Provisions on the protection of children's personal information network

Article 1 These Provisions are formulated in accordance with the Cyber Security Law of the People's Republic of China and the Law of People's Republic of China (PRC) on the Protection of Minors in order to protect the personal information of children and promote their healthy growth. Article 2 Children mentioned in these Provisions refer to minors under the age of 14. Article 3 These Provisions shall apply to the collection, storage, use, transmission and disclosure of children's personal information through the Internet in People's Republic of China (PRC). Article 4 No organization or individual may produce, publish or disseminate information that infringes on the safety of children's personal information. Article 5 Children's guardians shall correctly perform their guardianship duties, educate and guide children to enhance their awareness and ability of personal information protection, and protect the safety of children's personal information. Article 6 Internet industry organizations are encouraged to guide and promote network operators to formulate industry norms and codes of conduct for the protection of children's personal information, strengthen industry self-discipline and fulfill social responsibilities. Article 7 The collection, storage, use, transmission and disclosure of children's personal information by network operators shall follow the principles of proper necessity, informed consent, clear purpose and safe and legal use. Article 8 Network operators shall establish special rules and user agreements for the protection of children's personal information, and designate special persons to be responsible for the protection of children's personal information. Article 9 If a network operator collects, uses, transmits or discloses children's personal information, it shall notify the child's guardian in a conspicuous and clear way and obtain the consent of the child's guardian. Article 10 When obtaining the consent, the network operator shall provide the refusal option at the same time, and clearly inform the following matters:

(1) The purpose, manner and scope of collecting, storing, using, transmitting and disclosing children's personal information;

(two) the place, time limit and way of handling children's personal information after it expires;

(3) Children's personal information security measures;

(4) the consequences of refusal;

Channels and methods of complaints and reports;

(6) Ways and means to correct and delete children's personal information;

(seven) other matters that should be informed.

If the matters notified in the preceding paragraph are substantially changed, the consent of the child's guardian shall be obtained again. Eleventh network operators shall not collect children's personal information irrelevant to the services they provide, and shall not collect children's personal information in violation of the provisions of laws and administrative regulations and the agreement between the two parties. Twelfth network operators to store children's personal information, shall not exceed the period necessary to achieve the purpose of collection and use. Thirteenth network operators should take encryption and other measures to store children's personal information to ensure information security. Article 14 The use of children's personal information by network operators shall not violate the provisions of laws and administrative regulations and the purpose and scope agreed by both parties. If it is really necessary to use it beyond the agreed purpose and scope due to business needs, the consent of the child guardian shall be obtained again. Fifteenth network operators should strictly set information access rights and control the scope of children's personal information on the principle of minimum authorization for their staff. Access to children's personal information by staff shall be examined and approved by the person in charge of children's personal information protection or its authorized management personnel, and the access situation shall be recorded, and technical measures shall be taken to prevent children's personal information from being illegally copied and downloaded. Article 16 If a network operator entrusts a third party to handle children's personal information, it shall conduct a safety assessment of the trustee and the entrusted behavior, sign an entrustment agreement, and clarify the responsibilities of both parties, handling matters, handling period, handling nature and purpose, etc. Entrustment shall not exceed the scope of authorization.

The trustee specified in the preceding paragraph shall perform the following obligations:

(1) Handling children's personal information in accordance with the provisions of laws and administrative regulations and the requirements of network operators;

Assist the network operator to respond to the application made by the child guardian;

(three) to take measures to ensure information security, and in the event of children's personal information disclosure security incidents, timely feedback to the network operators;

(4) Delete children's personal information in time when the entrustment relationship is terminated;

(five) shall not be entrusted;

Other children's personal information protection obligations that should be fulfilled according to law. Seventeenth network operators who transmit children's personal information to a third party shall conduct safety assessment by themselves or entrust a third party organization. Article 18 Network operators shall not disclose children's personal information, except those that should be disclosed according to laws and administrative regulations or agreed with children's guardians. Nineteenth children or their guardians find that the personal information of children collected, stored, used and disclosed by network operators is wrong, and they have the right to ask network operators to correct it. Network operators should take timely measures to correct it. Article 20 If a child or his guardian requests the network operator to delete the children's personal information collected, stored, used and disclosed by him, the network operator shall take timely measures to delete it, including but not limited to the following situations:

(1) Network operators collect, store, use, transfer or disclose children's personal information in violation of laws, administrative regulations or the agreement of both parties;

(2) Collecting, storing, using, transferring or disclosing children's personal information beyond the scope of purpose or the necessary period;

(3) The guardian of the child withdraws his consent;

(four) children or their guardians terminate the use of products or services by means of cancellation.