Detail of GB/T 41391-2022

Introduction of GB/T 41391-2022

Information security technology—Basic requirements for collecting personal information in mobile internet applications 1 Scope This document specifies the basic requirements for the collection of personal information by Apps, the necessary personal information scope and use requirements of Apps of common service types. This document is applicable to the regulation of personal information collection activities by App operators, as well as the supervision, management and evaluation of personal information collection activities of Apps by regulatory authorities and third-party evaluation agencies. 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. GB/T 25069 Information security techniques—Terminology GB/T 35273-2020 Information security technology—Personal information security specification 3 Terms and definitions For the purposes of this document, the terms and definitions given in GB/T 25069, GB/T 35273-2020 and the following apply. 3.1 mobile internet application applications running on smart mobile terminal Note: Including applications and mini programs, referred to as App for short, that are preset, downloaded and installed on smart mobile terminals. 3.2 mobile internet application operator owner, manager or provider of mobile internet application Note: App operator for short. 3.3 mini program a mobile internet application based on the application open interface, which may be used by users without installation. Note: By exposing its application programming interface (API) or function, an application enables an external program to add functions on the application or use its resources without changing the source code of the application. 3.4 business function any function that meets the specific purpose of users Note: The business functions of App can be divided into basic business functions and extended business functions. [Source: GB/T 35273-2020, 3.17, modified] 3.5 service type classification of business functions provided by mobile internet applications Note: See Annex A for common service types such as map navigation, online car hailing, instant communication, online shopping, online payment, etc. 3.6 basic business function the business functions of mobile internet application serving the main purposes of users 3.7 extended business function business functions other than the basic business functions provided by mobile internet application 3.8 necessary personal information personal information necessary to ensure the normal operation of basic business functions of mobile internet application, without which, mobile internet application cannot perform basic business functions Note 1: See B.1 in Annex B for the relationship among App, basic business function and necessary personal information. Note 2: The scope of personal information that can be collected by App is divided into necessary personal information and non-necessary but relevant personal information. Non-necessary but relevant personal information refers to personal information related to the services provided by the App but whose collection is optional, see B.2. 3.9 user personal information subject using mobile internet application Note: Users usually include consumer-side users and service-supply-side users. Consumer-side users are individual consumers who use App services, while service-supply-side users are users who provide services through Apps. For example, consumer-side users of online car hailing Apps are passengers and service-supply-side users are drivers. 3.10 system permission to access personal information system permission of operating system of smart mobile terminal which is open to the mobile internet application and with the function of collecting personal information Note: System permission or permission for short. 3.11 unique device identifier a code that uniquely identifies the smart mobile terminal Note 1: It is also known as UDID, and can be divided into changeable unique device identifiers and unchangeable unique device identifiers. Note 2: Changeable unique device identifier refers to the unique device identifier that can be reset and changed, or be used to turn off tracking by the user. Unchangeable unique device identifier refers to the hardware identifier that remains unchanged regardless of device factory reset, safe uninstallation of application or other user operations. 3.12 targeted push based on the personal information such as the network browsing history, interests, purchasing records and habits, the information content, search results of goods or services, recommendations of products or services, news, advertisements, etc. may be displayed and provided to the personal information subject through algorithm Note: It is also known as personalized presentation or personalized recommendation. [Source: GB/T 35273-2020, 3.16, modified] 3.13 user profiling process of personal characteristic model formation through analyzing or predicting the personal characteristics of a particular natural person, such as occupation, economy, health, education, personal preference, credit and behavior, on the basis of collecting, gathering, and analyzing personal information [Source: GB/T 35273-2020, 3.8, modified] 3.14 software development kit software library assisting in software development Note: A software development kit usually includes a collection of related binaries, documents, examples and tools. 3.15 third-party software development kit software development kits provided by legal entities other than mobile internet application operators 3.16 system permission request the process by which a mobile internet application claims to the operating system of smart mobile terminal and requests authorization from user to obtain permission to access data or functions 3.17 third-party application an application provided by a legal entity other than the mobile internet application operator that provides services to users through the mobile internet application Note 1: The forms of third-party applications provided usually include SDK, mini programs, Web pages, etc. If SDK does not provide services directly to users, it is not a third-party application defined in this document. Note 2: If an application provider is a legal entity different from the App operator but belongs to the same enterprise group as the App operator and complies with the same set of management system, conducting unified security and operation and maintenance management, such application is not a third-party application of the App operator. Affiliates are usually the third parties of App operators. 4 Abbreviations For the purposes of this document, the following abbreviations apply. API: Application Programming Interface GPS: Global Positioning System ICCID: Integrate Circuit Card Identity IMEI: International Mobile Equipment Identity IMSI: International Mobile Subscriber Identity MAC: Media Access Control MEID: Mobile Equipment Identifier SDK: Software Development Kit SN: Serial Number WAP: Wireless Application Protocol WEB: World Wide Web 5 App function division The requirement for an App to collect personal information is closely related to its functions. The basic business functions and extended business functions of Apps shall be clearly divided according to the following requirements: a) It shall be clear that the service type of the business function that realizes the main purpose of the user is the type of the App; b) If the type of App is the common service type given in Annex A, the basic business function of the App shall be classified based on the corresponding service type in Annex A; Note 1: Annex A provides the basic business functions and necessary personal information scope of Apps of common service types and the use requirements for necessary personal information in accordance with the Provisions on necessary personal information scope of common types of mobile internet applications. The basic business functions and necessary personal information scope of Apps of common service types in Annex A of this document are consistent with the Provisions on necessary personal information scope of common types of mobile internet applications. c) If the type of App is not the common service type given in Annex A, the business functions that realize the main purpose of users shall be classified as the basic business functions of App, and the business functions other than the basic business functions provided by App shall be classified as extended business functions; Note 2: If App provides various types of services, service types other than App types are called "other service types", and business functions of other service types are extended business functions. For example, the map navigation Apps also provide online shopping and online car-hailing services, so the business functions of online shopping and online car-hailing services are all extended business functions. d) Business functions only for the purpose of improving service quality, enhancing user experience and targeted pushing of information and new product development shall be classified as extended business functions; e) Business functions provided by external third parties or affiliates shall be classified as extended business functions, except for the basic business functions of Apps of common service types given in Annex A; f) If there are multiple optional methods for implementing the basic business functions, the implementation methods that have a greater impact on users' personal rights and interests shall be classified as extended business functions. Note 3: If new implementation methods of basic business functions appear due to technological development, and collect personal information more sensitive than that of the traditional methods and have a greater impact on personal rights and interests, they can be classified as extended business functions, which are usually used as optional alternatives and supplements for basic business functions. For example, new identification methods based on the development of biometric identification technology (such as face recognition, voiceprint recognition, fingerprint recognition, etc.) collect biometric information instead of passwords, which has a greater impact on personal rights and interests.

Contents of GB/T 41391-2022

Foreword i Introduction ii 1 Scope 2 Normative references 3 Terms and definitions 4 Abbreviations 5 App function division 6 Basic requirements for App to collect personal information 6.1 Minimum necessary collection 6.2 Necessary personal information 6.3 Specific types of personal information 6.4 Informed consent 6.5 System permission 6.6 Third party access management 6.7 Other requirements Annex A (Nominative) A.1 Map navigation Apps A.2 Online car hailing Apps A.3 Instant communication Apps A.4 Online community Apps A.5 Online payment Apps A.6 Online shopping Apps A.7 Food delivery Apps A.8 Express mail delivery Apps A.9 Transportation ticketing Apps A.10 Online dating Apps A.11 Recruitment Apps Annex B (Informative) Explanation of concepts such as App, business functions and necessary personal information Annex C (Nominative) Collection requirements for specific types of personal information Annex D (Informative) Scope of system permission to access personal information Annex E (Informative) Android system permissions of low relevance to common service types Annex F (Informative) Common unchangeable unique device identifiers