On February 6, 2023, the Ministry of Industry and Information Technology promulgated the Circular of the Ministry of Industry and Information Technology on Further Improving Mobile Internet Application Service Capabilities, which reiterates the principles of legality, justification, and necessity. The circular provides that engaging in personal information processing activities must have clear and reasonable purposes, and users must not be compelled to consent to personal information processing beyond the scope or that is irrelevant to the service scenarios, solely for the sake of service experience, product development, algorithmic recommendation, and risk control, among others. When a user refuses to provide personal information that is not necessary for the current services, it must not impact the user’s basic functions of the service.
Regulations on Algorithm Recommendations
On September 17, 2021, the CAC and eight other PRC governmental authorities jointly promulgated the Guiding Opinions on Strengthening the Comprehensive Governance of Algorithms Related Internet Information Services, which provide that, among others, enterprises must establish an algorithm security responsibility system and a science and technology ethical review system, improve the algorithm security management organization, strengthen risk prevention and control as well as potential danger investigation and governance, and improve the capacity and level to respond to algorithm security emergencies. Enterprises must also strengthen their sense of responsibility and assume the main responsibility for the results arising from the application of algorithms.
On December 31, 2021, the CAC, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the SAMR jointly issued the Administrative Provisions on Algorithm Recommendation of Internet Information Services, which became effective on March 1, 2022. These administrative provisions stipulate that algorithm recommendation service providers must (i) fulfill their responsibilities for algorithm security, (ii) establish and improve management systems and technical measures for algorithm mechanism examination, scientific and technological ethics review, user-registration, information release review, data security and personal information protection, anti-telecommunications and internet fraud, security assessment and monitoring, and security incidents emergency response, among others, and (iii) formulate and disclose the rules for algorithm recommendation services, and be equipped with professional staff and technical support appropriate to the scale of the algorithm recommendation service. Algorithm recommendation service providers should not take advantage of algorithm recommendation services to (i) engage in any illegal activity which may endanger national security and social public interest, disturb economic and social order, or infringe others’ legitimate rights and interest, or (ii) disseminate any information prohibited by laws and regulations.
On November 25, 2022, the CAC, the Ministry of Industry and Information Technology, and the Ministry of Public Security jointly issued the Administrative Provisions on the Deep Synthesis of Internet Information Services, which came into effect on January 10, 2023. According to these provisions, no organization or individual may use deep synthesis services to produce, reproduce, release, or disseminate information prohibited by laws and administrative regulations, or to engage in activities that endanger the national security and interests, damage the national image, infringe upon social public interests, disrupt the economic and social order, or undermine the legitimate rights and interests of others. Specifically, the providers of deep synthesis services should, among other things, establish and maintain the management systems for algorithmic mechanism review, data security, and personal information protection.
Regulations Relating to E-commerce
On January 26, 2014, the State Administration for Industry and Commerce, the predecessor of the SAMR, adopted the Administrative Measures for Online Trading (2014), which came into effect on March 15, 2014. On March 15, 2021, the SAMR promulgated the Measures for the Supervision and Administration of Online Transactions (2021), which came into effect on May 1, 2021 and replaced the Administrative Measures for Online Trading (2014). Under these measures, online transaction operators engaging in business activities should follow the principles of voluntariness, equality, fairness, and good faith, comply with laws, regulations, rules, business ethics, public order, and good morals, participate in market competition fairly, earnestly perform statutory obligations, actively assume subject responsibilities, and accept supervision from all sectors of the society. Online transaction platform operators should require business operators that are applying to sell goods or provide services on their platforms to provide authentic information such as information relating to identity, address, contact, and administrative license, verify and register such information, establish registration files, and verify and update such information at least once every six months. In addition, online transaction platform operators should establish an inspection and monitoring system relating to information of business operators on their platforms and relating to goods and services such business operators advertise. Where an online transaction platform operator identifies any information relating to goods and services on its platforms that is in violation of laws, regulations, or rules on market supervision and administration, damages national or public interests, or is detrimental to public order or good morals, it must take necessary measures to dispose such information in accordance with the law, maintain the records, and report the same to the administration for market regulation.
85