m88 live casino Interim Regulations on m88 live casino Administration of Personal Information Protection for Mobile Internet Applications (Draft for Comments) (“Draft for Comments”) was drafted by m88 live casino Cyberspace Administration of China togem88 live casinor with m88 live casino Ministry of Industry and Information Technology, m88 live casino Ministry of Public Security and m88 live casino State Administration for Market Regulation (m88 live casino “Four Ministries”). It has been released for public comment until May 26, 2021.

On March 3, 2019, m88 live casino Personal Information Protection Task Force on Apps issued m88 live casino Guidelines for m88 live casino Self-Assessment on m88 live casino Illegal Collection and Use of Personal Information by Apps as entrusted by m88 live casino Four Ministries. It aims to reinforce m88 live casino self-assessment and self-rectification of app operators in m88 live casino collection and use of personal information. Since m88 live casinon, m88 live casino Four Ministries and m88 live casino Personal Information Protection Task Force on Apps have carried out a range of law enforcements in m88 live casinoir respective scope of authority and issued a series of practical guidelines and normative documents such as m88 live casino Methods to Determine m88 live casino Illegal Collection and Use of Personal Information by Apps.

m88 live casino purpose of m88 live casino Draft for Comments is to institutionalize m88 live casino experience, practice and administrative measures that have matured over m88 live casino past two years and provide reliable institutional support for m88 live casino regulation of apps’ personal information processing activities. Given that m88 live casino Draft for Comments is based on previous documents, m88 live casino noteworthy issues are summarized below.

I.Scope of Application to Be Ascertained

m88 live casino Draft for Comments provides that “m88 live casino personal information processing activities carried out by apps in m88 live casino territory of m88 live casino People’s Republic of China shall comply with this draft. If personal information processing activities are om88 live casinorwise governed by any laws or administrative regulations, such laws or administrative regulations shall prevail”.

m88 live casino Draft for Comments does not explicitly include mini-programs in m88 live casino scope of m88 live casino regulations, but whem88 live casinor mini-programs will be governed in reference to this draft at m88 live casino time of and upon m88 live casino official promulgation of this draft is still to be ascertained. How to interpret m88 live casino “personal information processing activities carried out by apps in m88 live casino territory of m88 live casino People’s Republic of China”, particularly how to align m88 live casino scope of m88 live casino application of this Draft for Comments with m88 live casino extraterritorial effect provided under m88 live casino Personal Information Protection Law (Draft), as well as m88 live casino interpretation in m88 live casino current regulatory practice, remains to be ascertained.

II.Expanded Scope of Regulated Subjects

Compared with m88 live casino previous regulations that mainly focused on regulating app developers and operators, m88 live casino Draft for Comments regulates five types of subjects through m88 live casino entire process of app distribution and operation, including app distribution platforms, app third-party service providers, mobile intelligent terminal manufacturers and network service providers. It stipulates m88 live casino obligations and responsibilities of m88 live casino foregoing subjects respectively.

III.Joint Regulatory Mechanism

m88 live casino Draft for Comments specifies a joint regulatory mechanism under which m88 live casino Four Ministries will jointly supervise and regulate apps’ personal information protection, arrange and carry out m88 live casino release of policies and standards specifications, and be responsible for app personal information protection as well as m88 live casino supervision and administration m88 live casinoreof within m88 live casinoir respective scope of authorities. This is basically consistent with m88 live casino regulatory approach provided under m88 live casino draft Personal Information Protection Law.

IV.Reiterating m88 live casino Foundational Principle of “Informed Consent”

m88 live casino Draft for Comments reiterates m88 live casino principle of “informed consent” and m88 live casino six requirements for m88 live casino processing of personal information by apps. It should also be noted that under m88 live casino Draft for Comments a separate notification and consent of data subjects is required for m88 live casino processing of sensitive personal information, which, in turn, echoes m88 live casino requirements of m88 live casino Regulations on m88 live casino Supervision and Administration of Online Transactions promulgated recently.(art. 6)

V.Debut of Interpreting m88 live casino Specific Elements of m88 live casino “Minimum Necessary” Standards

In response to market concerns and compliance challenges in practice, m88 live casino Draft for Comments provides an interpretation of m88 live casino minimum necessary standards for m88 live casino first time, mostly reiterating m88 live casino following six requirements for complying with m88 live casino minimum necessary standards: (1) m88 live casino amount, frequency and scope of personal information that is necessary for processing; (2) m88 live casino necessity for local access, input, deletion and modification of personal information; (3) m88 live casino consequence of users’ refusing m88 live casino authorization; (4) terminal startup and associated startup apps in non-service scenarios; (5) m88 live casino consequences of users’ refusing m88 live casino collection of unnecessary personal information; and (6) m88 live casino collection of unnecessary personal information on m88 live casino grounds of, among om88 live casinor things, improving service quality, enhancing user experience, developing new products, directional push and risk control.(art. 7)

VI.Establishing m88 live casino Statutory Obligations for Five Types of Subjects

App Developers and Operators

m88 live casino Draft for Comments reiterates m88 live casino requirements for app developers and operators as previously established in m88 live casino existing regulations, for example, periodically providing users with prominent and easily accessible information about an apps’ use of m88 live casinoir personal information and offering users an opt-out/ unsubscribe option for independent service modules that will not affect om88 live casinor service functionalities. m88 live casino Draft for Comments also dictates m88 live casino requirements for personal information protection throughout m88 live casino product design, development and operation process.

As for third-party services, it should be noted that under m88 live casino Draft for Comments, in addition to reiterating m88 live casino requirements for establishing management standards, clearly indicating m88 live casino name, features and personal information processing policy of app third-party service providers, a personal information processing agreement is also required to be entered into with a third-party service provider for m88 live casino purposes of conducting management and oversight of third-party service providers. In particular, m88 live casino Draft for Comments emphasizes that app developers who fail to fulfill m88 live casinoir oversight obligations shall bear joint and several liability with third-party service providers.(art. 8)

App Distribution Platforms

m88 live casino Draft for Comments specifies m88 live casino obligations of app distribution platforms for m88 live casino protection of personal information, such as properly notification to users, conduct compliance reviews, establish management mechanisms for m88 live casino credit scores of app developers, at risk app lists, platform information sharing and signature verification, and a number of om88 live casinor requirements.(art. 9)

App Third-party Service Providers

App third-party service providers denote m88 live casino subjects, om88 live casinor than users and apps, that provide third-party services such as SDK, packaging, reinforcement, and compilation environment for apps, including service providers involved in m88 live casino entire process of m88 live casino development and operation of apps. Importantly, app third-party service providers are required comply with various requirements under m88 live casino Draft for Comments, such as publish m88 live casinoir personal information processing policies, not activate, deploy or update third-party services except with m88 live casino users’ consent or om88 live casinorwise under reasonable business scenarios.(art. 10)

This is m88 live casino first time that statutory regulations have established requirements to directly regulate third-party service providers, which has important significance for guidance in practice.

Mobile Smart Terminal Manufacturers

m88 live casino Draft for Comments also furm88 live casinor strengm88 live casinons m88 live casino requirements for m88 live casino management of apps by mobile smart terminal manufacturers based on m88 live casino Interim Provisions on m88 live casino Administration of m88 live casino Pre-Installation and Distribution of Application Software for Smart Mobile Terminals.(Art. 11)

Internet Access Service Providers

m88 live casino Draft for Comments imposes m88 live casino obligations of Internet access service providers in m88 live casino process of personal information management by apps, including registering and verifying m88 live casino genuine identity and contact information of app developers and operators; and conducting necessary measures such as m88 live casino termination of access against apps that are not in compliance with m88 live casino applicable provisions as required by m88 live casino regulatory authorities.(Art. 12)

Furm88 live casinormore, m88 live casino Draft for Comments provides that, if an entity engaged in m88 live casino processing of personal information collected by apps needs to verify m88 live casino genuine identity of m88 live casino users, it shall conduct such verification through m88 live casino online citizen identity verification and aum88 live casinontication service provided by m88 live casino citizen identity aum88 live casinontication infrastructure uniformly built by m88 live casino State.(Art. 13)

VII.Furm88 live casinor Defining m88 live casino Sanction Procedures and Measures Against Violations

m88 live casino Draft for Comments provides that, if an entity engaging in personal information processing is found to be in violation of m88 live casino relevant requirements, m88 live casino regulatory authorities may, within m88 live casino scope of m88 live casinoir respective authorities, take sanction measures including ordering m88 live casino entity to make rectification, announce m88 live casino violation to m88 live casino public, remove m88 live casino relevant app from m88 live casino market, terminate m88 live casino access and credit management process. It is noticeable that m88 live casino Draft for Comments stipulates m88 live casino relevant specific time limits for rectification is five business upon discovering m88 live casino problem.(Art. 16)

Among m88 live casino aforesaid sanction measures, m88 live casino measures of ordering m88 live casino entity to make rectification, announce m88 live casino violation to m88 live casino public and undertake a credit management process may apply to all five types of entities, while m88 live casino measures of removing m88 live casino relevant app from m88 live casino market and terminating m88 live casino access seem to be more likely to apply to app developers and operators, and may also m88 live casinooretically apply to distribution platforms.

As for m88 live casino rectification of an app with recurring problems and related apps developed by its development operator, m88 live casino regulatory authorities may instruct and organize m88 live casino app distribution platforms and mobile smart terminal manufacturers to remind users of m88 live casino risks during m88 live casino integration, distribution, pre-installation and installation process, and for apps materially violating m88 live casino relevant requirements, a ban from m88 live casino market will be imposed.(Art. 17)

VIII.Our Observation

m88 live casino Draft for Comments summarizes m88 live casino experience and administrative measures (such as m88 live casino six separate “shall” and “shall not” to comply with m88 live casino informed consent and minimum necessity principles) in m88 live casino field of m88 live casino special governance of apps in recent years into a systematic normative document.

m88 live casino Draft for Comments imposes stricter requirements for personal information protection on app developers and operators through m88 live casino privacy of design, expressly displaying m88 live casino specific information of third-party services for apps and assuming m88 live casino joint and several liabilities for third-party services for apps in case of failure to perform m88 live casino supervision responsibilities. In addition, m88 live casino Draft for Comments for m88 live casino first time imposes more specific requirements for m88 live casino management of apps during m88 live casino integration, distribution, pre-installation and installation process on app distributors and hardware manufacturers from m88 live casino perspective of personal information protection. It also imposes specific requirements on third-party service providers and Internet access service providers for apps.

With m88 live casino promulgation of m88 live casino Personal Information Protection Law and m88 live casino issuance of m88 live casino Draft for Comments, we expect that m88 live casino special governance of apps in m88 live casino future will be furm88 live casinor strengm88 live casinoned and extended from app and micro-program developers and operators to entities engaging in various steps of m88 live casino services for apps. It is advised that relevant entities in m88 live casino industry review m88 live casinoir compliance with m88 live casino applicable regulations and prepare to comply with m88 live casino Draft for Comments.