The People’s Bank of China issued a Draft for comments on “Measures for the Administration of Credit Investigation Services“. It is intended to regulate the credit investigation business and related activities, and promote the healthy development of the credit investigation industry. This is formulated in accordance with the “Civil Code of the People’s Republic of China”, “The People’s Bank of China Law of the People’s Republic of China”, “Regulations on the Administration of Credit Investigation Industry” and other laws and regulations.

The term “credit information” refers to various types of information used to determine the credit status of individuals and enterprises by providing services for financial and economic activities. Personal and corporate identity, address, transportation, communication, debt, property, payment, consumption, production and operation, fulfillment of legal obligations and other information, as well as analysis and evaluation of the credit status of individuals and companies based on the foregoing information information are all considered to be “credit information”.

When engaging in credit investigation business and related activities, the lawful rights and interests of information subjects shall be protected in accordance with the law, information security shall be protected, and the leakage and abuse of credit information shall be prevented. Engaging in credit investigation business and related activities shall follow the principles of independence, objectivity, and impartiality, and shall not make discriminatory arrangements that violate social public order and good customs, and shall not provide exclusive services with the help of an advantageous position.

The collection of credit information by credit reporting agencies in China shall follow the principle of “minimum and necessary” and shall not collect excessively.

Credit reporting agencies shall not collect credit information in the following ways:

When collecting credit information, credit reporting agencies shall review the business legitimacy, information sources, information quality, information security, and authorization of information subjects of the information providers to ensure the legality, accuracy and sustainability of the collection of credit information.

Credit reporting agencies in China shall clarify their respective rights and obligations with information providers in terms of data correction, objection handling, and information security. The People’s Bank of China expects credit reporting agencies operating personal credit reporting services to formulate plans for collecting personal credit information, and report to the People’s Bank of China on matters such as the collected data items, the correlation with credit, and the protection of information subjects’ rights and interests.

The collection of personal credit information by a credit reporting agency shall obtain the consent of the information subject, and clearly inform the information subject of the purpose, source and scope of the collection of credit information, as well as the possible adverse consequences of not agreeing to the collection of information. Where a credit reporting agency obtains personal consent through an information provider, the information provider shall clearly inform the information subject of the name of the credit reporting agency. When collecting non-public corporate credit information, credit reporting agencies shall adopt appropriate methods to obtain the consent of the enterprise. The collection of credit information related to the performance of duties by corporate directors, supervisors, and senior executives by credit reporting agencies shall not be regarded as personal credit information.

Credit reporting agencies shall follow the principle of objectivity in sorting, storing, and processing credit information and shall not tamper with the original data. If a credit reporting agency finds information errors in the process of sorting, storing, and processing credit information, if the information provider reports an error, it shall promptly notify the information provider to correct it; if it is an internal processing error, it shall promptly correct it, and improve the internal processing flow.

5 Years Retention Period

The retention period of bad personal information collected by credit reporting agencies in China shall be 5 years from the date of termination of bad behavior or incident. When bad credit information expires, the credit reporting agency should delete it. If it is used as sample data, it should be de-identified and moved to a non-production database for storage to ensure that personal credit information is not directly or indirectly identified. The People’s Bank of China encourages redit reporting agencies to separate personal identification information from other credit information, and implement physical isolation.

Credit reporting agencies shall take appropriate measures to conduct necessary review of the identity, business qualifications, and purpose of use of information users. They shall conduct necessary review of the network and system security and compliance management measures of information users who access the credit reporting system through the Internet, monitor the inquiries, discover violations, and stop services in a timely manner. Credit reporting agencies shall conduct necessary review of information users to ensure that information users obtain the consent of the information subject when inquiring about personal information and use it for the agreed purpose. The use of credit information provided by credit reporting agencies by information users shall be used for lawful and legitimate purposes and shall not be abused.

Information users shall use personal credit information for clear and specific purposes, and use them in accordance with the purposes agreed upon with the information subject. If they exceed the agreed purposes, they shall obtain separate consent. Information subjects can inquire about their own credit information from credit reporting agencies. If the credit reporting agencies have not collected the information subject’s information, they should clearly inform them that if they have collected the information subject’s information, they should provide the information subject with the collected information content.

Credit reporting agencies in China shall provide personal information subjects with free credit report inquiry services twice a year through various methods such as the Internet, business premises, and entrusting other institutions. If a credit reporting agency entrusts other agencies to provide free credit report query services to information subjects, it shall review the qualifications, service capabilities, safety protection facilities, and compliance requirements of the entrusted agency, and be responsible for the entrusted agency’s inquiries and leaks by joint and several liability.

The subject of personal information in China has the right to request a complete credit report from the credit bureau. The content of credit reports provided by credit reporting agencies to individuals shall not be less than the content of credit reports provided to information users. Credit reporting agencies in China shall not charge information subjects for the reason of deleting bad information or not collecting bad information.

Where credit reporting agencies provide credit information inquiry products and services such as credit reports, they shall objectively display the content of the inquired credit information, and explain the content of the inquired credit information and professional terms. If a credit reporting agency provides a credit report product, the content of the report shall include the information user’s inquiry records, objection marks, and information subject statement. Credit reporting agencies that provide evaluation products and services such as portraits, scoring, rating, etc., shall establish evaluation standards, and must not use elements that are not related to the credit of the information subject as evaluation standards. Where a credit reporting agency provides personal credit evaluation services, all data used for evaluation shall be displayed in the credit report provided to the information subject. Credit reporting agencies shall disclose the scoring methods and models used in personal credit evaluation products, and the degree of disclosure shall be limited to reflecting the credibility of the evaluation.

If credit reporting agencies provide corporate entities or debt credit rating services, they shall comply with relevant management regulations on credit rating businesses. Where credit reporting agencies provide anti-fraud products and services, they shall establish standards for identifying fraudulent credit information.

Credit reporting agencies providing credit information inquiry, credit evaluation, and anti-fraud services shall report the following matters to the People’s Bank of China or its branches above the provincial capital (capital) city center branch (hereinafter collectively referred to as the branch):

Credit reporting agencies shall not provide the following credit reporting services and products:

Credit reporting agencies shall formulate safety management systems involving all business activities and equipment and facilities, and adopt effective protective measures to ensure the security of credit information.

Individual credit reporting agencies and corporate credit reporting agencies that store or process the credit information of enterprises of more than 500,000 enterprises shall meet the following requirements:

Credit reporting agencies shall ensure the safety of the operating facilities and equipment of the credit reporting system, security control facilities and APPs and other mobile internet terminals, do a good job in daily operation and maintenance management of the credit reporting system, and ensure the physical security of the system, network security, and host security, application security, data security and client security, prevent data loss and destruction, and prevent illegal intrusion into the credit investigation system.

The credit reporting agency shall do a good job in personnel safety management in terms of personnel recruitment, personnel leaving, personnel assessment, safety awareness education and training, and external personnel visit management. Credit reporting agencies shall strictly limit the authority and scope of staff who inquire about and obtain credit information, and they shall establish operating records for staff inquiring and obtaining credit information, and clearly record the time, method, content and purpose of staff inquiring and obtaining credit information.

Credit reporting agencies shall establish an emergency response system. When major credit information leaks occur or are likely to occur, they shall immediately take necessary measures to reduce the harm and report to the People’s Bank of China and its local branches.

For credit reporting agencies to carry out credit reporting services and related activities in China, the production database and backup database shall be located in China. Credit reporting agencies that provide personal credit information abroad shall comply with the provisions of national laws and regulations. Credit reporting agencies providing corporate credit information inquiry services overseas should review the identity and purpose of information users, ensure that credit information is used for reasonable purposes such as cross-border trade and financing, and provide it in a single inquiry. Credit reporting agencies shall not transmit the credit information of batch enterprises in a certain region or industry to the same information user overseas. Credit reporting agencies that provide corporate credit information overseas should file with the People’s Bank of China. If a credit investigation agency cooperates with an overseas credit investigation agency, it shall file with the People’s Bank of China after the cooperation agreement is signed.

Credit reporting agencies shall disclose the following matters to the public and accept social supervision: