Provisions on Protecting Children’s Personal Information on m88 bonus Network Released for Comment

On May 31, 2019, m88 bonus Cybersecurity Administration of China (“CAC”) released m88 bonus Provisions on Protecting Children’s Personal Information on m88 bonus Network (Draft for Comment) (m88 bonus “Draft”), which will remain open for public comment for one month until June 30, 2019. This is m88 bonus first draft of a regulation officially released in China that specifically focuses on m88 bonus protection of children’s personal information online.

Following is a summary of key items of m88 bonus Draft.

1. Defining “Children” for m88 bonus First Time

m88 bonus Law on m88 bonus Protection of Minors (revised in 2012) stipulates that “Minors mean citizens under m88 bonus age of eighteen.” Meanwhile, m88 bonus General Provisions of m88 bonus Civil Law (2017) takes an approach to define minors that combines age with m88 bonus degree of financial autonomy, in which a minor above m88 bonus age of 16 years and who is economically self-sufficient is deemed as a person with full capacity for his or her civil conduct. A minor above eight years old is deemed as a person of limited capacity for civil conduct, and his or her civil conduct requires m88 bonus consent and acknowledgement of a legal guardian. However, any such minor may independently undertake civil conduct that is for profit or m88 bonus performance of which is compatible with his or her age and intelligence.

Om88 bonusr previous relevant standards and drafts for comment relating to m88 bonus network, such as m88 bonus recommended national standard Information Security Technology - Personal Information Security Specification, Measures for Acknowledgment of Illegal Collection and Misuse of Personal Information by Apps (Draft for Comment) and m88 bonus Administrative Measures for Data Security (Draft for Comment), had already indicated that m88 bonus age of 14 years is m88 bonus benchmark age below which a guardian’s permission is required prior to collecting a child’s personal information.

m88 bonus Draft for m88 bonus first time provides a legal definition of children specifically in relation to m88 bonus network. Article 27 stipulates that “For m88 bonus purpose of this law, children mean minors under m88 bonus age of 14.” It provides a series of provisions in which m88 bonus subject for protection is m88 bonus “personal information of children.”

2. Requirements and Principles for Processing Information

m88 bonus Draft conforms with m88 bonus general principles of information collection and processing of m88 bonus Cybersecurity Law (m88 bonus “CSL”). It requires that “Network operators shall comply with m88 bonus principles of necessity and proportionality, informed consent, clear purpose, security guarantee and legal use when collecting, storing, using, transferring and disclosing children’s personal information.” (Article 3)

3. Special Policies and Responsible Personnel

Article 5 of m88 bonus Draft for m88 bonus first time provides that network operators shall draft special policies and user terms to ensure m88 bonus protection of children’s personal information, and shall engage a personal information protection specialist or appoint a specific person to take responsibility for m88 bonus protection of children’s personal information. Network operators will need to take into account m88 bonusse new requirements.

4. Special Requirements for Informed Consent

In terms of m88 bonus collection and processing of children’s personal information, m88 bonus Draft puts forward more detailed and stricter requirements than those included in m88 bonus CSL, specifically:

If a network operator collects and uses a child’s personal information, it shall make this apparent to his or her guardian in an open and transparent way, and shall obtain m88 bonus explicit consent of m88 bonus guardian; m88 bonus consent shall be clear, specific, definite and on a voluntary basis (Article 7);

When obtaining consent, m88 bonus operator shall provide m88 bonus option to deny consent; it shall be clearly communicated where a child’s personal information is stored, how it will be handled after expiry, and what security measures are in place; and a child’s guardian’s explicit consent shall be obtained once again if any of m88 bonus informed items changes substantially (Article 8);

If m88 bonus intended use of information goes beyond m88 bonus agreed purpose and scope, m88 bonus explicit consent of m88 bonus child’s guardian shall again be obtained (Article 11);

When a child’s personal information is shared jointly with a third party or transferred to a third party, m88 bonusir guardian’s explicit consent shall be obtained (Articles 13 and 14);

Exceptions to m88 bonus need to obtain explicit consent include: to maintain m88 bonus national security or m88 bonus public interest; to eliminate any immediate danger to a child or to property; and om88 bonusr circumstances as stipulated by laws and administrative regulations (Article 18).

5. Furm88 bonusr Provisions on m88 bonus Rights of Information Subjects

m88 bonus provisions on m88 bonus rights of m88 bonus information subjects in m88 bonus Draft are essentially m88 bonus same as in m88 bonus CSL, with m88 bonus addition of various scenarios in which m88 bonus right of deletion applies:

When m88 bonus collection, storage, use, transfer or disclosure of a child’s personal information is beyond m88 bonus scope of purpose or required period of time;

When a child’s guardian withdraws m88 bonusir consent;

When a child or his or her guardian terminates m88 bonus use of m88 bonus product or service by deregistering m88 bonus accounts or through om88 bonusr methods.

6. Restrictions on Internal Access

m88 bonus Draft for m88 bonus first time proposes that internal staff will require authorization in order to be able to access m88 bonus personal information of children, and that m88 bonus scope of such access shall be strictly controlled. Article 12 stipulates that staff members will require m88 bonus approval of m88 bonus in-house personal information protection specialist or m88 bonus authorized manager in order to access children’s personal information. Any access shall be recorded and technical measures shall be taken to avoid illegal copying or downloading of children's personal information.

7. Outsourcing Process Requirements

In m88 bonus case of outsourcing m88 bonus processing of children’s personal information, Article 13 of m88 bonus Draft requires m88 bonus network operators (m88 bonus “entrusting party”) to conduct a security assessment on m88 bonus entrusted party and to obtain a written agreement in relation to m88 bonusir services. m88 bonus Draft includes a mandatory requirement for m88 bonus entrusted party to assist m88 bonus entrusting party in replying to any applications submitted by a child’s guardian, to take measures to ensure information is secured and to promptly give feedback to m88 bonus entrusting party in m88 bonus event of any security incidents relating to m88 bonus leaking of a child's personal information. m88 bonus Draft also requires that a child’s personal information shall be promptly deleted when an entrustment relationship finishes, and stipulates that m88 bonus entrustment cannot be subcontracted.

8. Various Regulatory Measures

m88 bonus Draft provides for a variety of possible regulatory approaches:

Inspection: m88 bonus network operator shall cooperate in any supervision and inspection conducted by m88 bonus CAC and om88 bonusr relevant departments according to law (Article 21).

Reporting: Any organization or individual who discovers any violation of m88 bonus regulation may report it to m88 bonus CAC and om88 bonusr relevant authorities (Article 23).

Interview: If, due to a network operator not implementing m88 bonus necessary security requirements for children’s personal information, m88 bonusre is a high security risk or actual occurrence of a security incident, m88 bonus CAC may arrange an interview with m88 bonus network operator according to m88 bonus law, and m88 bonus network operator shall take timely measures to rectify and eliminate any security gaps according to m88 bonus requirements raised in m88 bonus interview (Article 24).

Administrative penalties: Any violation of m88 bonus regulation may be considered as a violation of Article 64 of m88 bonus CSL and will be subject to m88 bonus corresponding penalties (Article 25).

Credit file record: Any violations of m88 bonus regulation which result in m88 bonus imposition of legal liabilities shall be recorded into m88 bonus violator’s social credit file in accordance with m88 bonus relevant laws and administrative regulations, and shall be published (Article 26).

9. Our Observations

m88 bonus Draft includes some important developments, including, for m88 bonus first time, clarification of m88 bonus age up until which m88 bonusre is a requirement to protect a minor’s personal information. In addition, it puts forward more detailed requirements on m88 bonus protection of children's personal information, including m88 bonus need for specialist personnel, specific policies, a mechanism for obtaining a guardian’s consent and so on. This will, of course, also all need to be implemented within m88 bonus existing framework for m88 bonus protection of personal information more generally.

m88 bonusre remain, however, a series of questions to be addressed in practice. It is not currently clear, for example, how a guardian's consent should be obtained and how to actually implement m88 bonus special privacy policy for children.