Article 2 The personal information of natural persons is protected by law, and no organization or individual may infringe upon the personal information rights and interests of natural persons.
Article 3 This Law shall apply to the activities of processing personal information of natural persons within the territory of People's Republic of China (PRC).
Under any of the following circumstances, this Law shall also apply to the activities of processing the personal information of citizens and natural persons of China within the territory of China:
(a) for the purpose of providing products or services to domestic natural persons;
(2) Analyze and evaluate the behavior of natural persons in China;
(3) Other circumstances stipulated by laws and administrative regulations.
Article 4 Personal information refers to all kinds of information related to identified or identifiable natural persons recorded by electronic or other means, excluding anonymized information.
The processing of personal information includes the collection, storage, use, processing, transmission, provision, disclosure and deletion of personal information.
Article 5 Personal information shall follow the principles of legality, fairness, necessity, honesty and credibility, and shall not be handled by misleading, cheating or coercion.
Article 6 The processing of personal information should have a clear and reasonable purpose, be directly related to the processing purpose, and be carried out in a way that has the least impact on personal rights and interests.
Personal information should be collected for the purpose of processing, limited to a minimum range, and personal information should not be collected excessively.
Article 7 The handling of personal information shall follow the principle of openness and transparency, and the rules for handling personal information shall be made public, and the purpose, manner and scope of handling shall be clearly stated.
Article 8 The quality of personal information shall be guaranteed when handling personal information, so as to avoid the adverse impact on personal rights and interests caused by inaccurate and incomplete personal information.
Article 9 Personal information processors shall be responsible for their personal information processing activities and take necessary measures to ensure the safety of the personal information they process.
Article 10 No organization or individual may illegally collect, use, process or transmit other people's personal information, or illegally buy, sell, provide or disclose other people's personal information; Do not engage in personal information processing activities that endanger national security and public interests.
Article 11 The State shall establish and improve the personal information protection system, prevent and punish acts infringing on personal information rights and interests, strengthen publicity and education on personal information protection, and promote the formation of a good environment for the government, enterprises, relevant social organizations and the public to participate in personal information protection together.
Article 12 The State actively participates in the formulation of international rules on personal information protection, promotes international exchanges and cooperation on personal information protection, and promotes mutual recognition of personal information protection rules and standards with other countries, regions and international organizations.
Chapter II Rules for Handling Personal Information
Section 1 General Provisions
Article 13 A personal information processor can process personal information under any of the following circumstances:
(a) obtaining personal consent;
(2) It is necessary to sign and perform a contract in which an individual is a party, or it is necessary to implement human resource management in accordance with the labor rules and regulations formulated according to law and the collective contract signed according to law;
(3) It is necessary to perform legal duties or obligations;
(4) It is necessary for responding to public health emergencies or protecting the life, health and property safety of natural persons in emergencies;
(five) to carry out news reports, supervision by public opinion and other acts that are beneficial to the public, and to handle personal information within a reasonable range;
(6) Handling personal information disclosed by individuals themselves or other personal information disclosed according to law within a reasonable range in accordance with the provisions of this Law;
(seven) other circumstances stipulated by laws and administrative regulations.
In accordance with other relevant provisions of this law, personal consent shall be obtained for the handling of personal information, but it is not necessary to obtain personal consent in the circumstances specified in items 2 to 7 of the preceding paragraph.
Article 14 Where personal information is handled on the basis of personal consent, the consent shall be expressed voluntarily and explicitly by the individual on the premise that the individual is fully informed. Where laws and administrative regulations stipulate that personal consent or written consent shall be obtained for the handling of personal information, such provisions shall prevail.
If the purpose, method and type of personal information change, personal consent shall be obtained again.
Fifteenth personal information processing is based on personal consent, and individuals have the right to withdraw their consent. Personal information processors should provide convenient ways to withdraw their consent.
The withdrawal of personal consent does not affect the effectiveness of personal information processing activities based on personal consent before withdrawal.
Sixteenth personal information processors shall not refuse to provide products or services on the grounds that individuals do not agree to handle their personal information or withdraw their consent; Processing personal information is not necessary to provide products or services.
Seventeenth personal information processing personnel before processing personal information, should be in a significant way, clear and easy-to-understand language true, accurate and complete to inform individuals of the following matters:
(a) the name and contact information of the personal information processor;
(2) The purpose and method of personal information processing, the types of personal information processed and the storage period;
(3) Ways and procedures for individuals to exercise the rights stipulated in this Law;
(4) Other matters that should be notified according to laws and administrative regulations.
Where the matters specified in the preceding paragraph are changed, the individual shall be informed of the changed part.
Where a personal information processor informs the matters specified in the first paragraph by formulating personal information processing rules, the processing rules shall be open and easy to consult and save.
Article 18 The personal information processor shall not tell the individual about the matters specified in the first paragraph of the preceding article if there are circumstances that should be kept confidential or not required to be told by laws and administrative regulations.
If it is impossible to inform individuals in time in an emergency to protect the life and health of natural persons and the safety of property, the personal information processor shall inform them in time after the emergency is eliminated.
Article 19 Unless otherwise provided by laws and administrative regulations, the retention period of personal information shall be the shortest time necessary to achieve the purpose of processing.
Article 20 Where two or more personal information processors agree on the purpose and method of personal information processing, they shall agree on their respective rights and obligations. However, this agreement shall not affect the individual's request to any personal information processor to exercise the rights stipulated in this Law.
If a personal information processor * * * processes personal information and infringes on the rights and interests of personal information, it shall be jointly and severally liable according to law.
Article 21 Where a personal information processor entrusts others to process personal information, it shall agree with the trustee on the purpose, time limit, processing method, types of personal information, protection measures, rights and obligations of both parties, and supervise the personal information processing activities of the trustee.
The trustee shall handle personal information in accordance with the agreement, and shall not handle personal information beyond the agreed purpose and manner; If the entrustment contract is not effective, invalid, revoked or terminated, the trustee shall return the personal information to the personal information processor or delete it, and shall not keep it.
Without the consent of the personal information processor, the trustee shall not entrust others to process personal information.
Article 22 If a personal information processor needs to transfer personal information due to merger, division, dissolution, bankruptcy and other reasons, it shall inform the name or contact information of the individual recipient. The receiving party shall continue to fulfill its obligations as a personal information processor. If the recipient changes the purpose and method of the original treatment, it shall obtain his consent again in accordance with the provisions of this law.
Article 23 Where a personal information processor provides the personal information it processes to other personal information processors, it shall inform the recipient's name, contact information, processing purpose, processing method and types of personal information, and obtain the individual's independent consent. The receiving party shall handle the personal information within the scope of the purpose, method and type of the above-mentioned personal information. If the recipient changes the purpose and method of the original treatment, it shall obtain his consent again in accordance with the provisions of this law.
Twenty-fourth personal information processors should use personal information to make automatic decisions, and should ensure the transparency of decision-making and the fairness and justice of the results, and must not give unreasonable differential treatment to individuals in trading conditions such as transaction prices.
Information push and commercial marketing to individuals through automated decision-making methods should provide options that are not specific to their personal characteristics, or provide convenient refusal methods to individuals.
When making decisions that have a significant impact on personal rights and interests through automated decision-making, individuals have the right to ask the personal information processor to make explanations and have the right to refuse the personal information processor to make decisions only through automated decision-making.
Twenty-fifth personal information processors shall not disclose the personal information they handle, except with the individual's separate consent.
Twenty-sixth installation of image acquisition and personal identification equipment in public places should be necessary to maintain the safety of public places, abide by the relevant provisions of the state, and set up obvious warning signs. Personal images and identity information collected can only be used for the purpose of maintaining public safety, and shall not be used for other purposes; Unless you get personal consent.
Twenty-seventh personal information processors can handle personal information disclosed by individuals themselves or other personal information that has been legally disclosed within a reasonable range; Unless the individual explicitly refuses. Personal information processors shall obtain personal consent in accordance with the provisions of this law if the handling of public personal information has a significant impact on personal rights and interests.
Section 2 Rules for Handling Sensitive Personal Information
Article 28 Personal sensitive information refers to personal information that, once leaked or illegally used, will easily lead to infringement of the personal dignity of natural persons or endanger personal and property safety, including biometric identification, religious belief, specific identity, medical and health care, financial accounts, whereabouts and other information, as well as personal information of minors under 14.
Only when there is a specific purpose and sufficient necessity, and strict protection measures are taken, can personal information processors handle sensitive personal information.
Twenty-ninth handling of sensitive personal information should obtain the individual's separate consent; Where laws and administrative regulations stipulate that written consent shall be obtained for handling personal sensitive information, such provisions shall prevail.
Article 30 When handling sensitive personal information, a personal information processor shall inform the individual of the necessity of handling sensitive personal information and the impact on personal rights and interests in addition to the matters specified in the first paragraph of Article 17 of this Law; Except in accordance with the provisions of this law, it is not necessary to notify individuals.
Thirty-first personal information processors should obtain the consent of the parents or other guardians of minors when dealing with personal information of minors under the age of fourteen.
Personal information processors shall formulate special rules for handling personal information of minors under the age of fourteen.
Thirty-second laws and administrative regulations stipulate that the handling of personal sensitive information should obtain relevant administrative license or have other restrictions, such provisions shall prevail.
Section 3 Special Provisions of State Organs on Handling Personal Information
Article 33 This Law shall apply to the activities of state organs in handling personal information; Where there are special provisions in this section, the provisions in this section shall apply.
Article 34 In order to perform their statutory duties, state organs shall handle personal information in accordance with the authority and procedures prescribed by laws and administrative regulations, and shall not exceed the scope and limits necessary for performing their statutory duties.
Article 35 State organs shall perform the obligation of disclosure in accordance with the provisions of this Law when handling personal information in order to perform their statutory duties. There are circumstances stipulated in the first paragraph of Article 18 of this Law, or notification will hinder the state organs from performing their statutory duties.
Thirty-sixth personal information handled by state organs shall be stored in People's Republic of China (PRC); If it is really necessary to provide it overseas, a safety assessment shall be conducted. Safety assessment may require support and assistance from relevant departments.
Article 37 The provisions of this Law concerning the handling of personal information by state organs shall apply to organizations authorized by laws and regulations to perform their statutory duties.
Chapter III Rules for Cross-border Provision of Personal Information
Article 38 Where a personal information processor really needs to provide personal information inside and outside People's Republic of China (PRC) due to business needs, it shall meet one of the following conditions:
(a) in accordance with the provisions of Article 40 of this Law, through the security assessment organized by the national network information department;
(2) Personal information protection certification shall be conducted by a professional organization in accordance with the provisions of the Ministry of Network Information;
(three) according to the standard contract formulated by the national network information department, sign a contract with the overseas recipient to stipulate the rights and obligations of both parties;
(4) Other conditions stipulated by laws, administrative regulations or the national network information department.
If the international treaties and agreements concluded or acceded to by People's Republic of China (PRC) have provisions on the conditions for providing personal information inside and outside People's Republic of China (PRC), such provisions may be followed.
Personal information processors shall take necessary measures to ensure that the activities of overseas recipients in processing personal information meet the standards for personal information protection stipulated in this Law.
Article 39 Where a personal information processor provides personal information to the people of China and overseas, it shall inform the overseas recipients of the personal name, contact information, processing purpose, processing method, types of personal information, and the ways and procedures for individuals to exercise their rights stipulated in this Law, and obtain the individual's separate consent.
Fortieth key information infrastructure operators and personal information processors shall store the personal information collected and generated in People's Republic of China (PRC) if the amount of personal information processed reaches the amount specified by the national network information department. If it is really necessary to provide it overseas, it shall pass the safety assessment organized by the national network information department; Where laws, administrative regulations and the provisions of the national network information department do not require security assessment, those provisions shall prevail.
Article 41 The competent authorities of People's Republic of China (PRC) shall handle the requests of foreign judicial or law enforcement organs for providing personal information stored in China in accordance with relevant laws and international treaties and agreements concluded or acceded to by People's Republic of China (PRC), or in accordance with the principle of equality and reciprocity. Without the approval of the competent authorities of People's Republic of China (PRC), personal information processors may not provide personal information stored in People's Republic of China (PRC) to foreign judicial or law enforcement agencies.
Article 42 If an overseas organization or individual engages in personal information processing activities that infringe on the personal information rights and interests of the people of China and China, or endanger the national security and public interests of the people of China and China, the national network information department may include it in the list of restricting or prohibiting the provision of personal information, make an announcement, and take measures such as restricting or prohibiting the provision of personal information to it.
Article 43 Where any country or region takes discriminatory prohibitions, restrictions or other similar measures against People's Republic of China (PRC) in the protection of personal information, People's Republic of China (PRC) may take reciprocal measures against that country or region according to the actual situation.
Chapter IV Personal Rights in Personal Information Processing Activities
Forty-fourth individuals have the right to know and decide on the handling of their personal information, and have the right to restrict or refuse others to handle their personal information; Except as otherwise provided by laws and administrative regulations.
Forty-fifth individuals have the right to consult and copy their personal information from personal information processors; Except for the circumstances stipulated in the first paragraph of Article 18 and Article 35 of this Law.
If an individual requests to consult and copy his personal information, the personal information processor shall provide it in time.
If an individual requests to transmit personal information to a personal information processor who meets the requirements specified by the national network information department, the personal information processor shall provide the transmission method.
Article 46 If an individual discovers that his personal information is inaccurate or incomplete, he has the right to ask the personal information processor to correct or supplement it.
If an individual requests to correct or supplement his personal information, the personal information processing personnel shall verify his personal information and correct and supplement it in time.
Forty-seventh in any of the following circumstances, the personal information processor should take the initiative to delete personal information; If the personal information processor has not deleted it, the individual has the right to request deletion:
(a) the processing purpose has been achieved, and it is impossible or no longer necessary to achieve the processing purpose;
(2) The personal information processor stops providing products or services, or the storage period has expired;
(3) The individual withdraws his consent;
(four) the personal information processor violates laws, administrative regulations or the agreement to process personal information;
(5) Other circumstances stipulated by laws and administrative regulations.
If the retention period stipulated by laws and administrative regulations has not expired, or it is technically difficult to delete personal information, the personal information processor shall stop processing in addition to storing and taking necessary security protection measures.
Forty-eighth individuals have the right to ask personal information processors to explain their personal information processing rules.
Article 49 If a natural person dies, his close relatives may exercise the right to consult, copy, correct or delete the relevant personal information of the deceased for their own legitimate and legitimate interests. Unless the deceased had other plans before his death.
Article 50 A personal information processor shall establish a convenient mechanism to accept and handle personal applications for exercising rights. If an individual's request to exercise his rights is rejected, he shall explain the reasons.
If the personal information processor refuses the individual's request to exercise his rights, the individual may bring a lawsuit to the people's court according to law. ?
Please click to enter the picture description (maximum 18 words).