Regulations on the Management of Video Imaging Information Systems in Public Spaces (Draft for Solicitation of Public Comments)

by China Law Translate | 2024/04/09 12:35 PM

Article 1: These Provisions are drafted on the basis of the Personal Information Protection Law of the PRC, The PRC Cybersecurity Law, the PRC Data Security Law, and other laws, so as to regulate the management of video imaging information systems in public places, maintain public safety, and protect personal information security.

Article 2: Public Video Imaging Information Systems (hereinafter simply “public video systems”) as used in these Regulations refers to systems that conduct activities in public places such as the collection, storage, use, processing, transmission, provision, disclosure, or deletion of video imaging information by installing image acquisition equipment and related facilities.

Article 3: These Regulations apply to the construction and usage of public video systems as well as their oversight and management.

Article 4: The construction, use, oversight, and management of public video systems are to adhere to the principles of overall planning, reasonableness and appropriateness, standards and looking ahead, integration and sharing, lawful management, and security and controllability.

Article 5: The state is to encourage and support native innovation and technical development in the video imaging sector, establishing and improving relevant systems of standards, to increase the capacity for safeguarding public security and the level of personal information security protections.

Article 6: The carrying out of data handling activities using public video systems shall obey laws and regulations, perform obligations to protect data security, and take on social responsibility; it must not endanger national security or the public interest, and must not harm individuals' and organizations' lawful rights and interests.

Article 7: People’s governments at the county level or above are responsible for organizing, leading, planning, and coordinating the establishment and use of public video systems, establishing mechanisms such as for intensive sharing, security management, and emergency response, fully using existing resources to avoid duplicative establishment, and giving play to the function of public video systems in areas such as maintaining public safety and social governance.

Article 8: The State Council’s department for public security is responsible for efforts on the regulation and guidance of the establishment and use of public video systems. Public security organs of local people's governments at the county level or above are responsible for efforts on the regulation and guidance of the establishment and use of public video systems in the corresponding administrative region.

The relevant departments of people's governments at the county level or above are responsible for efforts on the regulation and guidance of the establishment and use of public video systems within the scope of their respective duties.

Article 9: As needed to maintain public safety, local people's governments at the county level or above are to organize public security organs and other relevant departments to plan and establish public video systems in public areas such as key urban and rural road segments, the borders of administrative regions and neighborhoods, underground tunnels, plazas, and the areas surrounding key governance and security units. The public video systems that are established shall be included in public infrastructure management, and the costs of construction and maintenance shall be included in the corresponding level of government’s budget.

Image acquisition equipment must not be installed in the public venues described above by any units or individuals except for the entities provided for in the preceding paragraph or those authorized by them.

Article 10: Based on laws, regulations, relevant standards, and the needs of security precautions, enterprises and public institutions that have business management responsibilities are to establish public video systems in the following public venues that have public safety risks:

(1) Venues where people congregate, such as commercial centers, exhibition centers, tourist attractions, cultural venues, sporting venues, entertainment venues, parking lots, service areas, and medical institutions;

(2) Transportation hubs such as airports, ports, navigation facilities, train stations, passenger auto stations, and urban light rail stations;

(3) Medium and large-scale vehicles such as passenger trains, commercial passenger cars, urban light rail cars, and passenger boats;

(4) Main transportation routes such as expressways and normal roads.

The public security organs of local people's governments at the county level or above are to collaborate with relevant departments to guide enterprises and public institutions to determine the key positions for installing image acquisition equipment.

Article 11: The installation of image acquisition equipment is prohibited in the following areas or positions:

(1) Inside the customer rooms in guest lodging venues such as inns, hotels, guesthouses, and hostels;

(2) Inside student dorm rooms, or rooms provided for their employees to live or rest in;

(3) Inside public baths, restrooms, changing rooms, nursing rooms, and fitting rooms;

(4) Other areas or positions that might harm individual privacy.

Article 12: The establishment and use of public video systems or installation of image acquisition equipment by relevant units or individuals beyond the provisions of articles 9 or 10 shall be restricted to those necessary for security precautions and follow relevant state provisions.

Article 13: The military organs opinions shall be solicited in the installation of image acquisition equipment near military restricted areas. The opinions of management units shall be solicited in the installation of image acquisition equipment near military-managed areas.

Article 14: In establishing public video systems on the basis of articles 9 and 10 of these Regulations, the establishing unit shall follow the requirements of the establishment plan, relevant standards, and the multi-level protection system for cybersecurity, to carry out system design, implementation, testing, inspection on collection, filing, and other such efforts, and shall store and manage relevant archive materials in accordance with law.

Article 15: In installing image acquisition equipment in public venues, the protection of individual privacy and rights and interests in personal information shall be emphasized, reasonably determining the installation location, angle, and scope of the collection, and setting up conspicuous alerts and information.

Article 16: For public video systems established on the basis of articles 9 and 10 of these Regulations, the video imaging information collected shall be retained for 30 days; after the completion of the retention period, images of individuals shall be deleted where the purpose of the data handling has been realized. Where laws and administrative regulations provide otherwise, those provisions control.

The personal images collected by public video systems can only be used to maintain public safety, and must not be used for other purposes.

Article 17: The units establishing and using public video systems established on the basis of articles 9 and 10 of these Regulations shall file with the public security organs for the local people's government at the county level or above within 30 days of initiating them. Where they have already been initiated before these Regulations took effect, the filing shall be handled within 60 days of the Regulations taking effect. Where there is a change in the filed circumstances of public video systems, the filings shall be promptly changed.

The public security organs shall use information technology measures to facilitate filing by the establishing and using units.

Article 18: The units establishing and using public video systems established on the basis of articles 9 and 10 of these Regulations shall perform responsibilities for managing operations and security; perform obligations for cybersecurity, data security, and personal information protection; establish systems for managing cybersecurity, data security, and personal information protection; improve technical security measures such as for preventing attacks, incursions, and viruses; regularly maintain facilities and equipment to ensure continuous, stable, and secure operation; and strengthen data security and personal information protections.

Article 19: Telecom operators providing transmission services to public video systems shall strengthen security management for transmission of the video imaging information, and employ technical measures and other necessary measures to ensure cybersecurity and operational stability, and preserve the integrity confidentiality, and usability of network data, in accordance with laws, administrative regulations, and the mandatory requirements of relevant standards

Article 20: Where the units establishing and using public video systems entrust others to operate the public video systems, they shall oversee the entrusted parties’ performance of cybersecurity, data security, and personal information protection obligations.

The entrusted party shall follow the laws, regulations, and contract agreements to establish systems such as for operations and maintenance management and risk monitoring. When system vulnerabilities, viruses, cyberattacks, or other risks are discovered, remedial measures shall be immediately employed; and when system security incidents occur, methods for addressing them shall be immediately employed, the entrusting party is to be promptly notified as provided, and reports are to be made to the relevant regulatory departments.

Article 21: Products and services used by public video systems shall comply with the mandatory requirements of relevant standards. The providers of products and services must not install malicious programs and backdoors; when discovering that their products and services have security flaws or vulnerabilities, they shall immediately adopt remedial measures, and follow provisions to promptly inform users and report to the competent departments.

Article 22: Units accepting entrustment to take on work such as for the design, work on, inspection, inspection on receipt, and maintenance of public video systems, and their employees, shall keep the confidentiality of the video imaging information they have contact with and the related archive materials, and must not, without authorization, retain them or use them for activities unrelated to the entrusted work.

Article 23: The units establishing and using public video systems established on the basis of articles 9 and 10 of these Regulations shall perform the following obligations:

(1) establish management systems such as for personnel entry inspections, education on confidentiality, and job training for persons in important positions such as system monitoring and management;

(2) employ technical measures such as for authorization management and access controls, strictly regulate internal personnel’s handling of video imaging information;

(3) Establish a system for registering information transfers, truthfully recording information such as the reason for accessing or collecting video imaging information, the content, and the unit and name of the person transferring it;

(4) Other duties that shall be performed in accordance with law.

The management or use of video imaging information from public video systems established in accordance with article 12 of these Regulations is to be conducted with reference to the provisions of the preceding paragraph.

Article 24: Where, in order to perform legally prescribed duties such as law enforcement case handling and emergency response, state organs access or collect video imaging information acquired by public video systems, they shall do so in accordance with the authority and procedures provided by laws and administrative regulations, and strictly observe confidentiality provisions; they must not use the information in ways unrelated to the performance of duties.

Article 25: In emergency situations, so as to protect the security of natural persons’ lives and well-being or major assets, related video imaging information may be accessed by individuals, their close relatives, or others with a duty of care, with the consent of the unit using the public video system.

Article 26: When the video imaging information collected by public video systems is used in public broadcasts, and might harm the lawful rights and interests of individuals or organizations, strict protective measures shall be employed for sensitive personal information such as people’s faces and motor vehicle license numbers, as well as sensitive information such as legal persons’ and unincorporated organizations’ names and business licenses, except where the individuals’ or organizations’ consent is obtained.

Article 27: Units or individuals must not exhibit the following conduct:

(1) Violating laws and regulations by externally disclosing or providing the video imaging information collected by public video systems;

(2) Altering, moving, or dismantling image acquisition equipment installed in accordance with articles 9 and 10, or related facilities, without authorization, or using means such as spraying or blocking it to impede its normal information;

(3) Illegally encroaching on or controlling public video systems;

(4) Illegally acquiring data from public video systems;

(5) Illegally deleting, modifying, or making additions to data or programs in public video systems;

(6) Other conduct impeding the normal operation of public video systems or harming cybersecurity, data security, or the security of personal information.

Article 28: Public security organs shall strengthen oversight inspections on the establishment and use of public video systems established on the basis of articles 9 and 10 of these Regulations, and relevant units or individuals shall cooperate. Where security risks are discovered or filings have not been made in accordance with these Regulations, the public security organs shall urge the relevant units or individuals to promptly correct it. Where corrections are refused, the public security organs may collaborate with relevant departments to have a talk with them in accordance with their authority and procedures.

Article 29: Where the second paragraph of article 9 of these Regulations is violated by installing image acquisition equipment without authorization, the public security organs are to order that the video imaging information they collect be deleted and that they be dismantled in a set period of time; where they refuse to so delete or dismantle, they are to be given a warning and a concurrent fine of up to 2,000 RMB.

Where units exhibit the conduct of the preceding paragraph, they are to be given a fine of up to 10,000 RMB, and the directly responsible managers and other directly responsible personnel are to be fined in accordance with the preceding paragraph.

Article 30: Where article 11 of these Regulations is violated in installing image acquisition equipment, the public security organs are to order the immediate deletion of the video imaging information they collected and their dismantling; and give a fine of between 1,000 and 2,000 RMB.

Where units exhibit the conduct of the preceding paragraph, they are to be given a fine of up to 5,000 RMB, and the directly responsible managers and other directly responsible personnel are to be fined in accordance with the preceding paragraph.

Article 31: Where article 15 of these Regulations is violated by a failure to set up alerts and notice, the public security organs are to order corrections.

Article 32: Where the first or second items of article 27 of these Regulations are violated, the public security organs are to order corrections and give warnings; and, where corrections are refused or serious consequences are caused, give a fine of up to 2,000 RMB is to be given.

Where units exhibit the conduct of the preceding paragraph, they are to be given a fine of up to 10,000 RMB, and the directly responsible managers and other directly responsible personnel are to be fined in accordance with the preceding paragraph.

Article 33: Where the third through sixth items of article 27 of these Regulations are violated, the public security organs are to give punishments in accordance with the Cybersecurity Law.

Article 34: Where articles 18 through 21 of these Regulations are violated by failing to perform security management obligations, punishment is to be given in accordance with the Cybersecurity Law and Data Security Law.

Article 35: Where these regulations are violated by handling of personal information in public video systems or by a failure to perform legally prescribed obligations to protect personal information, punishment is to be given in accordance with the Personal Information Protection Law.

Article 36: Where public employees violate these Regulations by abusing their authority, derelicting their duties, or twisting the law for personal gain while performing duties to manage public video systems or while accessing or collecting video imaging information, punishment is to be given in accordance with law.

Article 37: Where these Regulations are violated causing harm to others, civil liability is to be borne in accordance with law; where it constitutes a violation of public security administration, public security administration punishments are to be given in accordance with law; and where a crime is constituted, criminal responsibility is to be pursued in accordance with law

Article 38: The installation of image acquisition equipment in residences and other non-public places must not harm public safety or encroach on the lawful rights and interests of others, and video imaging information involving public places that is collected shall comply with the relevant provisions of these Regulations and must not be illegally provided externally or publicly transmitted.

Article 39: Image acquisition equipment installed in public places for use in identity recognition shall comply with the relevant laws, administrative regulations, and rules in addition to these Regulations.

Article 40: These regulations take effect on XX-XX-XX.

 

Click to rate this post!
[Total: 0 Average: 0]

CLT is a crowdsourced, crowdfunded legal translation project that enables English speaking people to better understand Chinese law.

Source URL: https://www.chinalawtranslate.com/cctv-regs/