Provisions on Protection of Personal Information of Telecommunication and Internet Users
Provisions on Protection of Personal Information of Telecommunication and Internet Users
Provisions on Protection of Personal Information of Telecommunication and Internet Users
Order of the Ministry of Industry and Information Technology of the People's Republic of China No. 24
July 16, 2013
The Provisions on Protection of Personal Information of Telecommunication and Internet Users has been deliberated and adopted at the 2nd executive meeting of the Ministry of Industry and Information Technology of the People's Republic of China on June 28, 2013, which is hereby promulgated and shall come into force on September 1, 2013.
Minister: Miao Wei
Provisions on Protection of Personal Information of Telecommunication and Internet Users
Chapter I General Provisions
Article 1 These Provisions are formulated in accordance with the Decision of the Standing Committee of the National People's Congress on Strengthening Network Information Protection, the Telecommunications Regulations of the People's Republic of China and the Administrative Measures for Internet Information Services and other laws and regulations for the purposes of protecting the legitimate rights and interests of the telecommunication and internet users and maintaining the security of online information.
Article 2 These Provisions shall apply to the activities collecting or using personal information of users in the provision of telecommunication service and internet information service within the territory of the People's Republic of China.
Article 3 The Ministry of Industry and Information Technology and the telecommunication administrations of all provinces, autonomous regions and municipalities directly under Central Government (hereinafter collectively referred to as the "Telecommunication Administration Authorities") shall legally carry out supervision and administration over the protection of personal information of telecommunication and internet users.
Article 4 For the purposes of these Provisions, "Personal Information" refers to the information that can identify the user individually or in combination with other information and that is collected in the course of provision of services by the telecommunication business operators and internet information service providers, such as name, birth date, ID No., address, telephone number, account number and code of the user, and the information on the time and place when and where the user uses the aforementioned service.
Article 5 The collection or use of personal information of users in the course of provision of service by the telecommunication business operators and internet information service providers shall follow the principles of legitimacy, justification and necessity.
Article 6 Telecommunication business operators and internet information service providers shall be responsible for the security of the personal information of users they collected or used in the course of their provision of service.
Article 7 The State encourages the telecommunication and internet industries to carry out self-discipline work in connection with the protection of personal information of users.
Chapter II Rules for Collection and Use of Information
Article 8 The telecommunication business operators and internet information service providers shall formulate the rules for collection and use of personal information of users, and publish the same on their places of business or service or websites.
Article 9 Without consent of the users, telecommunication business operators and internet information service providers may not collect or use the personal information of users.
Where the telecommunication business operators or internet information service providers collect or use personal information of users, they shall expressly advise users about the purpose, method and scope of the collection or use of information, and the ways to inquire or correct information, and the consequences of refusal to provide information, etc.
Telecommunication business operators and internet information service providers may not collect personal information of users other than those necessary for them to provide service, nor use the information for any other purpose other than provision of service, and may not collect or use information by means of deceiving, misleading or force or in violation of the laws, regulations or the agreements between the parties.
Telecommunication business operators and internet information service providers shall, after users terminate their use of the telecommunication service or internet information service, cease the collection and use of the personal information of users, and provide users with account or number cancellation service.
Where the circumstance as provided in Paragraph 1 to 4 hereof is otherwise provided in laws and regulations, such laws and regulations shall prevail.
Article 10 The personal information of users collected or used in the course of provision of service by the telecommunication business operators, internet information service providers and their personnel shall be kept in strict confidence, and may not be divulged, tampered with or damaged, and may not be sold or illegally provided to others.
Article 11 Where the telecommunication business operators or internet information service providers entrust other persons to perform market sales and technology services and other services directly facing the users on their behalf and the collection or use of personal information of users is involved in such services, they shall supervise and manage the protection of personal information of users by their agents, and may not entrust agents failing the requirements for protection of personal information of users as provided herein to act for relevant services.
Article 12 The telecommunication business operators and internet information service providers shall establish user complaint handling mechanism, publish effective contacts, accept complaints in connection with the protection of personal information of users, and reply the complainants within 15 days upon receipt of the complaint concerned.
Chapter III Safety Precautions
Article 13 The telecommunication business operators and the internet information service providers shall take the following measures to prevent any divulge, damage, tamper or loss of personal information of users:
1.
......