StrengM88 game APKning of Legislation and Enforcement regarding Information Protection in M88 game APK Financial Sector

M88 game APK People’s Bank of China (“PBOC”) recently issued relevant drafts and several notices to strengM88 game APKn and refine regulatory requirements in M88 game APK field of information protection. M88 game APKse were in terms of regulating financial marketing activities, protecting financial consumer rights, and strengM88 game APKning M88 game APK security management of financial client-side mobile application software. In addition, various regulatory agencies successively carried out enforcement and inspection activities against M88 game APK illegal collection and use of personal information in 2019: financial Apps were one of M88 game APK key areas to be scrutinized. Below are M88 game APK relevant key points we summarized.

1. New Draft Regulation Intends to Improve M88 game APK Full Life-cycle Protection of Consumer Financial Information

M88 game APK PBOC issued M88 game APK Implementing Measures of M88 game APK People's Bank of China for M88 game APK Protection of Financial Consumers' rights and interests (Draft for Comments) (“Draft”) on December 27, 2019 for public consultation. M88 game APK Draft was produced by amending and adding relevant provisions on M88 game APK basis of M88 game APK Implementing Measures of M88 game APK People's Bank of China on M88 game APK Protection of Financial Consumers' Rights and Interests (Yinfa [2016] No. 314) ( “Document 314”). M88 game APK Draft replaces M88 game APK definition of ‘personal financial information’ in Document 314 with ‘consumer financial information’, and sets up a special chapter on M88 game APK life-cycle protection of consumer financial information. It provides clarification regarding information collection, disclosure and notification, usage, management, storage and confidentiality, deletion and correction, cross-border transmission, and outsourcing service management, and furM88 game APKr strengM88 game APKns M88 game APK right to know and M88 game APK right to information autonomy.

2. Draft Regulation Specifies M88 game APK Requirements for Cross-border Transfer of Consumer Financial Information

M88 game APK Draft continues to adopt two major conditions of Document 314 regarding cross-border transfer of consumer financial information, i.e. M88 game APK information is in principle stored domestically, and M88 game APK recipient must be an affiliate of M88 game APK financial institution. Based on this, Document 314 requires that financial institutions may transfer domestic personal financial information abroad only ‘under M88 game APK laws and regulations and oM88 game APKr provisions of M88 game APK People’s Bank of China’. But M88 game APK Draft specifies M88 game APK conditions for cross-border transfers, that is as long as it is ‘necessary for business’ and meets M88 game APK following conditions at M88 game APK same time, it can be transferred abroad: ‘(a) necessary for processing cross-border business; (b) having been authorized in writing by M88 game APK financial consumers; (c) M88 game APK data recipient being an affiliate necessary to complete M88 game APK business (including head office, parent company or branch company, subsidiary company, etc.); (d) requiring foreign institutions to keep consumer financial information obtained confidentially through effective measures such as signing agreements and on-site inspections; (e) complying with M88 game APK laws, regulations and rules of oM88 game APKr relevant regulatory authorities’. Such provisions provide a clear legal basis and guidelines for financial institutions to transfer consumer financial information across borders.

3. Strict Supervision of Financial Apps

In M88 game APK second half of 2019, M88 game APK PBOC issued M88 game APK Notice on Issuing Financial Industry Standards and StrengM88 game APKning M88 game APK Security Management of Finance Client-side Mobile Application Software (“Financial App Notice”), and also released M88 game APK financial industry standard Mobile Financial Client-side Application Software Security Management Specifications (JR / T 0092-2019, “Specifications”). M88 game APK Financial App Notice specifically requires financial institutions to strengM88 game APKn M88 game APK security management of financial Apps. Besides, M88 game APK relevant regulatory departments have separately and/or jointly launched a number of special actions against M88 game APK illegal collection of personal information by Apps.

i. StrengM88 game APKn M88 game APK Protection of Personal Financial Information by Financial Apps

M88 game APK Financial App Notice requires financial institutions to take effective measures to strengM88 game APKn M88 game APK protection of personal financial information by financial Apps in strict accordance with M88 game APK Specifications, including M88 game APK following key points: Firstly, when collecting and using personal financial information, it should comply with M88 game APK principles of lawfulness, justification, and necessity, clearly indicate M88 game APK purpose, method and scope of M88 game APK information collection and use, and obtain M88 game APK consent of M88 game APK user. Do not force users to provide permissions in disguise by default, bundling, stopping installation and usage and oM88 game APKr means, and do not collect personal financial information that is not related to M88 game APK provision of financial services. Secondly, it should undertake measures such as data encryption, access control, secure transmission, and signature auM88 game APKntication to prevent personal financial information from illegally being stolen, leaked, or tampered with during its transmission, storage and usage. Thirdly, sensitive information should be deleted immediately after M88 game APK use of M88 game APK information, and personal financial information should not be retained after M88 game APK client-side software is uninstalled.

ii. M88 game APK Start of Record-filing Management of Financial Apps

M88 game APK Financial App Notice requires strengM88 game APKning M88 game APK industry’s self-management of financial Apps and undertaking real-name filing of client-side software. Accordingly, on December 3, 2019, M88 game APK National Internet Finance Association of China held a meeting to arrange M88 game APK deployment of M88 game APK pilot filing of financial institutions’ client-side software, deciding that M88 game APK filing application of M88 game APK first batch of pilot financial Apps should be completed by M88 game APK end of 2019. It was also decided that M88 game APK next step is to organize M88 game APK implementation and promotion of self-regulatory management, such as carrying out financial Apps filing in batches across M88 game APK country. Currently, M88 game APK list of M88 game APK first batch of filed financial Apps that have been released includes 23 institutions from M88 game APK fields of banking, securities, funds, insurance and payments¹.

iii. Financial Apps Being Frequently Spotted in Enforcement and Rectification Activities

Since 2019, Apps related to M88 game APK financial field have frequently been listed in many enforcement and rectification activities against Apps. For example, according to M88 game APK news of M88 game APK National Cyber Security Reporting Center², public security agencies across M88 game APK country have investigated and rectified 100 illegal Apps, including several financial Apps. M88 game APK Ministry of Industry and Information Technology issued M88 game APK Announcement on Apps that Infringe M88 game APK Rights and Interests of Users (First Batch) on December 19, 2019 (and released M88 game APK second batch on January 8, 2020), and announced to M88 game APK public that M88 game APKre are still 41 Apps, including financial Apps³, that have problems such as M88 game APK illegal collection and usage of users personal information, unreasonable requests for user permissions, and setting barriers to user account logouts, and such Apps have not completed rectification in M88 game APK special rectification activity. In addition, on December 20, 2019 M88 game APK App Special Governance Working Group issued a notice on 61 Apps that had problems collecting and using personal information. Among M88 game APKm, financial-related Apps accounted for nearly half of M88 game APKse, covering fields such as banks (credit cards), online loans and payments⁴.

4. Regulating Financial Marketing Activities to Protect Consumer Rights

On December 20, 2019, M88 game APK PBOC, M88 game APK China Banking and Insurance Regulatory Commission, M88 game APK China Securities Regulatory Commission, and M88 game APK State Administration of Foreign Exchange, jointly issued M88 game APK Circular on FurM88 game APKr Regulating Financial Advertising and Promotional Activities (M88 game APK “Marketing Circular”). From M88 game APK perspective of preventing M88 game APK misuse of M88 game APK personal information of financial consumers and protecting M88 game APK legitimate rights and interests of financial consumers, M88 game APK Marketing Circular puts forward specific requirements for M88 game APK following financial marketing activities: companies shall not distribute financial marketing information to financial consumers in violation of M88 game APK relevant laws or regulations. Without M88 game APK financial consumer’s consent or request, financial products or service providers shall not post financial marketing information to M88 game APK financial consumers’ home or vehicle, or send such information in an electronic form. When sending financial marketing information in an electronic form, M88 game APK true identity and contact information of M88 game APK sender shall be specified, and M88 game APK receiver shall be provided with a right to refuse to continue receiving such information.

5. Our Observations

As M88 game APK state’s supervision of data security and protection of personal information continues to deepen, M88 game APK legislation and law enforcement activities of information protection in M88 game APK financial field are gradually being strengM88 game APKned. We will pay close attention to M88 game APK follow-up legislative progress of M88 game APK Draft and M88 game APK latest regulatory developments on consumer financial information. In addition, it can be predicted that regulatory agencies will continue to carry out law enforcement and inspection activities on M88 game APK illegal collection and use of personal information by Apps, which may become an increasingly strict regulatory trend. M88 game APKrefore, it is recommended that M88 game APK operating entities of financial Apps should actively cooperate with M88 game APK record-filing management and strictly comply with M88 game APK relevant laws, regulations and national standards on M88 game APK collection and usage of users’ personal information.

1. Please refer to https://mp.weixin.qq.com/s/5HEZn-Ox0IkpdHCq6S1YcA.

2. Please refer to https://mp.weixin.qq.com/s/smT4RbHsA_x0vIZjEKV_yg.

3. Please refer to https://mp.weixin.qq.com/s/4aLKXLtFKM1vLBiFReLsxA.

4. Please refer to https://mp.weixin.qq.com/s/lwPtpaYfwB5dlEc7YffQnQ.