GB/T 40094.4-2021Electronic commerce data transaction—Part 4: Privacy protection specification (English PDF)

1 Scope

This part of GB/T 40094 specifies the general principles of privacy protection in e-commerce data transactions, the responsibilities and obligations of data providers, the responsibilities and obligations of data demanders, the responsibilities and obligations of transaction platform operators, and the requirements and verification methods for the rights of the information subject.

This part applies to privacy protection in e-commerce data transactions.

2 Normative references

The following documents are essential to the application of this document. For the dated documents, only the versions with the dates indicated are applicable to this document; for the undated documents, only the latest version (including all the amendments) is applicable to this standard.

GB/T 40094.1-2021 Electronic commerce data transaction - Part 1: Criteria

GB/T 40094.2-2021 Electronic commerce data transaction - Part 2: Data description specification

3 Terms and definitions

The terms and definitions defined in GB/T 40094.1-2021, GB/T 40094.2-2021, and the following apply to this document.

4 General rules

7 Responsibilities and obligations of transaction platform operators

The platform operators' responsibilities and obligations for privacy protection in data transactions shall include but are not limited to:

a) Implement national laws, regulations, and codes of conduct related to personal information protection, and consciously safeguard the legitimate rights and interests of personal information subjects.

b) Formulate platform privacy policies in accordance with national laws and regulations to ensure the legitimate rights and interests of transaction subjects.

c) Set up a privacy protection management department to be responsible for the daily management and implementation of the platform's privacy protection work.

d) Formulate a privacy protection management system to clarify the responsibilities, obligations of platform operators and transaction subjects, and punishment measures.

e) Establish a privacy protection management mechanism that includes but is not limited to:

--- Data sales permission mechanism: Ensure that only after a transaction subject obtains the sales permission qualification can it be allowed to participate in the transaction;

--- Data transfer registration mechanism: Implement the recording and filing of data transaction information to ensure that each data transfer has a traceable record;

--- Privacy leakage complaints and reporting mechanism: Actively respond to and resolve complaints and reports, clarify complaint resolution channels and report reward system.

f) Organize privacy protection publicity and training activities.

g) Strengthen data audit management; when information prohibited by national laws and regulations from publishing or transmitting is found, take necessary disposal measures according to the law and report to relevant competent authorities.

h) Actively cooperate with relevant competent authorities in various tasks that are carried out when they perform their duties in accordance with the law.

8 Information subject rights

The information subject in this part specifically refers to the personal information subject and does not include other information subjects except the personal information subject. The rights enjoyed by personal information subjects regarding privacy protection in data transactions shall include but not be limited to:

a) Have the right to propose revocation, deletion, and destruction of personal privacy information involved in the transaction;

b) If personal information subjects believe that the transaction activities violate the relevant national laws and regulations and infringe on their legitimate rights and interests, they have the right to protect their rights in accordance with the law;

c) If a personal information subject is harmed due to the leakage of private information, the personal information subject has the right to file a claim for compensation.

9 Verification method

9.1 The platform operators shall review the qualification materials of the data providers and the data demanders who conduct data transactions through the data transaction platform, and check whether they meet the requirements in 4.3 of GB/T 40094.1-2021. […]