Provisions on the Administration of Deep Synthesis Internet Information Services (Draft for solicitation of comments)

[Source]http://www.cac.gov.cn/2022-01/28/c_1644970458520968.htm

In order to regulate internet information services deep synthesis activities, to carry forward the Core Socialist Values, to preserve national security and the societal public interest, and to protect the lawful rights and interests of citizens, legal persons, and other organizations, our office has drafted these Provisions on the Administration of Deep Synthesis Internet Information Services (Draft for solicitation of comments) and hereby releases them to the public for solicitation of comments. The public may give feedback through the following channels and methods:

1. Log in to the Ministry of Justice's Chinese Government Legal Information Network (www.moj.gov.cn, www.chinalaw.gov.cn), and enter the "Collection of Opinions on Legislation" column on the main menu of the home page to submit comments.

2. Submit your comments via email to: shenduhecheng@cac.gov.cn.

3. Send your comments by letter to: Network ​​Law Bureau, State Internet Information Office, No. 11, Chegongzhuang Street, Xicheng District, Beijing, 100044, and please indicate on the envelope "Comments on the Provisions on the Administration of Deep Synthesis Internet Information Services".

The deadline for comments and feedback is February 28, 2022.

Cybersecurity Administration

January 28, 2022

Provisions on the Administration of Deep Synthesis Internet Information Services

(Draft for solicitation of comments)

Article 1: These Provisions are drafted on the basis of the Cybersecurity Law of the PRC, the PRC Data Security Law, the Personal Information Protection Law of the PRC, The Measures on the Administration of Internet Information Services, and other relevant laws and administrative regulations, so as to regulate internet information services deep synthesis activities, carry forward the Core Socialist Values, preserve national security and the societal public interest, and protect the lawful rights and interests of citizens, legal persons, and other organizations.

Article 2: These Provisions Apply to the application of deep synthesis technology to provide internet information services (hereinafter simply Deep Synthesis Services) and to activities providing technical support for deep synthesis services, within the mainland territory of the PRC. Where laws or administrative regulations otherwise provide, follow those provisions.

Deep synthesis technology as used in these Provisions refers to the use of technologies using generative sequencing algorithms to make text, images, audio, video, virtual scenes, or other information, as represented by deep learning and virtual reality, and including but not limited to:

(1) Technologies for generating or editing text content, such as chapter generation, text style conversion, and question-and-answer dialogues;

(2) Technologies for generating or editing voice content, such as text-to-speech, voice conversion, and voice attribute editing;

(3) Technologies for generating or editing non-voice audio content, such as music generation and scene sound editing;

(4) Technologies for generating or editing biometric features such as faces in images and video content, such as face generation, face swapping, personal attribute editing, face manipulation, or gesture manipulation.

(5) Technologies for editing non-biometric attributes in images and video content, such as image enhancement and image restoration;

(6) Technologies for generating or editing virtual scenes such as 3D reconstruction.

"Deep synthesis service providers" refers to organizations that provide deep synthesis services, as well as those that provide technical support for deep synthesis services.

"Deep synthesis service users" refers to organizations and individuals using deep synthesis services to make, reproduce, publish, or transmit information.

Article 3: The state internet information department is responsible for the overall planning and coordinating the nation's governance of deep synthesis services and related oversight and management efforts. Local internet information departments are responsible for the overall planning and coordinating the governance of deep synthesis services and related oversight and management efforts within the corresponding administrative region.

Article 4: Deep synthesis service providers and users shall comply with laws and regulations, respect social mores and ethics, and adhere to the correct political direction, public opinion orientation, and values trends, to promote progress and improvement in deep synthesis services.

Article 5: Relevant industry organizations are encouraged to strengthen self-discipline, establish and complete industry standards and norms, and self-discipline systems, urging and guiding deep synthesis service providers to draft and improve service guidelines, strengthen the management of information content security, provide services in accordance with law, and accept societal oversight.

Article 6: Deep synthesis services must not be used by any organization or individual to engage in activities that are prohibited by laws and regulations, such as those endangering national security, undermining social stability, disrupting social order, or violating the lawful rights and interests of others; or to create, reproduce, publish, and transmit information that contains content prohibited by laws and regulations such as incitements to subvert state sovereignty, endangering national security and social stability, pornography and fake information, as well as infringement of the lawful rights and interests of others such as their reputation, image, privacy, or intellectual property rights.

Article 7: Deep synthesis service providers shall implement entity responsibility for information security, establishing and completing management systems such as for algorithm review mechanisms, user registration, information content management, data security and personal information protection, protection of minors, and education and training of workers, and have safe and controllable safeguard measures corresponding to the development of new technologies.

Article 8: Deep synthesis service providers shall draft and disclose management rules and platform covenants, improve service agreements, post the security obligations of users of deep synthesis services in a conspicuous manner, and perform corresponding management responsibilities in accordance with law and agreements.

Article 9: Deep synthesis service providers shall conduct real-name identity verification for users of deep synthesis services in accordance with law. Where deep synthesis service users do not conduct real-name identity verification, the deep synthesis service providers must not provide them with information publishing services.

Article 10: Deep synthesis service providers shall strengthen content management for deep synthesis information, employing technical or manual methods to conduct reviews of the data input by users of the deep synthesis services and the synthesis results; establishing and completing a database of characteristics used to identify illegal and negative deep synthesis information content, and improve the standards, rules, and procedures for making entries in the database; and employ measures to address illegal and negative information in accordance with the law, and employ measures to lawfully address the related users of the deep synthesis services, such as warnings, limiting functions, suspending services, and closing accounts.

Article 11: Deep synthesis service providers shall strengthen the management of deep synthesis technologies, periodically reviewing, assessing, and testing algorithmic mechanisms; where models, templates, or other tools are provided that can edit biometric information such as faces and voices or non-biometric information such as special items and scenes that might involve national security or the societal public interest, they shall conduct a security assessment themselves and prevent information security risks.

Article 12: Deep synthesis service providers shall strengthen the management of training data, ensure that data processing is legal and proper, and employ necessary measures to ensure data security. Where training data includes data involving personal information, they shall also comply with provisions on the protection of personal information and must not illegally handle personal information.

Where deep synthesis service providers provide significant functions for editing biometric information such as faces and voices, they shall prompt the users of the deep synthesis service to inform and obtain the independent consent of the entity whose personal information is being edited, in accordance with law. Except as otherwise specified by laws and administrative regulations.

Article 13: Deep synthesis service providers shall use effective technical measures to add marks that do not affect users' usage to deep synthesis information content produced using their services, and retain log information in accordance with law, so that the deep synthesis information content that is published and transmitted can identify itself and be traced

Article 14: Where deep synthesis service providers provide the following deep synthesis services, they shall identify the deep synthesis information content in a conspicuous way to effectively alert the public about the synthetic nature of the information content:

(1) Where providing services such as smart dialogue or smart writing, etc., which simulate natural persons to generate or edit texts, it is to be prominently labeled in the area where the source of the text information content is explained;

(2) Where providing speech generation services such as voice synthesis and imitations or editing services that significantly change personal identification characteristics, it is to be prominently labeled by means such as vocal explanation in a reasonable part of the audio information content;

(3) Where providing services that generate images or video of virtual persons such as face generation, face swapping, face manipulation, and gesture manipulation, or editing services that significantly change personal identification characteristics, it is to be prominently labeled in a conspicuous location in the information content of images and videos;

(4) Where generation or editing services with immersive scenes are provided, it is to be prominently labeled in a conspicuous location in the virtual scene information content;

(5) Where other services that have functions for generating or editing information content are provided, it is to be prominently labeled in a conspicuous location in tests, images, sounds, video, virtual scenes, and so forth.

Where deep synthesis service providers provide deep synthesis services other than those provided for in the preceding paragraph, they shall provide users of the deep synthesis services with functions to prominently label the deep synthesis information content, and alert them that they may prominently label the deep synthesis information content.

Article 15: Where deep synthesis service providers discover that the deep synthesis information content provided for in the first paragraph of article 14 was not prominently labeled, they shall immediately stop the transmission of that information and are to label it as provided before resuming transmission.

Article 16: Internet application store service providers shall perform security management responsibilities for deep synthesis applications provided by deep synthesis service providers, checking the security assessment, filings, and so forth for the application; and where relevant state provisions are violated, they shall promptly employ measures to address it such as not making it available on the market, suspending availability, or taking it off the market.

Article 17: Deep synthesis service providers shall establish and complete mechanisms for dispelling rumors, and where it is discovered that deep synthesis information service users used the deep synthesis technology to make, reproduce, publish, or transmit false information, they shall promptly employ corresponding measures to dispel the rumors and file the relevant information with departments such as for internet information.

Article 18: Deep synthesis service providers shall set up convenient and effective portals for user appeals, and public complaints and reports, and shall publish the process for handling them and the time limits for responses, promptly accepting and handling them, and giving feedback on the outcome.

Article 19: Deep synthesis service providers shall follow the relevant provisions of the Provisions on the Management of Algorithmic Recommendations in Internet Information Services to provide filing procedures within 10 working days of beginning the provision of services.

Deep synthesis service providers that have completed filings shall indicate their filing number and provide links to publicly displayed information on the websites, applications, and so forth that they provide.

Article 20: Where deep synthesis service providers put new products, usages, or functions online that have public opinion properties or capacity for social mobilization shall follow the relevant state provisions to carry out security assessments.

Article 21: All levels of internet information department are to carry out oversight inspections of deep synthesis service providers' performance of entity responsibility for deep synthesis content management; and promptly submit corrective comments and set a time for corrections for deep synthesis service providers that have problems.

Deep synthesis service providers shall cooperate with internet information departments carrying out oversight inspections in accordance with law, and provide them with necessary technical and data support and assistance.

Article 22: Where articles 7, 8, 10, 11, 13, 14, 15, 16,17, 18, 20, or paragraph 2 of Article 21 of these Provisions are violated and there are provisions in laws and administrative regulations, follow those provisions; where the laws and administrative regulations are silent, the national, and provincial, autonomous region, or directly-governed municipalities' internet information departments are to give warnings and order corrections in a set period of time in accordance with their duties, relevant operations shall be stopped prior to corrections; where corrections are refused or the circumstances are serious, order a stop of information updates and give a concurrent fine of between 10,000 and 100,000 RMB.

Where articles 6, 9, 12, or 19 of these Provisions are violated, punishment is to be given in accordance with laws, administrative regulations, and department rules by the national, provincial, and directly-governed municipalities' internet information departments in accordance with their duties.

Where violations of these Provisions cause injury to others, civil liability is to be borne in accordance with law; where it constitutes a violation of public security administration, public security administration punishments are to be given in accordance with law; where a crime is constituted, criminal responsibility is to be pursued in accordance with law.

Article 23: The meaning of the following terms as used in these Provisions:

"Scene sounds" refers to content other than voices in background sounds for audio and visual materials.

"Face manipulation" refers to the manipulation of persons' facial expressions in images and videos.

"Gesture manipulation" refers to the manipulation of persons' body movements in images or videos.

"3D reconstruction" refers to deep synthesis technology that uses data to generate or edit 3D images of scenes.

"Training data" refers to annotated or benchmark datasets that are used to train machine learning models.

"Immersive scenes" refers to highly realistic virtual scenes that are generated or edited by deep synthesis technology and can be experienced or interacted with by participants.

Article 24: The state internet information office is responsible for the interpretation of these Provisions.

Article 25: These Provisions are to take effect on XX/XX/XXXX.