金融领域近期加强信息保护立法和执法

目录
一、新规拟完善消费者金融信息的全生命周期保护
二、明确消费者金融信息的出境条件
三、严格监管金融App
四、规范金融营销宣传行为以保护消费者权益
五、我们的观察
中国人民银行（以下简称“央行”）近期发布了相关草案和若干通知，从规范金融营销宣传行为、保护金融消费者权益、加强移动金融客户端应用软件安全管理等方面，加强和细化信息保护领域的监管要求。此外，各监管机关在2019年陆续开展了针对App违法违规收集使用个人信息的执法检查活动，金融App是其中重点领域之一。以下是我们总结的相关要点。
The People’s Bank of China (“PBOC”) recently issued relevant drafts and several notices to strengthen and refine regulatory requirements in the field of information protection. These were in terms of regulating financial marketing activities, protecting financial consumer rights, and strengthening the security management of financial client-side mobile application software. In addition, various regulatory agencies successively carried out enforcement and inspection activities against the illegal collection and use of personal information in 2019: financial Apps were one of the key areas to be scrutinized. Below are the relevant key points we summarized.
一、新规拟完善消费者金融信息的全生命周期保护
New Draft Regulation Intends to Improve the Full Life-cycle Protection of Consumer Financial Information
2019年12月27日，央行发布了《中国人民银行金融消费者权益保护实施办法（征求意见稿）》（以下简称“《金融消保草案》”）。《金融消保草案》是在《中国人民银行金融消费者权益保护实施办法》（银发〔2016〕314号）（以下简称“314号文”）的基础上，经修订增补相关条款后起草的。《金融消保草案》采用“消费者金融信息”替代了314号文关于“个人金融信息”的定义，并设立专章对消费者金融信息的全生命周期保护，即对信息收集、披露和告知、使用、管理、存储与保密、删除与更正、跨境传输、外包服务管理等方面进行了全面规定，进一步强调金融消费者的信息知情权和信息自主选择权。
The PBOC issued the Implementing Measures of the People's Bank of China for the Protection of Financial Consumers' rights and interests (Draft for Comments) (“Draft”) on December 27, 2019 for public consultation. The Draft was produced by amending and adding relevant provisions on the basis of the Implementing Measures of the People's Bank of China on the Protection of Financial Consumers' Rights and Interests (Yinfa [2016] No. 314) ( “Document 314”). The Draft replaces the definition of ‘personal financial information’ in Document 314 with ‘consumer financial information’, and sets up a special chapter on the life-cycle protection of consumer financial information. It provides clarification regarding information collection, disclosure and notification, usage, management, storage and confidentiality, deletion and correction, cross-border transmission, and outsourcing service management, and further strengthens the right to know and the right to information autonomy.
二、明确消费者金融信息的出境条件
/b>《金融消保草案》延续了314号文关于消费者金融信息的跨境传输的两大条件，即以境内存储为原则、接收方必须为金融机构的关联机构。基于该前提，2016年规定要求只有在“法律法规及中国人民银行另有规定”的情况下，金融机构才能向境外提供境内个人金融信息。《金融消保草案》则明确了可以跨境的条件，即“因业务需要”且同时满足以下条件：“（一）为处理跨境业务所必需；（二）经金融消费者书面授权；（三）信息接收方为完成该业务所必需的关联机构（含总公司、母公司或者分公司、子公司等）；（四）通过签订协议、现场核查等有效措施，要求境外机构为所获得的消费者金融信息保密；（五）符合法律法规和其他相关监管部门的规定”。前述规定为金融机构向境外提供消费者金融信息提供了更为清晰的法律依据和指引。
The Draft continues to adopt two major conditions of Document 314 regarding cross-border transfer of consumer financial information, i.e. the information is in principle stored domestically, and the recipient must be an affiliate of the financial institution. Based on this, Document 314 requires that financial institutions may transfer domestic personal financial information abroad only ‘under the laws and regulations and other provisions of the People’s Bank of China’. But the Draft specifies the conditions for cross-border transfers, that is as long as it is ‘necessary for business’ and meets the following conditions at the same time, it can be transferred abroad: ‘(a) necessary for processing cross-border business; (b) having been authorized in writing by the financial consumers; (c) the data recipient being an affiliate necessary to complete the business (including head office, parent company or branch company, subsidiary company, etc.); (d) requiring foreign institutions to keep consumer financial information obtained confidentially through effective measures such as signing agreements and on-site inspections; (e) complying with the laws, regulations and rules of other relevant regulatory authorities’. Such provisions provide a clear legal basis and guidelines for financial institutions to transfer consumer financial information across borders.
三、严格监管金融App
Strict Supervision of Financial Apps
2019年下半年，央行下发《关于发布金融行业标准加强移动金融客户端应用软件安全管理的通知》（以下简称“《金融App通知》”），并同时发布金融行业标准《移动金融客户端应用软件安全管理规范》（JR/T 0092-2019，以下简称“《规范》”）。《金融App通知》明确要求金融机构将加强金融App的安全管理工作。此外，相关监管部门也单独或联合开展了若干针对App违法违规采集使用个人信息的专项行动。
In the second half of 2019, the PBOC issued the Notice on Issuing Financial Industry Standards and Strengthening the Security Management of Finance Client-side Mobile Application Software (“Financial App Notice”), and also released the financial industry standard Mobile Financial Client-side Application Software Security Management Specifications (JR / T 0092-2019, “Specifications”). The Financial App Notice specifically requires financial institutions to strengthen the security management of financial Apps. Besides, the relevant regulatory departments have separately and/or jointly launched a number of special actions against the illegal collection of personal information by Apps.
1、加强金融App保护个人金融信息
Strengthen the Protection of Personal Financial Information by Financial Apps
《金融App通知》要求各金融机构应严格按照《规范》采取有效措施加强金融App个人金融信息保护，重点包括：一是收集、使用个人金融信息时应遵循合法、正当、必要的原则，明示收集使用信息的目的、方式和范围，并经用户同意。不得以默认、捆绑、停止安装使用等手段变相强迫用户授权，不得收集与其提供金融服务无关的个人金融信息；二是应采取数据加密、访问控制、安全传输、签名认证等措施，防止个人金融信息在传输、存储、使用等过程被非法窃取、泄露或篡改；三是信息使用结束后应立即删除敏感信息，在客户端软件卸载后不得留存个人金融信息。
The Financial App Notice requires financial institutions to take effective measures to strengthen the protection of personal financial information by financial Apps in strict accordance with the Specifications, including the following key points: Firstly, when collecting and using personal financial information, it should comply with the principles of lawfulness, justification, and necessity, clearly indicate the purpose, method and scope of the information collection and use, and obtain the consent of the user. Do not force users to provide permissions in disguise by default, bundling, stopping installation and usage and other means, and do not collect personal financial information that is not related to the provision of financial services. Secondly, it should undertake measures such as data encryption, access control, secure transmission, and signature authentication to prevent personal financial information from illegally being stolen, leaked, or tampered with during its transmission, storage and usage. Thirdly, sensitive information should be deleted immediately after the use of the information, and personal financial information should not be retained after the client-side software is uninstalled.
2、开始启动金融App备案管理工作
The Start of Record-filing Management of Financial Apps
《金融App通知》要求加强金融App的行业自律管理，并做好客户端软件实名备案工作。据此，2019年12月3日，中国互联网金融协会召开会议安排部署金融机构客户端软件备案试点工作，明确应于2019年底前完成第一批试点金融App的备案申请，下一步将在全国范围内分批次组织开展金融App备案推广等自律管理工作。截至目前，已发布的第一批通过备案的金融App清单包括来自于银行、证券、基金、保险、支付等领域的23家机构1。
The Financial App Notice requires strengthening the industry’s self-management of financial Apps and undertaking real-name filing of client-side software. Accordingly, on December 3, 2019, the National Internet Finance Association of China held a meeting to arrange the deployment of the pilot filing of financial institutions’ client-side software, deciding that the filing application of the first batch of pilot financial Apps should be completed by the end of 2019. It was also decided that the next step is to organize the implementation and promotion of self-regulatory management, such as carrying out financial Apps filing in batches across the country. Currently, the list of the first batch of filed financial Apps that have been released includes 23 institutions from the fields of banking, securities, funds, insurance and payments1.
3、金融App成为执法整治活动的“常客”
Financial Apps Being Frequently Spotted in Enforcement and Rectification Activities
2019年以来，在多次针对App执法整治行动中，金融领域相关的App频繁“上榜”。例如，根据国家网络安全通报中心的报道2，全国公安机关集中查处整改了100款违法违规App，其中包括若干金融App。工信部于2019年12月19日发布《关于侵害用户权益行为的App（第一批）通报》（并于2020年1月8日发布第二批名单），向社会公示尚有41款App存在违规收集、使用用户个人信息、不合理索取用户权限、为用户账号注销设置障碍等问题，在专项整治工作中未完成整改，也包括金融App3。另，App专项治理工作组于2019年12月20日发布关于61款App存在收集使用个人信息问题的通告，其中金融相关的App占比近半数，涵盖银行（信用卡）、网贷、支付等领域4。
Since 2019, Apps related to the financial field have frequently been listed in many enforcement and rectification activities against Apps. For example, according to the news of the National Cyber Security Reporting Center2, public security agencies across the country have investigated and rectified 100 illegal Apps, including several financial Apps. The Ministry of Industry and Information Technology issued the Announcement on Apps that Infringe the Rights and Interests of Users (First Batch) on December 19, 2019 (and released the second batch on January 8, 2020), and announced to the public that there are still 41 Apps, including financial Apps3, that have problems such as the illegal collection and usage of users personal information, unreasonable requests for user permissions, and setting barriers to user account logouts, and such Apps have not completed rectification in the special rectification activity. In addition, on December 20, 2019 the App Special Governance Working Group issued a notice on 61 Apps that had problems collecting and using personal information. Among them, financial-related Apps accounted for nearly half of these, covering fields such as banks (credit cards), online loans and payments4.
四、规范金融营销宣传行为以保护消费者权益
Regulating Financial Marketing Activities to Protect Consumer Rights
12月20日，央行、中国银行保险监督管理委员会、中国证券监督管理委员会和国家外汇管理局联合发布《关于进一步规范金融营销宣传行为的通知》（以下简称“《营销通知》”）。《营销通知》从防范金融消费者的个人信息被滥用、保护金融消费者合法权益的角度，特别对如下金融营销宣传行为提出规范要求：不得违规向金融消费者发送金融营销宣传信息。未经金融消费者同意或请求，不得向其住宅、交通工具等发送金融营销信息，也不得以电子信息方式向其发送金融营销信息。以电子信息方式发送金融营销信息的，应当明确发送者的真实身份和联系方式，并向接收者提供拒绝继续接收的方式。
On December 20, 2019, the PBOC, the China Banking and Insurance Regulatory Commission, the China Securities Regulatory Commission, and the State Administration of Foreign Exchange, jointly issued the Circular on Further Regulating Financial Advertising and Promotional Activities (the “Marketing Circular”). From the perspective of preventing the misuse of the personal information of financial consumers and protecting the legitimate rights and interests of financial consumers, the Marketing Circular puts forward specific requirements for the following financial marketing activities: companies shall not distribute financial marketing information to financial consumers in violation of the relevant laws or regulations. Without the financial consumer’s consent or request, financial products or service providers shall not post financial marketing information to the financial consumers’ home or vehicle, or send such information in an electronic form. When sending financial marketing information in an electronic form, the true identity and contact information of the sender shall be specified, and the receiver shall be provided with a right to refuse to continue receiving such information.
我们的观察
Our Observations
随着国家对数据安全和个人信息保护的监管不断深化，金融领域信息保护的立法工作和执法活动也正在逐步加强。我们将密切关注《金融消保草案》的后续立法进展以及针对消费者金融信息的最新监管动态。
As the state’s supervision of data security and protection of personal information continues to deepen, the legislation and law enforcement activities of information protection in the financial field are gradually being strengthened. We will pay close attention to the follow-up legislative progress of the Draft and the latest regulatory developments on consumer financial information.
此外，我们预计监管机构在App违法违规收集使用个人信息方面的执法检查活动将会持续开展，并且呈现愈发严格的监管趋势。因此，我们建议金融App的运营主体应积极配合备案管理工作，并依据相关法律法规及国家标准，严格做好用户个人信息收集和使用等方面的合规工作。
In addition, it can be predicted that regulatory agencies will continue to carry out law enforcement and inspection activities on the illegal collection and use of personal information by Apps, which may become an increasingly strict regulatory trend. Therefore, it is recommended that the operating entities of financial Apps should actively cooperate with the record-filing management and strictly comply with the relevant laws, regulations and national standards on the collection and usage of users’ personal information.
1.参见https://mp.weixin.qq.com/s/5HEZn-Ox0IkpdHCq6S1YcA
2.参见https://mp.weixin.qq.com/s/smT4RbHsAx0vIZjEKVyg
3.参见https://mp.weixin.qq.com/s/4aLKXLtFKM1vLBiFReLsxA
4.参见https://mp.weixin.qq.com/s/lwPtpaYfwB5dlEc7YffQnQ