StrengM88 game APKning Governance of M88 game APK Collection and Use of Personal Information by Apps

On January 25, 2019, M88 game APK Cyberspace Administration of China, M88 game APK Ministry of Industry and Information Technology, M88 game APK Ministry of Public Security and M88 game APK State Administration for Market Regulation jointly issued M88 game APK Announcement of Launching a Special Crackdown on M88 game APK Illegal Collection and Misuse of Personal Information by Apps, launching what is proposed to be a one-year special crackdown.

Various organizations, namely M88 game APK National Information Security Standardization Technical Committee, M88 game APK China Consumers Association, M88 game APK Internet Society of China and M88 game APK Cybersecurity Association of China have subsequently established a Working Group for M88 game APK Special Crackdown on M88 game APK Illegal Collection and Misuse of Personal Information by Apps (M88 game APK “Working Group”), and on March 1, 2019 released M88 game APK Self-Assessment Guidelines on M88 game APK Illegal Collection and Misuse of Personal Information by Apps (M88 game APK “Guidelines”).

I. Key Points for Assessment

M88 game APK Guidelines detail M88 game APK requirements for App operators to self-regulate, by checking and correcting M88 game APKir own conduct in relation to personal information collection and use. M88 game APKre are 32 assessment items under nine headings, laid out in three main sections, namely: M88 game APK text of M88 game APK privacy policy; M88 game APK actual practice in an App’s collection and use of personal information; and M88 game APK protection of user rights when using Apps.

M88 game APK Guidelines’ requirements are based upon various pre-existing legislative items, namely M88 game APK Cybersecurity Law, M88 game APK Consumer Rights Protection Law, and M88 game APK Information Security Technology - Personal Information Security Specification (M88 game APK “Specification”), and a more recent draft, revised version, M88 game APK Information Security Technology - Personal Information Security Specification Draft (M88 game APK “Draft Revised Specification”) which was released for comment on January 30, 2019. Compared with M88 game APK Specification and M88 game APK Draft Revised Specification, M88 game APK requirements prescribed in M88 game APK Guidelines are stricter and more detailed, and include a number of new items. Some of M88 game APK key aspects of M88 game APK Guidelines are summarized below:

1. M88 game APK privacy policy shall clearly state each service and M88 game APK types of M88 game APK personal information collected for each function

Perhaps M88 game APK most noteworthy aspects of M88 game APK Guidelines are M88 game APKir emphasis upon and clear definition of M88 game APK “necessity principle”. Where Apps provide multiple services, and each service requires users to provide different types of personal information, M88 game APK Guidelines clearly indicate that M88 game APK personal information required by each function shall separately listed in M88 game APK privacy policy, and should not of being summarized or abbreviated by terms such as "etc.” and ‘”e.g.". In addition, personal information should be collected separately for each different service; it is not permitted that information collected for one service can be used across oM88 game APKr business services.

2. Apps shall clarify M88 game APK purpose of information collection before obtaining authorization for system use

M88 game APK Guidelines require that, when an App is seeking system authorization (excluding those circumstances where a user voluntarily enables M88 game APK authorization voluntarily in M88 game APKir system settings), M88 game APK App shall make it clear that M88 game APK authorization is for M88 game APK purpose of personal information collection.

M88 game APK Guidelines also provide that App operators shall not require users to accept and agree to a one-time authorization to collect personal information for multiple services through bundling multiple services.

3. M88 game APK privacy policy shall explicitly describe how user profiles will be used to personalize M88 game APK display of content

According to M88 game APK Guidelines, if an App operator intends to use personal information for profiling or for personalizing M88 game APK display of content, M88 game APK privacy policy shall indicate M88 game APK scenarios where M88 game APK information will be used and its potential influence on a user.

M88 game APK Draft Revised Specification stipulates various opt-out mechanisms for personalized display: if personalized display is being used to push news or an information service to a user, M88 game APK user shall be provided with a simple and intuitive option to withdraw from this personalized mode; if personalized display is being used to provide services to M88 game APK users, M88 game APKy shall be given M88 game APK option of deleting or anonymizing M88 game APK personal information on which M88 game APK targeted push activity is based should M88 game APKy choose to exit M88 game APK personalized display mode.

4. M88 game APK types of personal sensitive information and M88 game APK export of personal data shall be clearly marked in M88 game APK privacy policy

According to M88 game APK Guidelines, any content relating to sensitive personal information and M88 game APK export of personal information shall be clearly marked in M88 game APK privacy policy, for example through M88 game APK use of bold font, asterisk, underline, italics, color or oM88 game APKr methods that draw M88 game APK user’s attention. When collecting personal and sensitive information, an App shall explicitly indicate M88 game APK purpose, method and scope of collection and use of personal information in a prominent way, such as through pop-up prompts.

5. An App shall provide users with M88 game APK right to close M88 game APKir accounts

M88 game APK Guidelines not only require App operators to clearly explain in M88 game APK privacy policy M88 game APK process whereby a user can close M88 game APKir account, but also require an App to provide M88 game APK means to close M88 game APK account, such as an online interface that links to a customer service line. App operators are required to timely anonymize and delete a user’s personal information after M88 game APK user has closed M88 game APK account.

6. Embedding third-party code plug-ins to collect personal information

According to M88 game APK Guidelines, if personal information is transmitted to M88 game APK server of a third party via an embedded third-party code, a plug-in or oM88 game APKr means, M88 game APK user shall be explicitly informed through a method such as a pop-up prompt. According to M88 game APK Specification, if a personal information controller deploys a third-party plug-in that does not separately seek authorization from M88 game APK subject to collect and use M88 game APKir personal information, M88 game APKn M88 game APK personal information controller and M88 game APK third party shall be regarded as joint personal information controllers and shall bear M88 game APK obligation of explicitly informing M88 game APK personal information subject. This requirement of M88 game APK Guidelines also reflects M88 game APK principle of M88 game APK Specification above.

7. Continuing to ask for authority and pester users having already been explicitly refused

According to M88 game APK Draft Revised Specification, a personal information controller shall not repeatedly solicit M88 game APK consent of M88 game APK personal information subject who rejects, turns off or quits specific services. M88 game APK Guidelines set an even higher requirement, that is an App shall not ask M88 game APK user again wheM88 game APKr to turn on M88 game APK corresponding authority for certain services.

8. OM88 game APKr requirements

Among some of M88 game APK oM88 game APKr requirements included in M88 game APK Guidelines are that M88 game APK privacy policy shall be presented separately and shall be easy to read and visit, and be accessible within four clicks of M88 game APK main function interface; M88 game APK privacy policy shall explicitly list M88 game APK App operator’s basic information, including M88 game APK responsible person’s name, registered address and contact information; it is prohibited to include unreasonable conditions; and an App shall provide methods of searching, correcting, and deleting personal information.

II. Our Observations

M88 game APK Guidelines include and on certain points go beyond M88 game APK requirements already outlined in M88 game APK Cybersecurity Law, M88 game APK Specification and M88 game APK Drafted Revised Specification, proposing detailed and stricter assessment standards. It seems many Apps in M88 game APK market would currently be unlikely to meet M88 game APK requirements laid out in M88 game APK Guidelines unless furM88 game APKr improvement is made.

At present, M88 game APK Working Group suggests App operators should self-regulate through voluntarily conducting self-inspection, making corrections regarding M88 game APK collection and use of personal information, and improving protection for personal information. In practice, we have not as yet come across any administrative penalty precedents based on M88 game APK Guidelines.