For an App, collect only personal information the business needs; for users under 14 get guardian consent; write the privacy policy clearly

Collect only information the business needs; for users under 14 get guardian consent. For violations, first an order to correct; the App may be stopped. Refusal to correct brings a fine of 1000000 yuan or less, and persons in charge 10000 to 100000 yuan. Serious cases bring a fine of 50000000 yuan or less or 5% or less of the prior year’s revenue, and persons in charge 100000 to 1000000 yuan

Cost

No money spent. Before launch, check the App’s permission list against the privacy policy and drop permissions you can do without. The hard part is product always wanting to keep some data that “might be useful later”

Benefit

Processing personal information shall have a clear and reasonable purpose, be directly related to that purpose, and use the method with the least impact on individuals’ rights and interests. Processing personal information requires the individual’s consent, or a statutory basis. For those under 14 years of age, consent of a parent or guardian is required. Violations bring orders to correct, warnings, and confiscation of illegal gains from the regulator, and orders to suspend or terminate the offending App’s services. Refusal to correct brings a fine of 1000000 yuan or less, and persons directly in charge and other persons directly responsible 10000 to 100000 yuan. Serious circumstances bring a fine of 50000000 yuan or less, or 5% or less of the prior year’s revenue. Responsible persons are fined 100000 to 1000000 yuan. Those people may also be barred for a period from serving as directors, supervisors, or senior managers of related enterprises. Selling or providing personal information that constitutes a crime is in item 4 (nationwide)

Notes

The statute does not say which posts count as “other persons directly responsible.” The author infers that people who write code and build the product may also be counted; this book found no case that can be checked word for word. MIIT periodically announces Apps taken down for violations; this section did not verify which specific bulletin, so none is cited.

Sources · 1

1. 全国人大常委会 (2021). 个人信息保护法（第六、十三、三十一、六十六条）. npc.gov.cn/npc/c2/c30834/202108/t20210820_313…