of national major cybersecurity defence tasks, public security bodies may conduct targeted security supervision and inspection of the following content of Internet service providers and network-using work units related to national major cybersecurity defence tasks:

(1) Whether or not they have formulated work plans required for major national cybersecurity defence tasks, clarified cybersecurity duties and work divisions, and appointed a management person for cybersecurity;

(2) Whether or not they have organized and conducted cybersecurity risk assessments, and adopted corresponding risk control measures to remedy cybersecurity leaks and vulnerabilities;

(3) Whether or not they have formulated cybersecurity emergency response plans, organized and conducted emergency response exercises, and whether or not emergency response-related equipment is complete and effective.

(4) Whether or not they have adopted other cybersecurity protection tasks required for major cybersecurity protection tasks according to the law;

(5) Whether or not they have reported cybersecurity protection measures and implementation circumstances to public security bodies according to requirement. 

Internet security supervision and inspection with preventing terror attacks as its major objective will be implemented according to the content provided in the previous Paragraph.

Chapter III: Supervision and inspection procedures

Article 13: Public security bureaus conducting Internet security supervision and inspection may adopt on-site supervision and inspection or remote monitoring methods to do so.

Article 14: When public security bodies conduct on-site Internet security supervision and inspection, the number of People’s Police may not be less than 2, and they shall produce their People’s Police card and county-level or higher local People’s Government public security body-issued supervision and inspection notification letter.

Article 15: Public security bodies conducting on-site Internet security supervision and inspection may adopt the following measures on the basis of requirement:

(1) Entering business premises, computer rooms, work premises;

(2) Requiring the supervision and inspection counterpart’s responsible person or cybersecurity management personnel to explain supervision and inspection matters;

(3) Consulting and reproducing information related to Internet security supervision and inspection;

(4) Checking the operational state of technical network and information security protection measures.

Article 16: Public security bodies may conduct remote monitoring on whether or not cybersecurity leaks exist with Internet service providers and network-using work units.

Public security bodies conducting remote monitoring shall notify the supervision and inspection counterpart in advance about the inspection time, inspection cope and other such matters, or publish the related inspection matters, they may not interfere with or destroy the regular operations of the supervision and inspection counterpart’s networks.

Article 17: Public security bodies conducting on-site supervision and inspection or remote monitoring may entrust cybersecurity service bodies having corresponding technical capabilities with providing technical support. 

Cybersecurity service bodies and their work personnel shall strictly preserve the secrecy of personal information and privacy, commercial secrets and State secrets they learn in the process of fulfilling Internet security supervision and inspection duties and responsibilities, they may not leak this, sell it or illegally provide it to others.

Public security bodies shall strictly supervise cybersecurity service bodies’ implementation of cybersecurity management and secrecy protection responsibilities.

Article 18: Public security bodies conducting on-site supervision and inspection shall draft supervision and inspection records, and have them signed by the People’s Police conducting supervision and inspection and the responsible person or cybersecurity management personnel from the supervision and inspection counterpart. Where the responsible person or cybersecurity management personnel from the supervision and inspection counterpart object to the supervision and inspection record, they shall be allowed to explain the matter; where they refuse to sign, People’s Police shall indicate this on the supervision and inspection record.

Public security bodies conducting remote monitoring shall draft supervision and inspection records, and have the supervision and inspection record signed by two or more People’s Police conducting the supervision and inspection. 

Where cybersecurity service bodies are entrusted with providing technical support, the technical support personnel shall sign the supervision and inspection record together.

Article 19: Public security bodies discovering that cybersecurity risks or vulnerabilities exist in Internet service providers and network-using work unit in the process of Internet security supervision and inspection, shall urge and guide them to adopt measures to eliminate the risks or vulnerabilities, and indicate this in the supervision and inspection records; where they discover unlawful acts, but circumstances are light or no results have been created, they shall order them to correct the matter within a limited time.

Where the supervision and inspection counterpart believes they have completed correction before the end of the time limit, they may submit a re-inspection application in writing to the public security body.

Public security bodies shall, within three working days after the time limit ends or after receiving an earlier re-inspection application from the supervision and inspection counterpart, conduct a re-inspection of the corrected situation, and feed back the re-inspection results within three working days after the re-inspection concludes.

Article 12: All kinds of material collected in the process of inspection, or all kinds of produced documents and other materials, shall be stored in files according to regulations.

Chapter IV: Legal liability

Article 21: Where public security bodies discover Internet service providers or network-using work units committed the following unlawful acts in the process of Internet security supervision and inspection, they shall impose administrative punishment according to the law:

(1) Those not formulating or implementing cybersecurity management rules and operating rules, or not appointing a responsible person for cybersecurity, will be punished according to Article 59 Paragraph I of the “Cybersecurity Law of the People’s Republic of China”;

(2) Those not adopting technical measures to defend against computer viruses, cyberattacks, cyber intrusions and other such acts harming cybersecurity, will be punished according to the provisions of Article 59 Paragraph I of the “Cybersecurity Law of the People’s Republic of China”;

(3) Those not adopting measures to record and preserve user registration information and web access daily record information, will be punished according to the provisions of Article 59 Paragraph I of the “Cybersecurity Law of the People’s Republic of China”;

(4) Those not requiring users to provide real identity information according to requirements in the process of providing Internet information dissemination, instant communication and other such services, or who provide related services to users not providing real identity information, will be punished according to the provisions of Article 61 of the “Cybersecurity Law of the People’s Republic of China”;

(5) Those who do not adopt measures to cease transmission and delete information of which the dissemination and transmission is prohibited by laws and administrative regulations according to the law or according to public security bodies’ requirements, and preserve relevant records, will be punished according to the provisions of Article 68 or Article 69 Paragraph I of the “Cybersecurity Law of the People’s Republic of China”;

(6) Those refusing to provide technical support and assistance to public security bodies maintaining cybersecurity and investigating criminal activities according to the law, will be punished according to the provisions of Article 69 Paragraph III of the “Cybersecurity Law of the People’s Republic of China”.

Where the acts in the preceding items 4 to 6 violate the “Anti-Terrorism Law of the People’s Republic of China”, they will be punished according to the provisions of Article 84 or Article 86 Paragraph I of the “Anti-Terrorism Law of the People’s Republic of China”.

Article 22: Where public security bodies, in the process of Internet security supervision and inspection, discover Internet service providers and network-using work units steal or obtain personal information in an illegal manner, illegally sell or illegally provide it to others, but it does not constitute a crime, they will be punished according to the provisions of Article 64 Paragraph II of the “Cybersecurity Law of the People’s Republic of China”.

Article 23: Where public security bodies, in the process of Internet security supervision and inspection, discover Internet service providers and network-using work units have installed malicious programmes in the Internet services they provide, they will be punished according to the provisions of Article 60 Paragraph I of the “Cybersecurity Law of the People’s Republic of China”.

Article 24: Where Internet service providers and network-using work units refuse or impede public security bodies’ conduct of Internet security supervision and inspection, they will be punished according to the provisions of Article 69 Paragraph II of the “Cybersecurity Law of the People’s Republic of China”; where they refuse to cooperate with anti-terrorism work, they will be punished according to the provisions of Article 91 or Article 92 of the “Anti-Terrorism Law of the People’s Republic of China.

Article 25: Where cybersecurity service bodies and their work personnel entrusted with providing technical support engage in illegal intrusion into the supervision and inspection counterpart’s networks, interfere with the regular functioning of the supervision and inspection counterpart’s networks, or steal online data and other such activities harming cybersecurity, they will be punished according to the provisions of Article 63 of the “Cybersecurity Law of the People’s Republic of China”; where they steal personal information they have obtained in the process of their work or obtain it in an illegal manner, illegally sell or illegally provide it to others, they will be punished according to the provisions of Article 64 Paragraph II of the “Cybersecurity Law of the People’s Republic of China”, where it constitutes a crime, criminal liability will be prosecuted according to the law.

Where bodies and their work personnel as provided in the previous Paragraph infringe the commercial secrets of the supervision and inspection counterpart, constituting a crime, criminal liability will be prosecuted according to the law.

Article 26: Where public security bodies and their work personnel, in the process of Internet security supervision and inspection work, are derelict in their duties, abuse their powers, or engage in favouritism, the directly responsible person in charge and other directly responsible personnel will be punished according to the law; where it constitutes a crime, criminal liability will be prosecuted according to the law.

Article 27: Where Internet service providers and network-using work units violate these Regulations, constituting a violation of public security management, they will be subject to public order management punishment; where it constitutes a crime, criminal liability will be prosecuted according to the law.

Chapter V: Supplementary provisions

Article 28: Supervision and inspection of commercial Internet access service venues will be implementing according to the relevant provisions of the “Commercial Internet Access Service Venue Management Regulations”.

Article 29: These Regulations take effect on 1 November 2018.

中华人民共和国公安部令
第151号

《公安机关互联网安全监督检查规定》已经2018年9月5日公安部部长办公会议通过,现予发布,自2018年11月1日起施行。

部长  赵克志

2018年9月15日

公安机关互联网安全监督检查规定

第一章 总则

第一条 为规范公安机关互联网安全监督检查工作,预防网络违法犯罪,维护网络安全,保护公民、法人和其他组织合法权益,根据《中华人民共和国人民警察法》《中华人民共和国网络安全法》等有关法律、行政法规,制定本规定。

第二条 本规定适用于公安机关依法对互联网服务提供者和联网使用单位履行法律、行政法规规定的网络安全义务情况进行的安全监督检查。

第三条 互联网安全监督检查工作由县级以上地方人民政府公安机关网络安全保卫部门组织实施。

上级公安机关应当对下级公安机关开展互联网安全监督检查工作情况进行指导和监督。

第四条 公安机关开展互联网安全监督检查,应当遵循依法科学管理、保障和促进发展的方针,严格遵守法定权限和程序,不断改进执法方式,全面落实执法责任。

第五条 公安机关及其工作人员对履行互联网安全监督检查职责中知悉的个人信息、隐私、商业秘密和国家秘密,应当严格保密,不得泄露、出售或者非法向他人提供。

公安机关及其工作人员在履行互联网安全监督检查职责中获取的信息,只能用于维护网络安全的需要,不得用于其他用途。

第六条 公安机关对互联网安全监督检查工作中发现的可能危害国家安全、公共安全、社会秩序的网络安全风险,应当及时通报有关主管部门和单位。

第七条 公安机关应当建立并落实互联网安全监督检查工作制度,自觉接受检查对象和人民群众的监督。

第二章 监督检查对象和内容

第八条 互联网安全监督检查由互联网服务提供者的网络服务运营机构和联网使用单位的网络管理机构所在地公安机关实施。互联网服务提供者为个人的,可以由其经常居住地公安机关实施。

第九条 公安机关应当根据网络安全防范需要和网络安全风险隐患的具体情况,对下列互联网服务提供者和联网使用单位开展监督检查:

(一)提供互联网接入、互联网数据中心、内容分发、域名服务的;

(二)提供互联网信息服务的;

(三)提供公共上网服务的;

(四)提供其他互联网服务的;

对开展前款规定的服务未满一年的,两年内曾发生过网络安全事件、违法犯罪案件的,或者因未履行法定网络安全义务被公安机关予以行政处罚的,应当开展重点监督检查。

第十条 公安机关应当根据互联网服务提供者和联网使用单位履行法定网络安全义务的实际情况,依照国家有关规定和标准,对下列内容进行监督检查:

(一)是否办理联网单位备案手续,并报送接入单位和用户基本信息及其变更情况;

(二)是否制定并落实网络安全管理制度和操作规程,确定网络安全负责人;

(三)是否依法采取记录并留存用户注册信息和上网日志信息的技术措施;

(四)是否采取防范计算机病毒和网络攻击、网络侵入等技术措施;

(五)是否在公共信息服务中对法律、行政法规禁止发布或者传输的信息依法采取相关防范措施;

(六)是否按照法律规定的要求为公安机关依法维护国家安全、防范调查恐怖活动、侦查犯罪提供技术支持和协助;

(七)是否履行法律、行政法规规定的网络安全等级保护等义务。

第十一条 除本规定第十条所列内容外,公安机关还应当根据提供互联网服务的类型,对下列内容进行监督检查:

(一)对提供互联网接入服务的,监督检查是否记录并留存网络地址及分配使用情况;

(二)对提供互联网数据中心服务的,监督检查是否记录所提供的主机托管、主机租用和虚拟空间租用的用户信息;

(三)对提供互联网域名服务的,监督检查是否记录网络域名申请、变动信息,是否对违法域名依法采取处置措施;

(四)对提供互联网信息服务的,监督检查是否依法采取用户发布信息管理措施,是否对已发布或者传输的法律、行政法规禁止发布或者传输的信息依法采取处置措施,并保存相关记录;

(五)对提供互联网内容分发服务的,监督检查是否记录内容分发网络与内容源网络链接对应情况;

(六)对提供互联网公共上网服务的,监督检查是否采取符合国家标准的网络与信息安全保护技术措施。

第十二条 在国家重大网络安全保卫任务期间,对与国家重大网络安全保卫任务相关的互联网服务提供者和联网使用单位,公安机关可以对下列内容开展专项安全监督检查:

(一)是否制定重大网络安全保卫任务所要求的工作方案、明确网络安全责任分工并确定网络安全管理人员;

(二)是否组织开展网络安全风险评估,并采取相应风险管控措施堵塞网络安全漏洞隐患;

(三)是否制定网络安全应急处置预案并组织开展应急演练,应急处置相关设施是否完备有效;

(四)是否依法采取重大网络安全保卫任务所需要的其他网络安全防范措施;

(五)是否按照要求向公安机关报告网络安全防范措施及落实情况。

对防范恐怖袭击的重点目标的互联网安全监督检查,按照前款规定的内容执行。

第三章 监督检查程序

第十三条 公安机关开展互联网安全监督检查,可以采取现场监督检查或者远程检测的方式进行。

第十四条 公安机关开展互联网安全现场监督检查时,人民警察不得少于二人,并应当出示人民警察证和县级以上地方人民政府公安机关出具的监督检查通知书。

第十五条 公安机关开展互联网安全现场监督检查可以根据需要采取以下措施:

(一)进入营业场所、机房、工作场所;

(二)要求监督检查对象的负责人或者网络安全管理人员对监督检查事项作出说明;

(三)查阅、复制与互联网安全监督检查事项相关的信息;

(四)查看网络与信息安全保护技术措施运行情况。

第十六条 公安机关对互联网服务提供者和联网使用单位是否存在网络安全漏洞,可以开展远程检测。

公安机关开展远程检测,应当事先告知监督检查对象检查时间、检查范围等事项或者公开相关检查事项,不得干扰、破坏监督检查对象网络的正常运行。

第十七条 公安机关开展现场监督检查或者远程检测,可以委托具有相应技术能力的网络安全服务机构提供技术支持。

网络安全服务机构及其工作人员对工作中知悉的个人信息、隐私、商业秘密和国家秘密,应当严格保密,不得泄露、出售或者非法向他人提供。公安机关应当严格监督网络安全服务机构落实网络安全管理与保密责任。

第十八条 公安机关开展现场监督检查,应当制作监督检查记录,并由开展监督检查的人民警察和监督检查对象的负责人或者网络安全管理人员签名。监督检查对象负责人或者网络安全管理人员对监督检查记录有异议的,应当允许其作出说明;拒绝签名的,人民警察应当在监督检查记录中注明。

公安机关开展远程检测,应当制作监督检查记录,并由二名以上开展监督检查的人民警察在监督检查记录上签名。

委托网络安全服务机构提供技术支持的,技术支持人员应当一并在监督检查记录上签名。

第十九条 公安机关在互联网安全监督检查中,发现互联网服务提供者和联网使用单位存在网络安全风险隐患,应当督促指导其采取措施消除风险隐患,并在监督检查记录上注明;发现有违法行为,但情节轻微或者未造成后果的,应当责令其限期整改。

监督检查对象在整改期限届满前认为已经整改完毕的,可以向公安机关书面提出提前复查申请。

公安机关应当自整改期限届满或者收到监督检查对象提前复查申请之日起三个工作日内,对整改情况进行复查,并在复查结束后三个工作日内反馈复查结果。

第二十条 监督检查过程中收集的资料、制作的各类文书等材料,应当按照规定立卷存档。

第四章 法律责任

第二十一条 公安机关在互联网安全监督检查中,发现互联网服务提供者和联网使用单位有下列违法行为的,依法予以行政处罚:

(一)未制定并落实网络安全管理制度和操作规程,未确定网络安全负责人的,依照《中华人民共和国网络安全法》第五十九条第一款的规定予以处罚;

(二)未采取防范计算机病毒和网络攻击、网络侵入等危害网络安全行为的技术措施的,依照《中华人民共和国网络安全法》第五十九条第一款的规定予以处罚;

(三)未采取记录并留存用户注册信息和上网日志信息措施的,依照《中华人民共和国网络安全法》第五十九条第一款的规定予以处罚;

(四)在提供互联网信息发布、即时通讯等服务中,未要求用户提供真实身份信息,或者对不提供真实身份信息的用户提供相关服务的,依照《中华人民共和国网络安全法》第六十一条的规定予以处罚;

(五)在公共信息服务中对法律、行政法规禁止发布或者传输的信息未依法或者不按照公安机关的要求采取停止传输、消除等处置措施、保存有关记录的,依照《中华人民共和国网络安全法》第六十八条或者第六十九条第一项的规定予以处罚;

(六)拒不为公安机关依法维护国家安全和侦查犯罪的活动提供技术支持和协助的,依照《中华人民共和国网络安全法》第六十九条第三项的规定予以处罚。

有前款第四至六项行为违反《中华人民共和国反恐怖主义法》规定的,依照《中华人民共和国反恐怖主义法》第八十四条或者第八十六条第一款的规定予以处罚。

第二十二条 公安机关在互联网安全监督检查中,发现互联网服务提供者和联网使用单位,窃取或者以其他非法方式获取、非法出售或者非法向他人提供个人信息,尚不构成犯罪的,依照《中华人民共和国网络安全法》第六十四条第二款的规定予以处罚。

第二十三条 公安机关在互联网安全监督检查中,发现互联网服务提供者和联网使用单位在提供的互联网服务中设置恶意程序的,依照《中华人民共和国网络安全法》第六十条第一项的规定予以处罚。

第二十四条 互联网服务提供者和联网使用单位拒绝、阻碍公安机关实施互联网安全监督检查的,依照《中华人民共和国网络安全法》第六十九条第二项的规定予以处罚;拒不配合反恐怖主义工作的,依照《中华人民共和国反恐怖主义法》第九十一条或者第九十二条的规定予以处罚。

第二十五条 受公安机关委托提供技术支持的网络安全服务机构及其工作人员,从事非法侵入监督检查对象网络、干扰监督检查对象网络正常功能、窃取网络数据等危害网络安全的活动的,依照《中华人民共和国网络安全法》第六十三条的规定予以处罚;窃取或者以其他非法方式获取、非法出售或者非法向他人提供在工作中获悉的个人信息的,依照《中华人民共和国网络安全法》第六十四条第二款的规定予以处罚,构成犯罪的,依法追究刑事责任。

前款规定的机构及人员侵犯监督检查对象的商业秘密,构成犯罪的,依法追究刑事责任。

第二十六条 公安机关及其工作人员在互联网安全监督检查工作中,玩忽职守、滥用职权、徇私舞弊的,对直接负责的主管人员和其他直接责任人员依法予以处分;构成犯罪的,依法追究刑事责任。

第二十七条 互联网服务提供者和联网使用单位违反本规定,构成违反治安管理行为的,依法予以治安管理处罚;构成犯罪的,依法追究刑事责任。

第五章 附则

第二十八条 对互联网上网服务营业场所的监督检查,按照《互联网上网服务营业场所管理条例》的有关规定执行。

第二十九条 本规定自2018年11月1日起施行。

Proposal on Personal Information Protection

Posted on Updated on

Following the rapid development of the mobile Internet and big data, the scale and impact of the disclosure of personal information of our country’s netizens has become ever larger, gravely infringing netizens’ rights and interests, harming the public interest, and attracting a high degree of attention from competent government departments as well as the broad attention of all walks of society. In order to protect netizens’ personal information security, safeguard the rights and interests of netizens, guide Internet enterprises to collect, store and use personal information in a standardized manner, stimulate the implementation of related laws and regulations, promote the healthy and sustainable development of the Internet sector, the Internet Society of China proposes the following Proposal to the nationwide Internet circles:

I, Strictly abide by all laws and regulations formulated by national and sectoral competent departments, as well as the sectoral self-discipline conventions issued by the Internet Society of China, and cooperate with relevant government departments’ lawful actions to attack the online disclosure of personal information. 

II, Strengthen sectoral self-discipline, shoulder corporate social responsibility, strengthen examination, verification and management of interactive platforms such as websites, forums, microblogs, instant messaging, e-commerce, etc., timely discover and clean up online disclosure of personal information, do not provide communication channels for information disclosure, and protect netizens’ lawful rights and interests.

III, Complete supervision and reporting mechanisms, vigorously respond to netizens’ complaints in the area of personal information protection, timely feed back handling outcomes to netizens, earnestly correct problems reflected by the public, increase online service quality, and create an online environment of security and sincerity.

IV, Strengthen professional training for employees, raise employees’ understanding of personal information protection, require employees to earnestly implement legal responsibilities, abide by legal provisions, and implement the requirements concerning personal information protection in laws and regulations. 

V, Strengthen cybersecurity protection capabilities, and prevent that databases and user information is stolen. If cybersecurity incidents such as disclosure of user information are discovered, timely report them to public security bodies and relevant government departments, adopt effective measures to plug cybersecurity vulnerabilities, and protect data and information security. 

VI, Strengthen propaganda, raise netizens’ capability to identify and judge phishing, fraud and other such online violations and harmful information, strengthen netizens’ understanding and usage levels of online smart terminals, strengthen personal information protection awareness, and prevent personal information disclosure. 

Internet Society of China

14 September 2018.

Appendix: small measures to prevent personal information disclosure

1, Do not register at websites with unclear sources, cautiously use mobile phone number registration.

2, Do not scan QR codes from an unclear origin, do not install software from an unclear origin.

3, Information on replaced electronic products must be deleted thoroughly, to prevent law-breakers from recovering data.

4, Processing paper forms with personal information requires caution, and privacy information must be erased.

5, Avoid disclosing excessive personal information on social software, to prevent its use by lawbreakers.

6, Cautiously use free WiFi in public venues, to prevent disclosure of user names and passwords.

7, Do not click on links in text messages and mails, in order to avoid “phishing”.

8, The same account name and password group must not be used on different pieces of software, in order to avoid the creation of grave harm. 

个人信息保护倡议书

随着移动互联网和大数据的快速发展,我国网民个人信息泄露的规模和影响越来越大,严重侵犯网民权益,损害公共利益,受到政府主管部门的高度重视和社会各界的广泛关注。为保护网民个人信息安全,维护网民合法权益,引导互联网企业规范地收集、存储及使用个人信息,促进相关法律法规的贯彻落实,推动互联网行业健康可持续发展,中国互联网协会向全国互联网业界发出如下倡议:

  一、严格遵守国家和行业主管部门制定的各项法律法规,以及中国互联网协会发布的行业自律公约,配合政府有关部门依法打击网络泄露个人信息的行为。

  二、加强行业自律,承担企业社会责任,强化对网站、论坛、微博、即时通信、电子商务等互动平台的审核和管理,及时发现、清理网上泄露的个人信息,不为泄露信息提供传播渠道,保护网民的合法权益。

  三、健全监督举报机制,积极响应网民在个人信息保护方面的诉求,及时向网民反馈处理结果,对公众反映的问题认真整改,提高网络服务质量,营造安全诚信的网络环境。

  四、加强对从业人员的职业教育,提高从业人员对个人信息保护的认识,要求从业人员认真履行法律责任,遵守法律规定,落实法律法规对个人信息保护方面的要求。

  五、强化网络安全防护能力,防止数据库和用户信息被窃取。如发现用户信息泄露等网络安全事件,及时向公安机关及政府有关部门报告,采取有效措施弥补网络安全漏洞,保护数据信息安全。

  六、加强宣传,提高网民对钓鱼、诈骗等网络违法和不良信息的识别判断能力,加强网民对网络智能终端的了解和应用水平,强化个人信息保护意识,防止个人信息泄露。

  中国互联网协会

  2018年9月14日

  附:防范个人信息泄露小妙招

  1、不要注册来源不明网站,谨慎使用手机号码注册。

  2、不扫描来历不明的二维码,不安装来历不明的程序。

  3、淘汰的电子产品信息销毁要彻底,防止不法分子恢复数据。

  4、带有个人信息的纸张单据处理需谨慎,要抹掉隐私信息。

  5、避免在社交软件上泄露过多个人信息,防止不法分子利用。

  6、慎用公共场所免费WiFi,防止用户名、密码泄露。

  7、不要点击短信和邮件中的链接,以免被“钓鱼”。

  8、不同软件不要使用同一组账号密码,以免造成严重损失。

Xi Jinping’s Speech at the National Cybersecurity and Informatization Work Conference

Posted on

In the wake of the recent upgrade of the Central Leading Group for Cybersecurity and Informatization to a fully-fledged Commission, a national Work Conference on Cybersecurity and Informatization work took place in Beijing on 20 and 21 April. Xi Jinping gave a speech outlining adjusted priorities after the 19th Party Congress. The full text of the speech has not (yet) been made public. This is a translation of the official Xinhua report. Analysis will be published on the DigiChina platform. 

Xi Jinping Stresses at the Cybersecurity and Informatization Work Conference to Keenly Grasp the Historical Opportunity in Informatization Development, and Move Forward the Construction of a Cyber Power through Indigenous Innovation

Li Keqiang Chairs, Li Zhanshu, Wang Yang, Wang Huning, Zhao Leji and Han Zheng Attend

Xinhua, 21 April, Beijing (Journalists Zhang Xiaosong, Zhu Jichai). The National Cybersecurity and Informatization Work Conference was convened on the 20th and 21st in Beijing. CCP Central Committee General Secretary, State President, Chair of the Central Military Commission and Chair of the Central Commission for Cybersecurity and Informatization Xi Jinping attended the Conference and gave an important speech. He stressed that informatization has brought extremely rare opportunities to the Chinese nation. We must acutely grasp the historical opportunity of informatization development, strengthen online positive propaganda, safeguard cybersecurity, promote breakthroughs in core technologies in the informatization area, give rein to the guiding role of informatization in economic development, strengthen civil-military convergence in the cybersecurity and informatization area, actively participate in international cyberspace governance processes, move forward the construction of a cyber power through indigenous innovation, and make new contributions to determine victory in comprehensively constructing a moderately prosperous society, seize new grand victories for Socialism with Chinese Characteristics in a new era, and realize the Chinese Dream of the Great Rejuvenation of the Chinese Nation. Read the rest of this entry »

Regulations for Internet Security Supervision and Inspection by Public Security Bodies

Posted on Updated on

(Opinion-seeking Draft)

Chapter I: General Principles

Article 1: In order to strengthen and standardize Internet security supervision and inspection work by public security bodies, prevent online law-breaking and crime, safeguard cybersecurity, protect the lawful rights and interests of citizens, legal persons and other organizations, on the basis of the “People’s Police Law of the People’s Republic of China”, the “Cybersecurity Law of the People’s Republic of China” and other such relevant laws and administrative regulations, these Regulations are formulated. Read the rest of this entry »

Microblog Information Service Management Regulations

Posted on Updated on

Article 1: In order to stimulate the healthy and orderly development of microblog information services, protect the lawful rights and interests of citizens, legal persons and other organizations, and safeguard national security and the public interest, on the basis of the “Cybersecurity Law of the People’s Republic of China” and the “State Council Notice concerning Authorizing the Cyberspace Administration of China to take Responsibility for Internet Information Content Work”, these Regulations are formulated. Read the rest of this entry »

“Proposal for International Cooperation on the “One Belt, One Road” Digital Economy”

Posted on Updated on

The digital economy is a driver for global economic growth that becomes more important every day, and is playing an ever more important role in accelerating economic development, enhancing labour productivity in existing industries, fostering new markets and new industrial growth points, realizing inclusive growth and sustainable growth. In order to expand cooperation in the digital economy area, as countries supporting the “One Belt, One Road” initiative, we will, on the basis of the principles of interconnection and interaction, innovation and development, openness and cooperation, harmony and inclusivity, mutual benefit and win-win, explore the common use of digital opportunities and response to challenge, strive to realize an interconnected and interactive “Digital Silk Road” through strengthening policy communication, infrastructure linkages, trade facilitation, financial flows and interlinking popular sentiment, and forge a mutually beneficial, win-win “community of interests” and a “community of destiny” for common development and flourishing. To this end, on the basis of voluntarity and non-restraint, we put forward the following proposal:

<!–more–>

1. Expanding broadband access, raising broadband quality. Build and perfect regional telecommunications, Internet, satellite navigation and other such important information infrastructure, stimulate interconnection and interaction, explore the expansion of high-speed Internet access and connectivity measures at a bearable price, stimulate broadband network coverage, improve service capabilities and quality.

2. Stimulating the digital transformation. Stimulate the digitization of agricultural production, operations and management, as well as the networked transformation of agricultural product distribution. Encourage digital technologies to converge with the manufacturing sector, build an ever more linked, networked and smart manufacturing sector. Use information and telecommunications technology to improve cultural education, healthcare and medicine, environmental protection, urban planning and other public services. Stimulate the sustained development of service sectors such as smart logistics, online tourism, mobile payment, digital creativity and the shared economy. 

3. Stimulate e-commerce cooperation. Explore the feasibility of establishing information sharing, mutual trust and mutual recognition mechanisms for cross-border e-commerce credit, customs passage, inspection, quarantine, consumer protection and other such areas, strengthen cooperation in areas such as financial payment, storage and logistics, technology services, offline exhibitions, etc. Strengthen cooperation in consumer rights protection.  

4. Support Internet start-ups and innovation. Encourage the promotion of Internet-based research, development and innovation through beneficial and transparent legal frameworks, and support Internet-based start-ups. Use the Internet to stimulate innovation in products, services, processes, organizational and commercial models. 

5. Stimulate the development of small, mid-size and micro enterprises. Stimulate small, mid-size and micro enterprises to use information and telecommunication technologies to conduct innovation, raise competitiveness and open up new market sales channels through policy support. Promote the provision of required digital infrastructure to small, mid-size and micro enterprises at bearable prices. Encourage small, mid-size and micro enterprises to provide information and telecommunication products and services to public departments, and enter into global value chains. 

6. Strengthen digitized skills training. Increase the public’s digitized skills levels, ensure that they obtain gains from the development of the digital economy. Launch on-the-job training for digital skills, enhance employees’ digital skills. Encourage government departments, universities, research bodies and enterprises to vigorously launch training programmes, and stimulate the popularization and improvement of digital skills. 

7. Stimulating investment in the information and telecommunications technology area. Improve the commercial environment through stimulating research, development and innovation as well as investment, including cross-border investment in the digital economy. Promote all kinds of financial bodies, multilateral development bodies, etc., to invest in information and telecommunications technology infrastructure and applications, guide commercial share investment funds as well as social funds to invest in the area of the digital economy, encourage public-private partnership relations and other such forms of participation. Encourage the organization of investment information exchange activities between information and telecommunications technology enterprises and financial bodies, encourage reciprocal investment in the information and telecommunications technology area.

8. Promoting inter-city digital economy cooperation. Stimulate relevant cities to launch twinning cooperation, support the establishment of strategic cooperation relationships between twinned cities, drive international traffic and logistics, enhance quality and increase efficiency through constructing information infrastructure, promoting information sharing, stimulating information technology cooperation, and stimulating Internet trading services. Explore the establishment of “Digital Silk Road” economic cooperation demonstration areas. Encourage and support relevant cities in establishing “Digital Silk Road” economic demonstration areas within these cities, promote profound bilateral cooperation in areas such as information infrastructure, smart cities, e-commerce, long-distance healthcare, “Internet Plus”, the Internet of Things, artificial intelligence, etc.

9. Increasing digital inclusivity. Adopt many kinds of policy measures and technological measures to reduce the digital divide, including the digital divide between countries and within countries, and forcefully stimulate the proliferation of the Internet. Stimulate the use of digital technologies in school education and non-official education, promote the realization of broadband access for schools and equip them with online learning environments, so that ever more students can use digitized tools and resources in pursuit of learning. Strengthen the development of digital content such as excellent online games, cartoons, audiovisual materials, literature, music and knowledge resources, and stimulate exchange between the cultures of all countries, and a meeting of people’s hearts.

10. Encouraging and fostering transparent digital economy policies. Develop and maintain an open, transparent and inclusive digital economy policy formulation method. Encourage the dissemination of related and publishable government data, and understand the potential of these in driving new technologies, new products and new services. Encourage online open tendering and procurement, support enterprises in innovating digital product production and services, and simultaneously ensure that demand is market-led. 

11. Furthering international standardization cooperation. Propose the formulation and application of international standards for technology products and services developed through joint coordination, these international standards should maintain consistency with international norms including the norms and principles of the World Trade Organization. 

12. Strengthening confidence and trust. Strengthen the feasibility, completeness, secrecy and reliability of online transactions. Encourage the development of secure information infrastructure, in order to stimulate trustworthy, stable and reliable Internet applications. Strengthen international cooperation in the area of online trading, jointly attack cybercrime and protect the information and telecommunications technology environment. Through ensuring and respecting privacy and protecting personal data, establish confidence among users, this is a critical factor influencing the development of the digital economy.

13. Encourage and stimulate cooperation while respecting autonomous development paths. Encourage all countries along the Belt and Road to strengthen exchange and enhance mutual understanding, strengthen cooperation in policy formulation, supervision and management, reduce, eliminate or prevent unnecessary differences in supervision and management requirement, in order to liberate the vitality of the digital economy, simultaneously understand that all countries should preserve consistency with their international legal obligations, and that they will plan their development path no the basis of their own development situation, historical and cultural traditions, national legal systems and national development strategies.

14. Encouraging the joint construction of a peaceful, secure, open, cooperative and ordered cyberspace. Support information and telecommunication technology policies that safeguard the global nature of the Internet, permit Internet users to  lawfully and autonomously choose the information, knowledge and services they obtain online. Understand that cybersovereignty must be fully respected, safeguard cybersecurity, determinedly attack cyberterrorism and cybercrime, protect personal privacy and information security, and promote the establishment of a multilateral, democratic and transparent international Internet governance system. 

15. Encouraging the establishment of multi-level exchange mechanisms. Stimulate all sides, governments, enterprises, scientific research bodies, and sectoral organizations to communicate and interact, share viewpoints, and promote cooperation in the digital economy. Strengthen training, research and cooperation in the area of the digital economy. Strengthen exchanges about policy formulation and legislative experiences among the “Belt-Road Initiative” countries, and share best practices. Launch the construction of digital technology capabilities, welcome and encourage the United Nations Trade and Development Committee, the United Nations Industrial Development Organization, the Organization for Economic Cooperation and Development, the International Telecommunications Union and other such international organizations to play an important role in driving international cooperation on the “Belt-Road Initiative” digital economy.

(Signed by China, Laos, Saudi Arabia, Serbia, Thailand, Turkey and the United Arab Emirates)

《“一带一路”数字经济国际合作倡议》全文如下:

    数字经济是全球经济增长日益重要的驱动力,在加速经济发展、提高现有产业劳动生产率、培育新市场和产业新增长点、实现包容性增长和可持续增长中正发挥着重要作用。为拓展数字经济领域的合作,作为支持“一带一路”倡议的相关国家,我们将本着互联互通、创新发展、开放合作、和谐包容、互利共赢的原则,探讨共同利用数字机遇、应对挑战,通过加强政策沟通、设施联通、贸易畅通、资金融通和民心相通,致力于实现互联互通的“数字丝绸之路”,打造互利共赢的“利益共同体”和共同发展繁荣的“命运共同体”。为此,在基于自愿、不具约束力基础上,我们提出以下倡议:

    1.扩大宽带接入,提高宽带质量。建设完善区域通信、互联网、卫星导航等重要信息基础设施,促进互联互通,探索以可负担的价格扩大高速互联网接入和连接的方式,促进宽带网络覆盖、提高服务能力和质量。

    2.促进数字化转型。促进农业生产、运营、管理的数字化,以及农产品配送的网络化转型。鼓励数字技术与制造业融合,建设一个更加连接的、网络化、智能化的制造业。利用信息通信技术改善文化教育、健康医疗、环境保护、城市规划和其他公共服务。促进智慧物流、在线旅游、移动支付、数字创意和分享经济等服务业的持续发展。

    3.促进电子商务合作。探索在跨境电子商务信用、通关和检验检疫、消费者保护等领域建立信息共享和互信互认机制的可行性,加强金融支付、仓储物流、技术服务、线下展示等方面的合作。加强消费者权益保护合作。 4.支持互联网创业创新。鼓励通过有利和透明的法律框架,推动基于互联网的研发和创新,支持基于互联网的创业。利用互联网促进产品、服务、流程、组织和商业模式的创新。

    5.促进中小微企业发展。通过政策支持,促进中小微企业使用信息通信技术进行创新、提高竞争力、开辟新的市场销售渠道。推动以可负担的价格为中小微企业运营提供所需的数字基础设施。鼓励中小微企业为公共部门提供信息通信产品和服务,融入全球价值链。

    6.加强数字化技能培训。提升公众数字化技能水平,确保从数字经济发展中获益。开展数字技能的在职培训,提升从业人员的数字技能。鼓励政府部门、大学和研究机构、企业积极开展培训项目,促进数字技能的普及和提升。

    7.促进信息通信技术领域的投资。通过促进研发和创新(RDI)以及投资,包括数字经济跨境投资等方面的政策框架,改善商业环境。推动各类金融机构、多边开发机构等投资信息通信技术基础设施和应用,引导商业股权投资基金以及社会基金向数字经济领域投资,鼓励公私伙伴关系(PPP)等参与形式。鼓励组织信息通信技术企业和金融机构间的投资信息交流活动,鼓励在信息通信技术领域相互投资。

    8.推动城市间的数字经济合作。推动有关城市开展对点合作,支持对点城市间建立战略合作关系,通过信息基础设施建设、推动信息共享、促进信息技术合作、推进互联网经贸服务和加强人文交流,带动国际交通物流提质增效。探索建设“数字丝绸之路”经济合作试验区。鼓励支持有关城市在各自城市分别建立“数字丝绸之路”经济合作试验区,推动双方在信息基础设施、智慧城市、电子商务、远程医疗、 “互联网+”、物联网、人工智能等领域的深度合作。

    9.提高数字包容性。采取多种政策措施和技术手段来缩小数字鸿沟,包括各国之间和各国之内的数字鸿沟,大力推进互联网普及。促进数字技术在学校教育及非正式教育中的使用,推动实现学校宽带接入并具备网络教学环境,越来越多的学生可以利用数字化工具和资源进行学习。加强各自的优秀网络游戏、动漫、影视、文学、音乐和知识资源等数字内容开发,促进各国文化交流、民心交融。

    10.鼓励培育透明的数字经济政策。发展和保持公开、透明、包容的数字经济政策制定方式。鼓励发布相关的、可公开的政府数据,并认识到这些对于带动新技术、新产品、新服务的潜力。鼓励在线公开招标采购,支持企业创新数字产品生产和服务,同时保持需求由市场主导。

    11.推进国际标准化合作。倡导共同协作开发相关技术产品和服务的国际标准的制定和应用,这些国际标准应与包括世贸组织规则和原则在内的国际规则保持一致。

    12.增强信心和信任。增强在线交易的可用性、完整性、保密性和可靠性。鼓励发展安全的信息基础设施,以促进可信、稳定和可靠的互联网应用。加强在线交易方面的国际合作,共同打击网络犯罪和保护信息通信技术环境。通过确保尊重隐私和个人数据保护,树立用户信心,这是影响数字经济发展的关键因素。

    13.鼓励促进合作并尊重自主发展道路。鼓励沿线各国加强交流、增进相互了解,加强政策制定、监管领域的合作,减少、消除或防止不必要的监管要求的差异,以释放数字经济的活力,同时认识到所有国家应与其国际法律义务保持一致,并根据各自的发展情况、历史文化传统、国家法律体系和国家发展战略来规划发展道路。

    14.鼓励共建和平、安全、开放、合作、有序的网络空间。支持维护互联网全球属性的信息通信技术政策,允许互联网使用者依法自主选择获得在线信息、知识和服务。认识到必须充分尊重网络主权,维护网络安全,坚决打击网络恐怖主义和网络犯罪,保护个人隐私和信息安全,推动建立多边、民主、透明的国际互联网治理体系。

    15.鼓励建立多层次交流机制。促进政府、企业、科研机构、行业组织等各方沟通交流、分享观点,推动数字经济合作。加强数字经济方面的培训和研究合作。加强“一带一路”国家间交流政策制定和立法经验,分享最佳实践。开展数字技术能力建设,欢迎和鼓励联合国贸易和发展会议、联合国工业发展组织、经济合作与发展组织、国际电信联盟和其他国际组织,在推动“一带一路”数字经济国际合作中发挥重要作用。

Internet News Information Service Work Unit Content Management Staff Management Rules

Posted on Updated on

Chapter I: General provisions

Article 1: In order to strengthen management of content management staff in Internet news information service work units, safeguard the lawful rights and interests of staff and the social public, and stimulate the healthy and orderly development of internet news information services, on the basis of the “Cybersecurity Law of the People’s Republic of China” and the “Internet News Information Management Regulations”, these Rules are formulated. Read the rest of this entry »

Security Assessment and Management Regulations concerning New Technologies and New Applications in Internet News Information Services

Posted on Updated on

Article 1: In order to standardize security assessment and management work concerning new technologies and new applications in Internet news information services, safeguard national security and the public interest, protect the lawful rights and interests of citizens, legal persons and other organizations, on the basis of the “Cybersecurity Law of the People’s Republic of China”, and the “Internet News Information Service Management Regulations”, these Regulations are formulated.

Article 2: These Regulations apply to national, provincial, autonomous region and municipal Internet information offices’ organization and execution of security assessments of new technologies and new applications concerning Internet news information services. Read the rest of this entry »

What did Xi Jinping say about cyberspace?

Posted on

Yesterday, Xi Jinping presented his political report to the 19th Party Congress – a 32000 word behemoth comprehensively covering all areas of economic, political and social life. The report announces a new era in China’s historical progress. In CCP theory, history is divided in stages, which are characterised by various contradictions that are subordinate manifestations of one fundamental contradiction. Once that contradiction is solved, history moves to the next phase. Xi now announced that the primary contradiction is no longer the one defined by Deng Xiaoping: the tension between China’s material poverty and the needs of its population. Instead, Xi claims the major problem that must now be solved is China’s imbalanced development. In other words, GDP growth at all costs is out, in favour of a more comprehensive approach to social and economic governance. Technology will obviously play a central role in this regard, as a governance tool and a potential economic growth pole, but also as a source of potential risk and disruption. The journal China Information Security very usefully listed the excerpts referring to cybersecurity and informatization, which are translated here:

I, The work from the past five years and historical changes

Public culture service levels have incessantly risen, literature and art creation continues to flourish, cultural undertakings and cultural industries thrive and develop, Internet construction, management and use has incessantly been perfected, and the entire people’s fitness and competitive sports levels have developed comprehensively.

III, The thought and basic orientation of Socialism with Chinese Characteristics for a New Era and

(4) Persisting in new development ideas. […] Push forward the synchronized development of new kinds of industrialization, informatization, urbanization and agricultural modernization, actively participate in and promote the progress of economic globalization, and develop and ever higher-level, open economy, incessantly expand our country’s economic strength and comprehensive national strength.

(10) Persist in the overall view of national security. […] Comprehensively manage external security and internal security, territorial security and citizens’ security, traditional security and non-traditional security, our own security and common security, perfect national security structures and systems, strengthen the construction of national security capabilities, and determinedly defend the country’s sovereignty, security and development interests.

V, Implement new development ideas, build modernized economic systems

(1) Deepen supply-side structural reform. […] Accelerate the development of advanced manufacturing sectors, promote the profound convergence of the Internet, big data, artificial intelligence and the real economy, foster new growth points and create new drivers in areas such as mid- and high-end consumption, innovative leadership, greenness and low-carbon, the sharing economy, modern supply chains, human capital services and other such areas. […] Strengthen the construction of basic infrastructure networks for irrigation, railways, roads, waterways, aviation, pipelines, the electricity grid, information, logistics, etc.

(2) Accelerate the construction of an innovative country. […] Strengthen the use of basic research, expand the implementation of national major science and technology programmes, give prominence to critical and common technologies, advanced forerunner technologies, modern engineering technologies, disruptive technology innovation, in order to provide powerful support for the construction of a strong science and technology country, a strong quality country, a strong aviation country, a strong cyber country, a strong transportation country, a strong digital country and a smart society.

VII, Persist in cultural self-confidence, promote the flourishing and ascendance of Socialist culture

(1) Firmly grasp leadership power in ideological work. […] Deepen Marxist theory research and construction, accelerate the construction of philosophy and social science with Chinese characteristics, and strengthen the construction of new types of think tanks with Chinese characteristics. Give high regard to construction and innovation in means of dissemination, and raise the communication power, guiding power, influence and credibility of news and public opinion. Strengthen the construction of Internet content, establish comprehensive network governance systems, and create a clear and crisp cyber space.

VIII, Raising, guaranteeing and improving people’s living standards, strengthening and innovating social governance

(1) Giving priority to development of education. […] Promote the integrated development of urban and rural compulsory education, give high regard to rural compulsory education, run preschool education, special education and online education well, universalize education at the higher secondary stage, and strive to let every child enjoy fair and high-quality education.

(7) Effectively safeguard national security. National security is an important cornerstone to bring peace and stability to the nation, safeguarding national security is the locus of the fundamental interest of the people of all ethnicities in the entire country. We must perfect the national security strategy and national security policies, firmly safeguard national political security, and comprehensively advance security work in all areas. Complete national security systems, strengthen legal guarantees for national security, and raise capabilities to guard against and resist security risks. Closely guard against and resolutely attack all kinds of infiltration, subversive and destructive activities, violent and terrorist activities, ethnic separatist activities, and religious extremist activities. Strengthen national security education, strengthen the national security consciousness of the entire Party and the people in the entire country, and promote all of society to create and safeguard powerful polled efforts for national security.

X, Firmly march the path of a strong military with Chinese characteristics, comprehensively move national defence and military modernization forward

Adapt to new global military changes and development trends and national security demands, raise construction quality and efficiency, ensure that mechanization is basically realized by 2020, that informatization concentration sees major progress, and strategic capabilities increase greatly.

The military must prepare to wage war, all work must target the norm of combat effectiveness, the focus must be on waging war and waging war victoriously. Firmly prepare for military struggles in all strategic orientations, comprehensively advance military struggle preparation in traditional security areas and new strategic areas, develop new kinds of battle forces and protection forces, launch combat-type military training, strengthen the use of military forces, accelerate the development of military smartification, raise joint warfare capabilities and all-area warfare capabilities based on online information systems, effectively mould situations, manage and control crises, contain war, and fight war victoriously.

XII, Persist in the path of peaceful development, promote the construction of a community of common destiny for humanity.

At the same time, the world faces prominent instabilities and indeterminacies, global economic growth drivers are insufficient, the difference between rich and poor grows graver daily, regional hotspots and problems rise one after another, terrorism, cybersecurity, major epidemics, climate change and other such non-traditional security threats continue to proliferate, humanity faces many common challenges.

XIII, Unwaveringly, comprehensively and strictly govern the Party, incessantly raise the Party’s governing ability and leadership levels.

Strengthen reform and innovation skills, maintain a tenacious and enterprising spiritual bearing, be good at integrating real creativeness in moving work forward, and be good at using Internet technologies and informatized means to carry out work.

Internet User Public Account Information Service Management Regulations

Posted on Updated on

Article 1: These Regulations are formulated in order to standardize Internet user public account information services, safeguard national security and the public interest, protect the lawful rights and interests of citizens, legal persons and other organizations, on the basis of the “Cybersecurity Law of the People’s Republic of China” and the “State Council Notice concerning Authorizing the Cyberspace Administration of China to Be Responsible for Internet Information Content Management Work”.

Article 2: These Regulations shall be observed when providing or using Internet user public accounts to engage in information dissemination services within the territory of the People’s Republic of China. 

Internet user public account information service providers as mentioned in these Regulations, refers to online platforms providing Internet user public account registration and use services. Internet user public account information service users as mentioned in these Regulations, refers to bodies or individuals using or operating Internet user public accounts to provide information dissemination services. 

Article 3: the Cyberspace Administration of China is responsible for Internet user public account information service supervision, management and law enforcement work nationwide, local Internet information offices are responsible for Internet user public account information service supervision, management and law enforcement work within their administrative areas, on the basis of their duties and responsibilities.

Article 4: Internet user public account information service providers and users shall uphold the correct orientation, carry forward the Socialist core value view, foster vigorous and healthy online culture, and maintain a benign online ecology.

All levels’ Party and government departments, enterprise and undertaking work units and people’s organizations are encouraged to register and use Internet user public accounts to disseminate government affairs information or public service information, serving economic and social development and satisfying the public’s information demand. 

Internet user public account information service providers shall cooperate with Party and government bodies, enterprise and undertaking work units and people’s organizations to enhance government information dissemination and public service levels, provide the necessary technical support and information security protection.

Article 5: Internet user public account information service providers shall bear dominant responsibility for information content security management, allocate specialist personnel and technical capabilities suited to the business scale, install general editors and other such positions responsible for information content security, establish and complete management structures for user registration, information examination and verification, emergency response, security protection, etc.

Internet user public account information service providers shall formulate and publish management norms and platform conventions, and conclude service agreements with users, clarifying both sides’ rights and interests.

Article 6: Internet user public account information service providers shall, according to the principle of “real name back stage, voluntary at the front of the stage”, conduct authentication of the real identity information of users, based on organization and body codes, identity card numbers, mobile telephone numbers, etc. Where users do not provide real identity information, no information dissemination services may be provided to them. 

Internet user public account information service providers shall establish a tiered credit management system for Internet user public account information service users, and provide corresponding services on the basis of credit tiers.

Article 7: Internet user public account information service providers shall check users’ account information, service qualifications, service scope and other such information, categorize them and add symbols, and file them with the local provincial, autonomous region or municipal Internet information office in a categorized manner. 

Internet user public account information service providers shall establish databases on the basis of users public account’s registration subjects, disseminated content, account subscription numbers, article reading numbers, etc., implement tiered and categorized management of Internet user public accounts, formulate concrete management rules and file them with the national or provincial, autonomous region and municipal Internet information offices. 

Internet user public account information service providers shall set a reasonable upper limit to the number of registered public account by the same subject on the same platform; where the same subject registers multiple accounts on the same platform, or a user operates multiple accounts in the form of a group, company or alliance, they shall be required to provide basic information on registration subjects, business scope, account list, etc., this will be filed with the local provincial, autonomous region or municipal Internet information office.

Article 8: Internet news information service providers who have lawfully obtained Internet news information gathering and dissemination qualifications, they may gather and disseminate news information through establishing a user public account. 

Article 9: Internet user public account information service providers shall adopt the necessary measures to protect users’ personal information security, they may not leak, distort or damage it, and may not illegally sell or illegally provide it to other persons.

Internet user public account information service provides shall, after a user terminates service use, provide them with account cancellation services.

Article 10: Internet user public account information service users shall bear responsibility for the secure management of information dissemination and operations, observe laws, regulations and relevant State provisions on news information management, intellectual property protection, cybersecurity protection, etc., and safeguard the online communication order.

Article 11: Internet user public account information service users may not disseminate information content prohibited by laws, regulations and relevant State provisions through public accounts.

Internet user public account information service providers shall strengthen supervision and management of public accounts on their platforms, where they discover the dissemination or transmission of unlawful information, they shall immediately adopt deletion and other such measures to deal with it, prevent transmission and diffusion, preserve relevant records, and report the matter to the relevant competent authorities.

Article 12: Internet user public account information service providers launching online public account messages, posts, comments and other such interactive functions, shall conduct security assessments according to relevant regulations.

Internet user public account information service providers shall, according to the principle of tiered and categorized management, conduct supervision and management of user public account messages, posts, comments, etc., set up by users, provide management powers to users, and provide them with support to conduct management of interactive segments. 

Internet user public account information service users shall conduct real-time management of user public account messages, posts, comments and other such interactive segments. Where management is weak, and information content prohibited by laws, regulations and relevant State provisions emerges, Internet user public account information service providers shall, on the basis of the user agreement, limit or cancel messaging, posting, commenting and other such interactive functions.

Article 13: Interactive user account information service providers shall, according to the law, adopt measures to deal with Internet user public accounts violating laws and regulations, service agreements and platform conventions, such as warning, correction, limiting functions, suspending renewal, account closure, etc., preserve relevant records and report the situation to the relevant competent department.

Internet user public account information service providers shall establish blacklist management systems, to blacklist public accounts and registration subjects gravely violating laws and conventions, adopt measures such as account closure, prohibition of re-registration, etc. in view of circumstances, preserve relevant records, and report the matter to the relevant competent department. 

Article 14: Internet sectoral organizations are encouraged to guide and promote Internet user public account information service providers and users to formulate sectoral conventions, strengthen sectoral self-discipline, and bear social responsibility.

Internet sectoral enterprises are encouraged to establish authoritative specialized mediation mechanisms with participation from multiple parties, to coordinate the resolution of sectoral disputes.

Article 15: Internet user public account information service providers and users shall accept supervision from the social public and sectoral organizations. 

Internet user public account information service providers shall set up convenient reporting interfaces, complete complaints and  reporting channels, perfect mechanisms to screen malicious reports, for report acceptance, feedback, etc. timely and fairly  deal with complaints and reports. National and local Internet information offices will, on the basis of their duties and responsibilities, conduct supervision and inspection of the report reception and implementation situation.

Article 16: Internet user public account information service providers and users shall cooperate with relevant competent departments conducting supervision and inspection according to the law, and provide the necessary technical support and assistance.

Internet user public account information service providers shall record Internet user public account information service users’ disseminated content and daily records, and preserve this for no less than six months according to regulations.

Article 17: Internet user public account information service providers and users violating these Regulations, will be punished by the relevant department according to relevant laws and regulations.

Article 18: These Regulations will take effect on 8 October 2017.

互联网用户公众账号信息服务管理规定
第一条 为规范互联网用户公众账号信息服务,维护国家安全和公共利益,保护公民、法人和其他组织的合法权益,根据《中华人民共和国网络安全法》《国务院关于授权国家互联网信息办公室负责互联网信息内容管理工作的通知》,制定本规定。
  第二条 在中华人民共和国境内提供、使用互联网用户公众账号从事信息发布服务,应当遵守本规定。
  本规定所称互联网用户公众账号信息服务,是指通过互联网站、应用程序等网络平台以注册用户公众账号形式,向社会公众发布文字、图片、音视频等信息的服务。
  本规定所称互联网用户公众账号信息服务提供者,是指提供互联网用户公众账号注册使用服务的网络平台。本规定所称互联网用户公众账号信息服务使用者,是指注册使用或运营互联网用户公众账号提供信息发布服务的机构或个人。
  第三条 国家互联网信息办公室负责全国互联网用户公众账号信息服务的监督管理执法工作,地方互联网信息办公室依据职责负责本行政区域内的互联网用户公众账号信息服务的监督管理执法工作。
  第四条 互联网用户公众账号信息服务提供者和使用者,应当坚持正确导向,弘扬社会主义核心价值观,培育积极健康的网络文化,维护良好网络生态。
  鼓励各级党政机关、企事业单位和人民团体注册使用互联网用户公众账号发布政务信息或公共服务信息,服务经济社会发展,满足公众信息需求。
  互联网用户公众账号信息服务提供者应当配合党政机关、企事业单位和人民团体提升政务信息发布和公共服务水平,提供必要的技术支撑和信息安全保障。
  第五条 互联网用户公众账号信息服务提供者应当落实信息内容安全管理主体责任,配备与服务规模相适应的专业人员和技术能力,设立总编辑等信息内容安全负责人岗位,建立健全用户注册、信息审核、应急处置、安全防护等管理制度。
  互联网用户公众账号信息服务提供者应当制定和公开管理规则和平台公约,与使用者签订服务协议,明确双方权利义务。
  第六条 互联网用户公众账号信息服务提供者应当按照“后台实名、前台自愿”的原则,对使用者进行基于组织机构代码、身份证件号码、移动电话号码等真实身份信息认证。使用者不提供真实身份信息的,不得为其提供信息发布服务。
  互联网用户公众账号信息服务提供者应当建立互联网用户公众账号信息服务使用者信用等级管理体系,根据信用等级提供相应服务。
  第七条 互联网用户公众账号信息服务提供者应当对使用者的账号信息、服务资质、服务范围等信息进行审核,分类加注标识,并向所在地省、自治区、直辖市互联网信息办公室分类备案。
  互联网用户公众账号信息服务提供者应当根据用户公众账号的注册主体、发布内容、账号订阅数、文章阅读量等建立数据库,对互联网用户公众账号实行分级分类管理,制定具体管理制度并向国家或省、自治区、直辖市互联网信息办公室备案。
  互联网用户公众账号信息服务提供者应当对同一主体在同一平台注册公众账号的数量合理设定上限;对同一主体在同一平台注册多个账号,或以集团、公司、联盟等形式运营多个账号的使用者,应要求其提供注册主体、业务范围、账号清单等基本信息,并向所在地省、自治区、直辖市互联网信息办公室备案。
  第八条 依法取得互联网新闻信息采编发布资质的互联网新闻信息服务提供者,可以通过开设的用户公众账号采编发布新闻信息。
  第九条 互联网用户公众账号信息服务提供者应当采取必要措施保护使用者个人信息安全,不得泄露、篡改、毁损,不得非法出售或者非法向他人提供。
  互联网用户公众账号信息服务提供者在使用者终止使用服务后,应当为其提供注销账号的服务。
  第十条 互联网用户公众账号信息服务使用者应当履行信息发布和运营安全管理责任,遵守新闻信息管理、知识产权保护、网络安全保护等法律法规和国家有关规定,维护网络传播秩序。
  第十一条 互联网用户公众账号信息服务使用者不得通过公众账号发布法律法规和国家有关规定禁止的信息内容。
  互联网用户公众账号信息服务提供者应加强对本平台公众账号的监测管理,发现有发布、传播违法信息的,应当立即采取消除等处置措施,防止传播扩散,保存有关记录,并向有关主管部门报告。
  第十二条 互联网用户公众账号信息服务提供者开发上线公众账号留言、跟帖、评论等互动功能,应当按有关规定进行安全评估。
  互联网用户公众账号信息服务提供者应当按照分级分类管理原则,对使用者开设的用户公众账号的留言、跟帖、评论等进行监督管理,并向使用者提供管理权限,为其对互动环节实施管理提供支持。
  互联网用户公众账号信息服务使用者应当对用户公众账号留言、跟帖、评论等互动环节进行实时管理。对管理不力、出现法律法规和国家有关规定禁止的信息内容的,互联网用户公众账号信息服务提供者应当依据用户协议限制或取消其留言、跟帖、评论等互动功能。
  第十三条 互联网用户公众账号信息服务提供者应当对违反法律法规、服务协议和平台公约的互联网用户公众账号,依法依约采取警示整改、限制功能、暂停更新、关闭账号等处置措施,保存有关记录,并向有关主管部门报告。
  互联网用户公众账号信息服务提供者应当建立黑名单管理制度,对违法违约情节严重的公众账号及注册主体纳入黑名单,视情采取关闭账号、禁止重新注册等措施,保存有关记录,并向有关主管部门报告。
  第十四条 鼓励互联网行业组织指导推动互联网用户公众账号信息服务提供者、使用者制定行业公约,加强行业自律,履行社会责任。
  鼓励互联网行业组织建立多方参与的权威专业调解机制,协调解决行业纠纷。
  第十五条 互联网用户公众账号信息服务提供者和使用者应当接受社会公众、行业组织监督。
  互联网用户公众账号信息服务提供者应当设置便捷举报入口,健全投诉举报渠道,完善恶意举报甄别、举报受理反馈等机制,及时公正处理投诉举报。国家和地方互联网信息办公室依据职责,对举报受理落实情况进行监督检查。
  第十六条 互联网用户公众账号信息服务提供者和使用者应当配合有关主管部门依法进行的监督检查,并提供必要的技术支持和协助。
  互联网用户公众账号信息服务提供者应当记录互联网用户公众账号信息服务使用者发布内容和日志信息,并按规定留存不少于六个月。
  第十七条 互联网用户公众账号信息服务提供者和使用者违反本规定的,由有关部门依照相关法律法规处理。
  第十八条 本规定自2017年10月8日起施行。