Samuel is a partner of AnJie Law Firm. He has rich experience in the areas of Technology, Media and Telecommunications (TMT). He has worked as in-house counsel and external lawyer in these areas for more than 15 years. He advises clients on a wide range of regulatory, commercial and corporate matters, such as telecommunications, cybersecurity, data protection, e-commerce, social networking, online games, hardware and software, technology procurements and transfers, distribution and licensing, and other technology-related matters. He also advises clients on compliance, dispute resolution and employment.
Before he joined AnJie, Sam worked for British Telecom, CMS Cameron McKenna and DLA Piper.
The Cyberspace Administration of China, the Ministry of Industry and Information Technology, the Ministry of Public Security and the State Administration for Market Regulation recently announced that they had launched a campaign to stop apps from unlawfully collecting and processing personal data. The announcement sets out the obligations of various parties with regard to the collection and processing of personal data, including app operators, associations, authorities and public security organs.
The National Information Security Standardisation Technical Committee recently published the draft Information Security Technology – Personal Information Security Specifications for public comment. Among other amendments, the draft has revised the exceptions regarding authorisation and consent by personal information subjects, introduced rules concerning the merger of personal information and promoted the importance of data protection officers and departments.
The Cybersecurity Bureau of the Ministry of Industry and Information Technology recently released its checking results for seven inspected telecom enterprises and required them to rectify the loopholes and vulnerabilities of their networks or systems as notified. The inspected telecom enterprises were found to have had a number of major issues, including medium and high-risk loopholes in their business systems and equipment (including their official websites).
The Ministry of Public Security recently released the Guideline for Internet Personal Information Security Protection (Draft for Comment) to solicit public opinions. The guideline requires that personal information holders implement a series of security protection measures. Among others, these include a management mechanism, which involves building firewalls to protect enterprises from criminal risks, and technical measures to ensure that network operations are secure for internet inspection purposes.
The Cyberspace Administration of China recently issued the Administrative Regulations on the Provision of Financial Information Services. Under the regulations, parties must obtain the corresponding permits before they can provide various financial information services. Further, service providers must establish service specifications regarding information content auditing, data retention, information security and personal information and IP protection.
The National Health Commission recently released the Circular regarding Issuing National Health Medical Big Data Standards, Safety and Service Management Measures (For Trial Implementation). The circular provides guidelines regarding the standards and security of Big Data in the healthcare industry, as well as service management measures. As the circular is considered to mark the Cybersecurity Law's implementation in the healthcare industry, most of its security measures are derived from the law.
In one of the Guangdong province's top 10 internet cases of 2017, the court found that Apple IDs constitute personal information which may affect other parties' personal and property safety. As such, the two defendants concerned were convicted of infringing citizens' personal data rights after more than 1,200 pieces of personal information were found on their computers. This decision is believed to have had a demonstrable effect on the handling of similar cases.
The Ministry of Public Security recently released the Provisions on the Supervision and Inspection of Internet Security by Public Security Organs. According to the provisions, public security organs must supervise and inspect internet service providers and network entity users that provide a range of internet-related services. They also list certain powers that public security organs may use when supervising and inspecting internet security on-site.
The National Information Security Standardisation Technical Committee recently held a meeting to commence the pilot work on the Information Security Technology – Guidelines for Critical Information Infrastructure (CII) Security Examination Assessment (For Approval). The pilot work will focus on the reasonability and practicability of the guidelines. Twelve CII operators from the telecoms, internet, transportation, energy, finance, e-government and public services industries have been selected as pilot units.
The Shanghai Communications Administration (SHCA) recently criticised four telecoms and internet companies for failing to improve their network security monitoring and forecasting systems and report important matters to the SHCA. The SHCA ordered the companies to rectify these failings and emphasised that telecoms and internet companies have a number of obligations in order to ensure the security and stability of Shanghai's public networks.
The Ministry of Industry and Information Technology recently released its Notification on the Network Security Inspection of the Telecom and Internet Industry in 2018. According to the notification, the inspection will cover the networks and systems established and operated by, among other players, internet enterprises and domain name registration administration and service organisations licensed by telecoms regulators.
The Ministry of Public Security recently launched a nationwide security inspection and correction campaign regarding Big Data applications in China. This campaign is one of a series of network security inspection projects which target key information systems, critical information infrastructure and Big Data. The Big Data campaign focuses on the level of supervision, security and protection afforded in the collection, storage, application, transfer and destruction of such data.
The National Information Security Standardisation Technical Committee recently released the Information Security Technology – Guide to the Personal Information Security Impact Assessment (Draft for Comment). The guide provides direction on the personal information specification and stipulates the basic concepts, framework, methods and procedures regarding personal information security impact assessments.
The State Internet Information Office recently released the Digital China Construction and Development Report (2017), laying a foundation for further enhancing China's network security protection capabilities. The report urges China to, among other things, establish a 'correct' view of cybersecurity, strengthen the top-level design of its network security and improve its network security laws and regulations.
The EU General Data Protection Regulation (GDPR) recently came into force, with impact on a global scale. On the same day, the secretariat of the National Information Security Standardisation Technical Committee published the Network Security Practice Guidelines: EU GDPR Key Issues, setting out some key areas of the GDPR which Chinese companies should account for in their practices.
The Ministry of Industry and Information Technology (MIIT) recently issued its Notice on the Formal Commercialisation of Mobile Communications Resale Services, under which private enterprises, state-owned enterprises and foreign-invested enterprises may apply to undertake mobile communications resale services. Applicants must apply to the MIIT or their regional communications administration for the corresponding telecoms business licence and submit contracts signed by the major telecoms companies.
The People's Bank of China (PBC) recently released its Circular on Further Intensifying the Management of Credit Information Security. According to the circular, the PBC will intensify its management of credit information security by, among other things, practically raising awareness around the management of such information and strengthening information subjects' responsibilities in this regard. It will also optimise operational and control procedures for credit-related businesses.
The Ministry of Industry and Information Technology (MIIT) recently released its Notice to Further Clear and Regulate the Internet Access Service Market. According to the notice, the campaign to clear and regulate the internet access service market has been extended to March 31 2019 in order to solidify the accomplishments achieved and investigate the issues found thus far pursuant to the notice of the same name issued by the MIIT in January 2017.
The General Office of the State Council recently issued the Measures for the Management of Scientific Data, which aim to improve and standardise the management of scientific data, safeguard scientific data security and encourage transparency and the sharing of scientific data. This is the first time that China has released measures which regulate scientific data at the national level. However, compared with some European countries and the United States, China still has far to go in this regard.