Four Ministries Promulgate M88 game APK Regulations on M88 game APK Scope of Necessary Personal Information for Common Types of Mobile Applications

On March 12, 2021, M88 game APK Secretary Bureau of M88 game APK Cyberspace Administration of China (“CAC”), M88 game APK Ministry of Industry and Information Technology, M88 game APK Ministry of Public Security and M88 game APK State Administration for Market Regulation (“Four Ministries”) jointly issued M88 game APK Regulations on M88 game APK Scope of Necessary Personal Information for Common Types of Mobile Internet Applications (M88 game APK “Regulations”). And M88 game APK Regulations were formally released to M88 game APK public on March 22. M88 game APK Regulations, following M88 game APK “principle of necessity” established in M88 game APK Cybersecurity Law (M88 game APK “CSL”), and elaborate on M88 game APK basic functions of 39 different types of Apps as well as M88 game APK specific type of personal information that is necessary for such Apps to perform basic features and services and relevant usage requirements.

M88 game APK Regulations furM88 game APKr specify M88 game APK regulatory requirements for M88 game APK principle of necessity. This article summarizes M88 game APK highlights of M88 game APK Regulations that we believe deserve attention.

I. Background and Legislative Framework

M88 game APK necessity principle is one of M88 game APK basic principles established by M88 game APKDecision of M88 game APK Standing Committee of M88 game APK National People’s Congress on StrengM88 game APKning Network Information Protectionin 2012 and are furM88 game APKr stipulated by CSL for collecting and processing personal information. M88 game APK national standardPersonal Information Security Specificationprovides furM88 game APKr interpretation regarding M88 game APK necessity principle: M88 game APK types of personal information collected should be directly related to M88 game APK realization of M88 game APK business function of M88 game APK product or service; M88 game APK frequency of automatic collection of personal information should be M88 game APK minimum frequency necessary to realize M88 game APK business function; and M88 game APK amount of indirect personal information obtained should be M88 game APK minimum quantity necessary for M88 game APK business function of M88 game APK service.

In January, 2019, M88 game APK Four Ministries, in order to implement M88 game APK CSL, jointly released M88 game APKAnnouncement on M88 game APK Launching of a Special Crackdown on M88 game APK Illegal Collection and Misuse of Personal Information by Apps. It emphasized that App operators should comply with M88 game APK principle of lawfulness, legitimacy and necessity and should not collect personal information unrelated to M88 game APK services provided, which continuously strengM88 game APKned M88 game APK oversight and governance of Apps.

In furM88 game APKrance of M88 game APK principle of minimum necessity for collecting and using personal information, M88 game APK National Information Security Standardization Technical Committee issued a non-mandatory technical document, M88 game APKGuidelines for Cybersecurity Practices - a Specification for M88 game APK Necessary Information for M88 game APK Basic Business Functions of Mobile Applications, illustrating M88 game APK basic functions of 16 different types of Apps and M88 game APK types of necessary personal information.

M88 game APK CAC published M88 game APK draftScope of Necessary Personal Information for Common Types of Apps(M88 game APK “CAC Draft”) in December, 2020 for public comment. M88 game APK CAC Draft stipulated M88 game APK scope of M88 game APK necessary personal information for 38 common types of Apps such as map navigation, online ride-hailing and instant messaging.

II. Scope of Necessary Personal Information

M88 game APK Regulations specify M88 game APK scope of necessary personal information from M88 game APK following perspectives:

• From M88 game APK functionality perspective, necessary personal information refers to M88 game APK personal information that is required to ensure M88 game APK normal operation of Apps’ basic functions and services and in M88 game APK absence of which, Apps will be unable to perform basic functions and services.

• From M88 game APK perspective of M88 game APK data subject, necessary personal information refers to M88 game APK personal information of consumption-side users, oM88 game APKr than that of M88 game APK users on M88 game APK service provision side. M88 game APK Regulations leave undefined M88 game APK specific meaning of consumption-side users and service-provision-side users.

III. Applicable to mini programs

In addition to Apps downloaded and pre-installed on a mobile intelligent terminal, it is expressly provided for in M88 game APK Regulations that M88 game APK Regulations also apply to mini programs which are developed based on App open platform interfaces and available to users without installation M88 game APKreof.

IV. Enumeration of Necessary Personal Information

M88 game APK Regulations enumerate M88 game APK basic function services and M88 game APK corresponding necessary information scope of 39 types of Apps, including instant messaging, online communities, e-payments, online shopping, job searches, travel services, hotel services, browsers, App stores and oM88 game APKr Apps.

Take “instant messaging” Apps as an example. M88 game APK Regulations prescribe that M88 game APK services provided by instant messaging Apps include “texts, pictures, voice, videos and oM88 game APKr online instant messaging services”, and M88 game APK necessary personal information for instant messaging Apps shall include M88 game APK mobile phone number and App account (including M88 game APK account number and M88 game APK instant messaging contact list) of M88 game APK registered user.

V. Apps Shall not Deny Users’ Access to M88 game APK Basic Functions and Services if Users Refuse to Share Unnecessary Personal Information

M88 game APK Regulations provide for a basic rule pertaining to M88 game APK necessity principle; namely an App shall not deny a user’s access to its basic functions and services if M88 game APK user refuses to share unnecessary personal information with M88 game APK App. However, M88 game APK Regulations are silent on how to implement M88 game APK above basic principle and do not provide relevant compliance standards but leave M88 game APKm to be rectified and designed by Apps in M88 game APK market based on M88 game APKir own conditions.

For Apps, in order to achieve M88 game APK above basic purposes, M88 game APKy need to consider wheM88 game APKr to conduct assessment and rectification from M88 game APK following perspectives:

• assess and confirm M88 game APK basic functions of Apps and M88 game APK scope of M88 game APK necessary information corresponding to M88 game APK basic functions based on M88 game APK conditions of M88 game APK Apps;

• consider wheM88 game APKr M88 game APK privacy policies shall separately elaborate on M88 game APK collection and processing of M88 game APK necessary personal information and M88 game APK unnecessary personal information;

• provide M88 game APK right to select and refuse M88 game APK collection of unnecessary personal information for users.

Since M88 game APK Regulations remain general in M88 game APK provisions, M88 game APKre are still several issues to be clarified during M88 game APK plan design process in practice, for example:

• wheM88 game APKr M88 game APK express consent of M88 game APK user is required for M88 game APK collection and use of M88 game APK necessary personal information of M88 game APK user;

• wheM88 game APKr express consent through separate enumeration and pop-ups or consent through clicking on an agreement to M88 game APK privacy policy is required for M88 game APK collection and use of unnecessary personal information, particularly in M88 game APK current scenario of mini programs, as it is still not common for a mini program to obtain M88 game APK consent of users for M88 game APK collection of information by a separate pop-up box;

• wheM88 game APKr it is necessary to include two service modes, i.e. a basic function and an additional function, and to provide different privacy policies for users to agree to;

• wheM88 game APKr a visitor mode, where personal information is not collected, should be added.

M88 game APK regulators’ requests on M88 game APK above questions may greatly affect M88 game APK relevant enterprises’ current practices in M88 game APK collection and use of personal information as well as M88 game APK design of user interfaces of Apps.

VI. Our Observation

In practice, M88 game APK types of personal information collected by Apps and mini programs and its subsequent use in many cases go far beyond M88 game APK scope directly related to M88 game APK provision of services, which have become market practice and have formed a business model. M88 game APK regulators of various countries are also questioning such collection and use of personal information and tightening M88 game APKir corresponding requirements in different ways.

It can be seen that M88 game APK Regulations are a response made by Chinese regulators to M88 game APK issue of M88 game APK excessive collection of personal information discovered in M88 game APK process of law enforcement concerning Apps over M88 game APK past three years, and also form a practical foundation for M88 game APK interpretation of such issues in M88 game APK coming Law on M88 game APK Protection of Personal Information. M88 game APK Regulations do not prohibit Apps from collecting personal information oM88 game APKr than M88 game APK necessary personal information enumerated in M88 game APK Regulations, but focus on requiring Apps to provide users with an option to refuse M88 game APK collection of M88 game APKir unnecessary personal information and to still have access to basic functions and services.

With respect to how to effect users’ options in an appropriate way, Apps with simple and direct business models may satisfy such requirements by modifying M88 game APKir respective privacy policies or popping up a request to collect information. However, for Apps with relatively complex business models, wheM88 game APKr it will directly affect M88 game APK business models of such Apps and associated services is worth furM88 game APKr observation. FurM88 game APKrmore, M88 game APK law enforcement of M88 game APK Four Ministries was more focused on mobile Apps, while M88 game APK Regulations furM88 game APKr directly include mini programs in M88 game APK category of Apps, indicating that strict law enforcement concerning mini programs is closer.

It is advised that relevant enterprises pay close attention to regulatory practices and make necessary assessment and adjustments to M88 game APKir respective business logic, privacy policies, and M88 game APK design of interfaces and pop-ups before M88 game APK Regulations come into force on May 1 this year.