Press "Enter" to skip to content

Interim Provisions on the Collection of Electronic Data Evidence in Market Regulation Adminstrative Law Enforcement

Promulgation Date: 2024-4-7
Title: Notice of the State Administration for Market Regulation on Issuing the "Interim Provisions on the Collection of Electronic Data Evidence for Market Regulation Administrative Law Enforcement"
Document Number:SAMR (2024) No.4 
Expiration date: 
Promulgating Entities: State Administration for Market Regulation
Source of text: https://www.samr.gov.cn/zw/zfxxgk/fdzdgknr/zfjcs/art/2024/art_c6b8790db04a4e3ab7459eee7971dc48.html

Chapter I: General Provisions

Article 1: These Provisions are drafted on the basis of the PRC Administrative Punishments Law, the PRC Administrative Compulsion Law, the Provisions on Administrative Punishment Procedures in Market Regulation, and other relevant provisions, in order to regulate the collection of electronic data evidence in market regulation administrative law enforcement, increase the capacity of law enforcement personnel to collect electronic data evidence, and increase the efficacy of administrative law enforcement.

Article 2: These provisions apply to the activities of market regulation departments and their law enforcement personnel in the course of administrative law enforcement surrounding the collection, sealing, seizure, inspection, analysis, and storage as evidence of electronic data.

Article 3: Market regulation departments and their law enforcement personnel shall follow the legally prescribed procedures and obey relevant technical standards to fully, objectively, and promptly gather and collect electronic data involved in the cases, and ensure the veracity and legality of the electronic data evidence.

When electronic data is to be used as evidence, it shall meet the evidence requirements of legality, veracity, and relevance.

Article 4: Where market regulation departments lawfully gather or collect electronic data from relevant units or individuals, the relevant units or individuals shall truthfully provide it.

State secrets, commercial secrets, and individual private information learned of by law enforcement personnel during the course of performing their duties shall be kept confidential in accordance with law.

Article 5: Electronic data that is gathered or collected by other state organs and is related to the case, which is received or lawfully collected by the market regulation departments, may be used as evidence in administrative law enforcement cases after verification.

Chapter II: General Provisions on the Collection of Electronic Data Evidence

Article 6: Electronic data as used in these Provisions refers to information related to the case, that can prove case facts, and is stored, processed, or transmitted in digital form.

Electronic data includes, but is not limited to, the following information and electronic documents:

(1) documents, pictures, audio and video and other electronic files and their attribute information;

(2) Information published on web pages, blogs, forums, and other web platforms;

(3) User registration information, identity verification information, digital signatures, and other user information;

(4) transaction records, browsing records, operations records, and other information on user conduct;

(5) Source code, tool software, run scripts, and other action tool information;

(6) System logs, application logs, security logs, and other system operation information;

(7) Information files and the like, that are stored in the course of any online application services that arerelated to the case.

Article 7: One or more of the following measures or methods may be lawfully employed when gathering or collecting electronic data:

(1) Sealing, seizing, or advance registration and preservation of the original storage media;

(2) On-scene collection of electronic data;

(3) Online collection of electronic data;

(4) Other measures and methods that conform with laws, regulations, and rules.

Article 8: The on-scene gathering or collection of electronic data shall be conducted by two or more persons with administrative law enforcement credentials; and when necessary, persons with expert knowledge may be appointed or hired to assist the law enforcement personnel in gathering or collection of electronic data.

Article 9: Market regulation departments may use internet information systems or equipment to collect or fix electronic data. The internet information systems or equipment used to gather or collect electronic data shall comply with the relevant provisions and have a record made of the name and version number of the system, equipment, or software used.

Article 10: When law enforcement personnel collect electronic data, a record shall be made and signed or have a seal affix by the law enforcement personnel, and the person in possession of (or proivding) the electronic data. Where the person in possession of (or providing) the electronic data is unable to sign or affix a seal, or refuses to do so, the law enforcement personnel shall note the situation in the record and employ means such as audio or video to make a record; when necessary, they can invite authenticating witnesses to the scene as witnesses.

Article 11: In any of the following circumstances, law enforcement personnel may employ methods such as printing, photographing, screen captures, screen recording, or video to fix the electronic data:

(1) There is no way to seal or seize the original storage medium and no way to collect the electronic data;

(2) The electronic data has self-destruct functions or apparatus and the relevant evidence needs to be promptly fixed;

(3) Where it is necessary to display or look over the relevant electronic data on-scene;

(4) Other situations where it is necessary to employ methods such as printing, photographing, screen captures, screen recording, or video to fix relevant evidence.

Article 12: Where law enforcement personnel employ methods such as printing, photography, screen capture, screen recording, or video to fix electronic data, they shall clearly reflect the content of the electronic data and the reasons for employing these methods to fix the evidence, and circumstances such as the place where the electronic data is saved and the characteristics and location of the original storage medium shall be noted in the record, which the law enforcement personnel and the person in possession (providing) the electronic data are to sign or affix a seal to. Where the person in possession of (or providing) the electronic data is unable to sign or affix a seal, or refuses to do so, the law enforcement personnel shall note the situation in the record and employ means such as audio or video to make a record; when necessary, they can invite authenticating witnesses to the scene as witnesses.

Article 13: As needed for law enforcement, the market regulation departments may entrust qualified third-party electronic data evaluation bodies to conduct evaluations, and may also entrust notary establishments to notarize the collection of the electronic data evidence.

Chapter III: Sealing and Seizure of Original Storage Media

Article 14: Where during the investigation and handling of cases, electronic data related to the case is discovered and there is no way to directly collect it at the scene, the original storage media shall be sealed or seized in accordance with law, a unique label placed on the storage media, and a record made of the state of the original storage media before and after the sealing and seizure.

Article 15: The sealing and seizure of original storage media shall be conducted according to the procedures in the “Administrative Compulsion Law”, and a written decision on the implementation of the administrative enforcement measures and an inventory indicating the original storage media’s name, serial number, quantity, model number, and source, and signed by the law enforcement personnel and the person in possession of (or providing) it is to be handed over at the scene.

Article 16: When sealing or seizing original storage media, where the person in possession of (or providing) the original storage media cannot be confirmed, is unable to sign or affix a seal, or refuses to do so, the law enforcement personnel shall note the situation in the record and employ means such as audio or video to make a record; when necessary, they can invite authenticating witnesses to the scene as witnesses.

Article 17: The sealing or seizure of original storage media shall comply with the following requirements:

(1) Ensure there is no way to use or launch the original storage media without lifting the seal or seizure. When necessary, electronic equipment, hard drives, memory cards, and other internal storage media may be sealed or seized separately;

(2) Pictures shall be taken before and after the sealing or seizure of the original storage medium. Pictures shall reflect the state of the original storage media before and after the sealing, and clearly reflect the seal or sealing tape.

(3) The sealing or seizure of original storage media with wireless communications functions shall employ measures such as signal blocking, cutting off signals, or cutting the power supply.

(4) The charging cables, data cables, and other necessary connection accessories are to be sealed or seized together with the original storage media.

Article 18: When seizing the original storage media, the following may be learned of from relevant persons, gathered, and noted in the record:

(1) The circumstances of the original storage medium and application systems, network topology and system layout, whether there are multiple persons managing and using it, the identity of the users or managers, etc.;

(2) The user names and passwords for the original storage medium and application systems;

(3) The circumstances of data backups for the original storage medium, whether there are encrypted disks or containers, whether there are other mobile media, whether backups have been made, the location of backup storage data, and so forth;

(4) Other relevant content.

Chapter IV: Collection of Electronic Evidence at the Scene

Article 19: The following measures may be employed to protect electronic equipment for on-scene collection of electronic data involved in the case:

(1) Promptly separating the persons involved in the case or other relevant persons from the electronic equipment;

(2) In situations where it cannot be determined whether data is easily lost, not closing currently operating electronic equipment;

(3) Where on-scene computer information systems might be remotely controlled, measures such as signal blocking, signal obstructions, or signal disconnecting network connections shall be promptly employed;

(4) Protect the power supply;

(5) Other protective measures that need to be employed.

Article 20: On-scene collection of electronic data shall comply with the following provisions:

(1) The collected data must not be stored in the original storage medium;

(2) New applications must not be installed in the target system; If it is necessary to install new applications on the target system due to special circumstances, the goal of installing the applications shall be recorded in the records;

(3) Where on-scene computer information systems might be remotely controlled, measures such as signal blocking, signal obstructions, or signal disconnecting network connections shall be promptly employed;

Article 21: When collecting electronic data at the scene, a record indicating the following content shall be made:

(1) The name, storage location, signal power status, and whether compulsory measures were employed;

(2) The methods and procedures for collection, and the name of the post-collection storage media for the electronic data;

(3) The collect electronic data's name, type, and file format;

(4) the integrity check values for electronic data evidence related to the case;

(5) Other matters that should be clearly indicated.

Article 22: Collected electronic data may be compressed and the means of compression is to be noted in the records as is the integrity check value following compression.

Article 23: In situations where the electronic data might be destroyed or is difficult to collect, advance registration and preservation may be conducted in accordance with law, with a decision on handling to be made within 7 working days. During the period of advance registration and preservation, parties and other relevant personnel must not transfer, convert, or destroy the storage media, and must not delete or modify the electronic data.

Chapter V: Online Collection of Electronic Data

Article 24: Electronic data that is published openly, and electronic data on remote computer information systems within the mainland territory, may be collected online through the networks.

Materials of technical monitoring records for online illegal conduct may be used as electronic data evidence for carrying out administrative law enforcement.

Article 25: Before carrying out online collection of electronic data evidence, an inspection should be conducted of the hardware and software environment of computer systems used for the collection of evidence, to ensure their integrity and reliability, and that they are in a normal operating state. Law enforcement personnel shall make a screen recording of the full process of collecting electronic data where collection might not be repeatable or for situations that cannot be replicated.

Article 26: When necessary, relevant information such as electronic signature authentication certificates, digital signatures, or registration information may be collected.

Article 27: When collecting online, a record or evidence report shall be created, and one or more methods such as screen captures, screen recordings, or video is to be employed to record the information:

(1) The method of visiting the remote computer information system;

(2) The date and time of extraction;

(3) The tools and means used in extraction;

(4) The network address and storage path of the electronic data, or the steps taken for accessing the electronic data;

(5) The process and outcome of integrity checks;

(6) Other information that shall be disclosed in accordance with the law.

Chapter VI: Inspection and Analysis of Electronic Data

Article 28: For original storage media or collected electronic data that has been seized, sealed, or registered and stored in advance where it is necessary to further discover or collect leads and evidence related to the case, an inspection and analysis may be conducted of the electronic data and a record made recording content such as the basic circumstances of the inspection and analysis, the inspection process, and the inspection outcomes.

Article 29: The inspection and analysis of electronic data shall be conducted by two or more law enforcement personnel. When necessary, persons with professional or technical knowledge may be appointed or hired to participate.

Article 30: The inspection and analysis of electronic data shall comply with the following requirements:

(1) Conducting examination using secure write-protected equipment to access the examined equipment involved in the case, or first making a backup of the electronic data and then conducting an inspection of the backup; and where there is no way to use write-protected equipment and no way to make a backup, the reason shall be noted and the entire process recorded;

(2) Before inspections, check the protective measures for the original storage media and its seals, and where necessary restore the protective measures after the inspection, and use means such as photographs or video to record the process;

(4) The inspection of electronic equipment with wireless communications functions shall employ measures such as signal blocking, cutting off signals, or cutting the power supply to preserve the integrity of electronic data.

Chapter VII: Storage of Electronic Data Evidence

Article 31: Security and confidentiality management is to be conducted for the storage of electronic data evidence be based on the PRC Law on the Protection of State Secrets, and the PRC Data Security Law.

Article 32: Means such as storage media, blockchain, or cloud storage may be used to save electronic data evidence.

To prevent the loss of electronic data evidence, it may be placed in backup storage.

Article 33: After an administrative punishment case concludes, the electronic data evidence shall be aggregated into a file in accordance with the relevant provisions on archive management.

Chapter VIII: Supplemental Provisions

Article 34: The meanings of the following terms in these Provisions:

(1) "Storage media" refers to hard drives, optical discs [CDs], flash drives, memory sticks, memory cards, memory chips, and other carriers and equipment with data storage functions.

(2) "Integrity Check Values" refers to a set data value to prevent alteration or destruction of data by utilizing specialized calculation methods such as has algorithms to perform calculations on electronic data, the outputs of which are used to verify the integrity of data.

(3) “Digital signatures” refer to data values that are used to verify the source and integrity of electronic data and are obtained by computing electronic data with specific algorithms.

(4) "Digital certificates" refer to electronic documents that contain digital signatures and authenticate the source and integrity of electronic data.

Article 35: Market regulation departments and their law enforcement personnel may enforce these Provisions by reference when collecting electronic data evidence in oversight inspections.

Article 36: These Provisions take effect on the date of printing and issue.

Click to rate this post!
[Total: 0 Average: 0]

Print this entry

CLT is a crowdsourced, crowdfunded legal translation project that enables English speaking people to better understand Chinese law.

Be First to Comment

    Leave a Reply

    Your email address will not be published. Required fields are marked *

    Translate