On June 1, 2019, the Secretariat of the National Information Security Standardization Technical Committee issued the practice guide for network security - essential information specification for basic business functions of mobile Internet Applications (v1.0). The following is the full text of the guide to network security practice necessary information specification for basic business functions of mobile Internet applications:
Introduction
In order to implement Article 41 of the network security law, it is necessary for network operators to collect and use personal information in accordance with the principles of legality, legitimacy and necessity, make public the rules of collection and use, express the purpose, method and scope of collection and use of information, and obtain the consent of the collected, and "network operators shall not collect personal information unrelated to the services they provide" This document, based on the principle of personal information minimum sufficiency proposed by relevant national standards, aims at the problems of personal information security in current mobile Internet applications, such as over range collection, compulsory authorization, over claim, etc., and in combination with the current mobile Internet technology and application status, provides the basic business functions of mobile Internet applications with a large number of users and high social concern The personal information that needs to be collected to ensure its normal operation provides practical guidance for mobile Internet applications to collect personal information.
1、 Scope of application
This specification provides the principles for the collection of personal information by mobile Internet applications, as well as the normal operation of 16 basic business functions, including map navigation, online car hailing, instant communication and social networking, community social networking, online payment, news and information, online shopping, short video, express delivery, food and beverage delivery, transportation and ticketing, marriage and dating, job recruitment, financial lending, real estate trading, automobile trading Line.
This specification is applicable to the standardization of personal information collection behavior of mobile Internet application providers, as well as the supervision, management and evaluation of personal information collection behavior by competent regulatory authorities and third-party evaluation agencies. It can also provide reference for mobile Internet application developers, mobile Internet application distribution platform operators and mobile intelligent terminal manufacturers.
2、 Definition of terms
1. Mobile Internet application is an application program installed and running on the mobile intelligent terminal.
2. A business or function that satisfies the specific use needs of a personal information subject. Such as map navigation, online car hailing, instant messaging, community social networking, online payment, news information, online shopping, express delivery, traffic ticketing, etc.
3. Basic business functions
The business or function that satisfies the main demand and fundamental expectation of the personal information subject to choose to use the mobile Internet application.
4. Non basic business function other business or function than the basic business function provided by the mobile Internet application.
5. Necessary information is the personal information needed to ensure the normal operation of basic business functions of mobile Internet applications. For the scope and type of personal information, please refer to Appendix A of GB / T 35273 information security technology personal information security specification.
6. An organization or individual that provides mobile Internet applications.
7. Mobile Internet application developers are the organizations or individuals who design and develop mobile Internet applications, including the developers of mobile Internet applications, as well as the third-party code developers and providers of mobile Internet application integration.
8. Mobile Internet application distribution platform operator
The organization providing mobile Internet application distribution services to the public is responsible for the management of mobile Internet application distribution platform, the content audit, copyright protection, release and management of the application software uploaded by mobile Internet application developers, and the channel of application software search, browse and download for mobile Internet application consumers.
9. Mobile intelligent terminal manufacturer
The organization that produces mobile intelligent terminals. The mobile intelligent terminal refers to the mobile terminal that can access the mobile communication network, has an open operating system that can provide the application program development interface, and can install and run the application software.
3、 Principles of personal information collection
Personal information collection activities of mobile Internet applications are mainly based on the "4 basic principles of personal information security" in GB / T 35273 "information security technology personal information security specification", and follow the following basic principles:
1) Principle of consistency of rights and responsibilities - personal information collection shall comply with the requirements of laws and regulations, shall not adopt illegal methods and channels to collect personal information, shall not collect and use personal information prohibited by laws and regulations, shall not violate the agreement with users, and shall be responsible for the damage to the legitimate rights and interests of the subject of personal information caused by personal information processing activities.
2) Clear purpose principle: the purpose, method and scope of collecting and using personal information shall be made clear to users, and the collected personal information and the authority of application shall have legal, legitimate, necessary and clear collection and use purpose and business function.
3) The principle of minimum sufficiency - do not collect personal information unrelated to the services provided, and do not apply for permission to open to collect unrelated personal information. Only the minimum type and quantity of personal information necessary to meet the business function is collected, and the frequency of automatic collection of personal information shall not exceed the frequency actually required by the business function.
4) Choice of consent principle - the network operator can collect personal information only after the user knows the rules of collection and use and explicitly agrees. Do not force or mislead the subject of personal information to agree to collect personal information in the form of default authorization, function bundling, etc. on the grounds of improving service quality, improving user experience, directional push information, developing new products, etc. Do not refuse to provide basic business function services or frequently ask for user's consent due to personal information subject's refusal or revocation of consent to collect other information than necessary information.
5) Principle of openness and transparency - Rules for the public collection and use of personal information in a clear, simple, easy to access way, and subject to external supervision.
6) Ensure the safety principle - adopt sufficient safety technology and management measures to ensure the safety of personal information collection, and prevent the safety risks such as data theft, illegal crawling, collection and transmission leakage.
4、 Necessary information about basic business functions
According to the principle of minimum and sufficient personal information collection, this specification provides the necessary information range related to each business function for 16 basic business functions, such as map navigation, online car hailing, online shopping, etc.
Necessary information mainly includes necessary information related to basic business functions and necessary information related to general functions: necessary information related to basic business functions is personal information directly related to basic business functions, which will lead to the failure of basic business functions or normal operation in case of lack; necessary information related to general functions is required by relevant laws and regulations and mobile protection Personal information necessary for security risk control of Internet applications.
（1） Map navigation
Map navigation refers to the business functions of providing Internet map and navigation services for users based on their geographic location, including map search and display services based on their geographic location, and route planning and navigation services from the starting point to the end point according to user instructions. The necessary information collected by the basic business function of map navigation is shown in Table 1.
Table 1 essential information of map navigation basic business function
（2） Network car appointment
Network car booking refers to the business function of providing network car booking service (excluding car rental service) for users, involving network reservation express, special car, luxury car, taxi, windmill, etc. The necessary information collected by the basic service function of network car Hailing is shown in Table 2.
Table 2 necessary information of basic business functions of network car Hailing
The personal information listed in Table 2 is mainly collected personal information of online car Hailing passenger users, excluding personal information of online car Hailing owner users.
（3） Instant messaging social
Instant communication and social communication refer to providing instant communication and social services for users, such as chatting in the form of text, picture, voice, video, etc., making voice call and video call, establishing and reflecting user relationship, providing social interaction and social space display, etc. The necessary information collected by the basic business function of instant messaging social networking is shown in Table 3.
Table 3 essential information of basic business functions of instant messaging
（4） Community social
Community socializing refers to providing community and social services for users with the same interests and common characteristics, including topic discussion, information sharing, attention interaction and other functions. The necessary information collected by the basic business functions of social community is shown in Table 4.
Table 4 necessary information of basic social business functions of the community
（5） Online payment
Network payment refers to the business function of providing users with the service of transferring monetary funds between payees and payers, including the functions of recharge and withdrawal, transfer, transaction, bill, etc. users usually send payment instructions remotely, and the electronic equipment of payment customers does not interact with the specific exclusive equipment of payment customers. The necessary information collected by the basic business function of network payment is shown in Table 5.
Table 5 necessary information of basic business functions of network payment
In addition, Payment institutions usually provide biometric based authentication, which involves personal biometric information. However, due to the sensitive biometric information, users should be informed again and obtain their express consent, and local terminal authentication mechanism should be preferred.
（6） News
News information refers to the business functions of providing users with news information services such as browsing, searching and publishing images, audio and video, including real-time news, hot information, etc. The necessary information collected by the basic functions of news and information business is shown in Table 6.
Table 6 essential information of basic business functions of news information
The main purpose of news information business function is to provide news information browsing. Traditional news applications usually do not collect personal information when users browse. However, with the development of news application, there are also aggregate news applications with personalized recommendation information content as the core business model. This customized news push function usually collects user's browsing operation records, which are used to mine the content that users may be interested in and push the most valuable news The user can be informed and approved. If the user refuses, the user can exit the directed push mode.
（7） Short video
Short video refers to the business functions that provide users with services such as browsing, searching, making, uploading, and publishing short video. The necessary information collected by the basic service function of short video is shown in Table 7.
Table 7 essential information of short video basic service function
（8） Online shopping
Online shopping is the business function of selling goods or services through the network, including commodity display, search, consultation, price negotiation, order placing, credit evaluation, receiving and other functions. The goods or services here do not include financial products and services, and the use of information networks to provide content services such as news information, audio and video programs, publishing and cultural products. The necessary information collected by the basic business functions of online shopping is shown in Table 8.
Table 8 necessary information of basic business functions of online shopping
The personal information listed in Table 8 is mainly for the common scenarios of mass users' shopping, excluding the user identity information to be provided under the real name shopping scenarios such as customs clearance for cross-border e-commerce and purchase of mobile phone number. In the real name shopping scenario, the user's ID number usually needs to be collected. In some o2o online to offline shopping scenarios, due to the need to judge the shopping mall where the user is, the scope of the business district, etc., the location information of the user may also be collected, and the user should be informed and get the user's authorization and consent.
（9） Express delivery
Express delivery refers to the business function of delivering letters, parcels, printed matter and other articles to users, including sending, checking, receiving and other functions. The necessary information collected by the basic business function of express delivery is shown in Table 9.
Table 9 necessary information of basic business functions of express delivery
The personal information listed in Table 9 is mainly for domestic express delivery scenarios, excluding the receiving ID card information and customs clearance information to be provided under the international express delivery scenario, as well as the payment information to be provided under the express value-added business scenarios such as collecting payment for goods on behalf of others. In addition, according to the requirements of the Interim Regulations on express delivery, enterprises engaged in express delivery business should check the identity of the sender and register the identity information, but mobile Internet applications with express delivery business function generally do not directly collect the relevant identity information.
（10） Food and beverage takeout
Catering takeout refers to the business functions of providing catering and other takeout information and services for individual users, including catering distribution, self access to the store and other functions. The necessary information collected by the basic business functions of food and beverage take out is shown in table 10.
Table 10 necessary information of basic business functions of food and beverage take out
（11） Traffic ticketing
Traffic ticketing refers to the business functions of providing traffic related ticketing and transportation services for users, including ticketing query, purchase, endorsement change, ticket refund, check-in and other functions. The necessary information collected by the basic business function of traffic ticketing is shown in Table 11.
Table 11 necessary information of basic business functions of traffic ticketing
（12） Marriage and blind date
Marriage and dating refers to the business functions of providing marriage services for users, including heterosexual recommendation, dating and other functions. The necessary information collected by the basic business functions of marriage and dating is shown in Table 12.
Table 12 necessary information of basic business functions of marriage and dating
（13） Job recruitment
Job recruitment refers to the provision of online recruitment and job search services for users, including position publishing, position display, position search, resume delivery and other functions. The necessary information collected by the basic business function of job recruitment is shown in table 13.
Table 13 necessary information of basic business functions of job recruitment
（14） Financial lending
Financial lending refers to the provision of personal consumer loan services for individual users from financial institutions, including credit, loan, repayment and transaction records. Here, financial institutions usually refer to banks, consumer finance companies, small loan companies and other institutions that provide loan services on the network with loan qualification. The necessary information collected by the basic business function of financial lending is shown in table 14.
Table 14 necessary information of basic business functions of financial lending
（15） Real estate transaction
Real estate transaction refers to the provision of house information, house rental and trading services through the network, including house display, house search, contact appointment, house rental and other functions. The necessary information collected by the basic business function of real estate transaction is shown in table 15.
Table 15 essential information of basic business functions of real estate transaction
Table 15 only lists the personal information collected through the real estate transaction mobile Internet application. At present, the real estate transaction service usually adopts the combination of online and offline. Most of the housing source information and rental realize online services, while the housing transaction is still mainly offline. The specific information can be collected according to the requirements of relevant policy documents.
（16） Car trade
Automobile trading refers to providing users with automobile information, new car and second-hand car trading services through the network, including vehicle source information search and display, vehicle audit, new car and second-hand car trading and other functions. The necessary information collected by the basic business function of automobile transaction is shown in table 16.
Table 16 essential information of basic business functions of automobile transaction
Table 16 only lists the personal information collected through the mobile Internet application of automobile trading. At present, the automobile trading service usually adopts the way of online and offline combination. Most of the new and second-hand automobile transactions have realized the online signing of electronic contracts, and some links such as vehicle audit, vehicle registration, vehicle transfer, and payment of sales fees still need to be combined offline. For example, some personal vehicle information will be collected in the process of two hand vehicle audit. For details, please refer to the second-hand vehicle flow General management measures and other relevant policies and regulations.
5、 Necessary information about general functions
The necessary information collected by mobile Internet applications due to general business function requirements or legal and regulatory requirements is shown in Table 17.
Table 17 necessary information related to general functions
Mobile Internet applications usually collect personal online records for the purpose of ensuring network security and dealing with user disputes, realizing personalized recommendation, improving user experience and improving service quality. The following points need to be considered in collecting personal online records:
a) It is necessary to judge the necessity of collecting information of the log records of users' active operations, such as collection, comment, forwarding, likes, publishing and reporting, in combination with the necessity of these users' operations.
b) Browsing, searching, clicking and other operation records are usually unnecessary information. Users shall be informed and approved when collecting.
c) When saving and using personal online records, personal information shall be demarcated.
d) When the personal online record is used to analyze the user's portrait for personalized display and recommendation, the user will be informed of the purpose of use, and the user will be provided with the option to exit the directional push mode. In addition, other necessary information collected by mobile Internet applications due to regulatory documents such as laws and regulations is only used for the purposes described in laws and regulations.