Citizen's personal information should be stored in the country

The draft of cyber security law that was submitted to the National People's Congress Standing Committee for second review on the 27th proposed to strengthen the security protection of key information infrastructure and its data; further strengthen the national measures to maintain network security; and increase a number of support measures to promote network security Promote network security and development; further strengthen the social responsibility of network operators, specify the duration of network operators' retention of network logs, and cooperate with the supervision and inspection obligations of related departments; plan to further increase disciplinary measures such as interviews, credit files, and prohibition of practice. Great efforts to punish cybersecurity activities.

Citizens’ personal information should be stored on the National People’s Congress’s Law Committee. Some members of the Standing Committee and local authorities recommend that the scope of key information infrastructure be excluded from enumeration. The State Council may formulate supporting regulations to make it clear.

In response, the second-party review stipulates that the state will implement key protections on the basis of a network security protection system based on the key information infrastructure that may be seriously damaged by national security, the people’s livelihood, and the public interest if it is damaged, lost functionality, or leaked data. . The specific scope and safety protection measures for key information infrastructure are formulated by the State Council.

The second-part review also stipulates that citizens' personal information and important business data collected and generated by operators of key information infrastructure in the territory of the People's Republic of China should be stored in China. If it is really necessary to provide overseas services due to business needs, safety assessments shall be carried out in accordance with the methods formulated by the State Network Lettering Department and the relevant departments of the State Council, except where otherwise provided for by laws and administrative regulations.

The second reviewer adds provisions that the state encourages network operators outside the critical information infrastructure to voluntarily participate in the protection system of critical information infrastructure; information obtained by the national network trust department and related departments in the protection of critical information infrastructure can only be used to maintain the network. The need for safety cannot be used for other purposes.

The operator has retained the network log for not less than six months. The National People's Congress Law Committee stated that it intends to increase a number of support measures to promote network security and promote network security while promoting development. First, the state promotes the construction of a network security social service system and encourages enterprises and institutions to carry out network security certification, testing, and risk assessment services. Second, the state encourages the development of network data security protection and utilization technologies, promotes the opening of public data resources, promotes technological innovation and economic and social development, supports innovative cyber security management methods, applies new network technologies, and enhances the level of network security protection. The third is to increase the provisions of the big data application that must anonymize citizens’ personal information, and further clarify the rules for the use of citizens’ personal information.

The draft of the second-party review also added provisions that the network operator's retention of the network log should not be less than six months; the network operator should cooperate with the supervision and inspection conducted by relevant departments according to law.

The relevant department may negotiate about the operator's second reviewer's stipulations. For operators who have relatively large security risks or security incidents on the network, the relevant department may perform a contract on their legal representative or principal responsible according to the prescribed authority and procedures. Any person who deliberately engages in public security management penalties or criminal punishments for activities that endanger network security shall not engage in network security management and key positions in network operations for the rest of his life. For those who commit illegal acts as prescribed by this Law, they shall be subject to relevant laws and administrative regulations. The provisions are credited to the credit file and publicized.