>>>welcome 河南大学, You have logged in.
Logout History Contact us  
Font Size:  A A A Search “Fabao” Window English 中文 = 简体  繁体
  Favorite   DownLoad   Print
 
Notice by the Secretary Bureau of the Cyberspace Administration of China, the General Office of the Ministry of Industry and Information Technology, the General Office of the Ministry of Public Security and the General Office of the State Administration for Market Regulation of Issuing the Measures for the Determination of the Collection and Use of Personal Information by Apps in Violation of Laws and Regulations [Effective]
国家互联网信息办公室秘书局、工业和信息化部办公厅、公安部办公厅、国家市场监督管理总局办公厅关于印发《App违法违规收集使用个人信息行为认定方法》的通知 [现行有效]
【法宝引证码】

Notice by the Secretary Bureau of the Cyberspace Administration of China, the General Office of the Ministry of Industry and Information Technology, the General Office of the Ministry of Public Security and the General Office of the State Administration for Market Regulation of Issuing the Measures for the Determination of the Collection and Use of Personal Information by Apps in Violation of Laws and Regulations 

国家互联网信息办公室秘书局、工业和信息化部办公厅、公安部办公厅、国家市场监督管理总局办公厅关于印发《App违法违规收集使用个人信息行为认定方法》的通知

(No. 191 [2019] of the Secretary Bureau of the Cyberspace Administration of China) (国信办秘字〔2019〕191号)

The cyberspace administrations, communication administrations, public security departments (bureaus), and market regulatory administrations (departments and commissions) of all provinces, autonomous regions, municipalities directly under the Central Government, and Xinjiang Construction and Production Corps: 各省、自治区、直辖市及新疆生产建设兵团网信办、通信管理局、公安厅(局)、市场监管局(厅、委):
In accordance with the Announcement on Conducting the Special Campaign against the Collection and Use of Personal Information by Apps in Violation of Laws and Regulations, for the purposes of providing reference for determining the collection and use of personal information by Apps in violation of laws and regulations and implementing the Cybersecurity Law and other laws and regulations, the Cyberspace Administration of China, the Ministry of Industry and Information Technology, the Ministry of Public Security and the State Administration for Market Regulation have jointly developed the Measures for the Determination of the Collection and Use of Personal Information by Apps in Violation of Laws and Regulations, which are hereby issued to you for your reference and implementation in consideration of actual circumstances of regulation and law enforcement work. 根据《关于开展App违法违规收集使用个人信息专项治理的公告》,为认定App违法违规收集使用个人信息行为提供参考,落实《网络安全法》等法律法规,国家互联网信息办公室、工业和信息化部、公安部、市场监管总局联合制定了《App违法违规收集使用个人信息行为认定方法》。现印发你们,请结合监管和执法工作实际参考执行。
Secretary Bureau of the Cyberspace Administration of China 国家互联网信息办公室秘书局
General Office of the Ministry of Industry and Information Technology 工业和信息化部办公厅
General Office of the Ministry of Public Security 公安部办公厅
General Office of the State Administration for Market Regulation 市场监管总局办公厅
November 28, 2019 2019年11月28日
Measures for the Determination of the Collection and Use of Personal Information by Apps in Violation of Laws and Regulations App违法违规收集使用个人信息行为认定方法
In accordance with the Announcement on Conducting Special Campaign against the Collection and Use of Personal Information by Apps in Violation of the Laws and Regulations, these Measures are developed for the purposes of providing reference for supervision and administration departments' determination of the collection and use of personal information by Apps in violation of laws and regulations, providing guidance for App operators' self-examination and self-correction and social supervision by netizens, and implementing the Cybersecurity Law and other laws and regulations. 根据《关于开展App违法违规收集使用个人信息专项治理的公告》,为监督管理部门认定App违法违规收集使用个人信息行为提供参考,为App运营者自查自纠和网民社会监督提供指引,落实《网络安全法》等法律法规,制定本方法。
I. The following acts of an App may be determined as “failing to make public the collection and use rules” 

法小宝

  一、以下行为可被认定为“未公开收集使用规则”
1. There is no privacy policy in the App, or there are no rules on collecting and using personal information in the privacy policy. 1.在App中没有隐私政策,或者隐私政策中没有收集使用个人信息规则;
2. Users are not given a prompt through obvious methods such as pop-up windows that they should read the privacy policy and other collection and usage rules when the App runs for the first time. 2.在App首次运行时未通过弹窗等明显方式提示用户阅读隐私政策等收集使用规则;
3. It is difficult to access collection and usage rules such as privacy policy. For example, after entering the main interface of the App, a user cannot access collection and usage rules unless he or she clicks the menu button more than four times or conducts other operations. 3.隐私政策等收集使用规则难以访问,如进入App主界面后,需多于4次点击等操作才能访问到;
4. It is difficult to read collection and usage rules such as the privacy policy. For example, the characters are too small or too close to each other, too light in color, or blurred, or no simplified Chinese version is provided. 4.隐私政策等收集使用规则难以阅读,如文字过小过密、颜色过淡、模糊不清,或未提供简体中文版等。
II. The following acts of an App may be determined as “failing to explicitly show the purposes, methods and scope of the collection and use of personal information   二、以下行为可被认定为“未明示收集使用个人信息的目的、方式和范围”
1. The purposes, methods and scope, among others, of the collection and use of personal information by Apps (including entrusted or embedded third-party codes and plug-ins) are not listed one by one. 1.未逐一列出App(包括委托的第三方或嵌入的第三方代码、插件)收集使用个人信息的目的、方式、范围等;
2. When the purposes, methods and scope of the collection and use of personal information change, users are not notified in appropriate manners which include but are not limited to updating the privacy policy and other collection and use rules and reminding the users to read such rules. 2.收集使用个人信息的目的、方式、范围发生变化时,未以适当方式通知用户,适当方式包括更新隐私政策等收集使用规则并提醒用户阅读等;
3. When applying for opening the permission to collect personal information, or for collecting personal sensitive information such as a user's ID number, bank account number or whereabouts, the App fails to notify the user of its purpose, or the purpose given is unclear and difficult to understand. 3.在申请打开可收集个人信息的权限,或申请收集用户身份证号、银行账号、行踪轨迹等个人敏感信息时,未同步告知用户其目的,或者目的不明确、难以理解;
4. The content of the relevant collection and usage rules is obscure, verbose, and cumbersome, and is difficult for users to understand. For instance, a lot of terminologies, among others, are used. 4.有关收集使用规则的内容晦涩难懂、冗长繁琐,用户难以理解,如使用大量专业术语等。
III. The following acts of an App may be determined as “failing to collect and using personal information with a user's consent”   三、北京大学互联网法律中心以下行为可被认定为“未经用户同意收集使用个人信息”
1. The App starts to collect personal information or open the permission to collect personal information before obtaining the user's consent. 1.征得用户同意前就开始收集个人信息或打开可收集个人信息的权限;
2. After the user clearly expresses his or her disagreement, the App still collects personal information or opens the permission to collect personal information, or frequently asks for the user's consent or interferes with the normal use of the user. 2.用户明确表示不同意后,仍收集个人信息或打开可收集个人信息的权限,或频繁征求用户同意、干扰用户正常使用;
3. The personal information actually collected or the permission to collect personal information opened is beyond the scope authorized by the user. 3.实际收集的个人信息或打开的可收集个人信息权限超出用户授权范围;
4. The user's consent is sought in a non-explicit manner, such as selection of “agreeing to the privacy policy” by default. 4.以默认选择同意隐私政策等非明示方式征求用户同意;
5. The authority status concerning whether collection of personal information is permitted as set by the user is changed without the user's consent. For instance, the App automatically restores the authority status set by the user to the default state when the App is updated. 5.未经用户同意更改其设置的可收集个人信息权限状态,如App更新时自动将用户设置的权限恢复到默认状态;
6. The App pushes information in a directional manner by using the user's personal information and algorithm, and does not provide the option of non-directional push of information. 6.利用用户个人信息和算法定向推送信息,未提供非定向推送信息的选项;
7. The user is misled into agreeing to the collection of personal information or opening of the permission to collect personal information by improper methods such as fraud or coaxing, such as deliberately deceiving the user by concealing the true purpose of collection and use of personal information. 7.以欺诈、诱骗等不正当方式误导用户同意收集个人信息或打开可收集个人信息的权限,如故意欺瞒、掩饰收集使用个人信息的真实目的;
8. The user is not provided with the channels and methods for withdrawing the consent to collect personal information. 8.未向用户提供撤回同意收集个人信息的途径、方式;
9. Personal information is collected and used in violation of collection and use rules declared by the App. 9.违反其所声明的收集使用规则,收集使用个人信息。
IV. The following acts of an App may be determined as “collecting personal information unrelated to the services it provides against the necessary principle”   四、以下行为可被认定为“违反必要原则,收集与其提供的服务无关的个人信息”
1. The type of personal information collected or the permission to collect personal information opened is unrelated to existing business functions. 1.收集的个人信息类型或打开的可收集个人信息权限与现有业务功能无关;
2. The App refuses to provide business functions for a user because the user disagrees with collection of unnecessary personal information or opening of unnecessary permissions. 2.因用户不同意收集非必要个人信息或打开非必要权限,拒绝提供业务功能;
3. The personal information collected upon application by the App for a new business function is beyond the scope of a user's original consent, and the App refuses to provide the original business function for the user if the user disagrees with the new scope, except that the new business function replaces the original business function. 3.App新增业务功能申请收集的个人信息超出用户原有同意范围,若用户不同意,则拒绝提供原有业务功能,新增业务功能取代原有业务功能的除外;
4. The frequency of collecting personal information, among others, exceeds the actual needs of business functions. 4.收集个人信息的频度等超出业务功能实际需要;
5. The App forces users to agree with the collection of personal information only under the excuse of improving service quality, enhancing user experience, pushing information in a directional manner, or searching and developing new products, among others. 5.仅以改善服务质量、提升用户体验、定向推送信息、研发新产品等为由,强制要求用户同意收集个人信息;
6. Users are required to agree with opening of multiple permissions to collect personal information at one time. If any user disagrees, the user cannot use the App. 6.要求用户一次性同意打开多个可收集个人信息的权限,用户不同意则无法使用。
V. The following acts of an App may be determined as “providing personal information to others without consent”   五、以下行为可被认定为“未经同意向他人提供个人信息”
1. The App client directly provides personal information to a third party without users' consent and without making such information anonymous, including providing the third party with personal information through third-party codes and plug-ins embedded through the client or other methods. 1.既未经用户同意,也未做匿名化处理,App客户端直接向第三方提供个人信息,包括通过客户端嵌入的第三方代码、插件等方式向第三方提供个人信息;
2. The App provides a third party with the personal information it collects after data is transmitted to the backend server of the App without users' consent or without making such information anonymous. 2.既未经用户同意,也未做匿名化处理,数据传输至App后台服务器后,向第三方提供其收集的个人信息;
3. The App accesses to a third-party's application to provide the third party with personal information without users' consent. 3.App接入第三方应用,未经用户同意,向第三方应用提供个人信息。
VI. The following acts of an App may be determined as “failing to provide the function of deletion or correction of personal information according to the provisions of laws” or “failing to publish information such as ways of filing complaints and reports”   六、以下行为可被认定为“未按法律规定提供删除或更正个人信息功能”或“未公布投诉、举报方式等信息”
1. The App fails to provide the effective function of correction or deletion of personal information or cancellation of user accounts. 1.未提供有效的更正、删除个人信息及注销用户账号功能;
2. The App sets unnecessary or unreasonable conditions for correction or deletion of personal information or cancellation of user accounts. 2.为更正、删除个人信息或注销用户账号设置不必要或不合理条件;
3. When manual handling is required because the App fails to respond to a user's corresponding operation in a timely manner though it provides the functions of correction and deletion of personal information and cancellation of user accounts, the App fails to complete the verification and handling within a promised time limit (the promised time limit shall not exceed 15 working days, or shall be at most 15 working days if there is no promised time limit). 3.虽提供了更正、删除个人信息及注销用户账号功能,但未及时响应用户相应操作,需人工处理的,未在承诺时限内(承诺时限不得超过15个工作日,无承诺时限的,以15个工作日为限)完成核查和处理;
4. The execution of a user operation such as correction or deletion of personal information or cancellation of user account has been completed, but such operation has not been completed at the App backend. 4.更正、删除个人信息或注销用户账号等用户操作已执行完毕,但App后台并未完成的;
5. The App fails to establish and publish personal information security complaint and report channels, or fails to accept and handle the complaints and reports within a promised time limit (the promised time limit shall not exceed 15 working days, or shall be at most 15 working days if there is no promised time limit).法小宝 5.未建立并公布个人信息安全投诉、举报渠道,或未在承诺时限内(承诺时限不得超过15个工作日,无承诺时限的,以15个工作日为限)受理并处理的。
     
     
Scan QR Code and Read on Mobile
【法宝引证码】        北大法宝en.pkulaw.cn
Message: Please kindly comment on the present translation.
 
Confirmation Code:
Click image to reset code
 
  Translations are by lawinfochina.com, and we retain exclusive copyright over content found on our website except for content we publish as authorized by respective copyright owners or content that is publicly available from government sources.

Due to differences in language, legal systems, and culture, English translations of Chinese law are for reference purposes only. Please use the official Chinese-language versions as the final authority. Lawinfochina.com and its staff will not be directly or indirectly liable for use of materials found on this website.

We welcome your comments and suggestions, which assist us in continuing to improve the quality of our materials as we dynamically expand content.
 
Home | About us | Disclaimer | Chinese