1. What is the background of releasing the Measures for the Administration of Credit Reporting Services?
The People’s Bank of China (PBC) has been attaching great importance to the development of credit reporting industry, resolutely implementing the decisions and arrangements made by the Central Committee of the Communist Party of China (CPC) and the State Council, and proactively encouraging market-oriented, law-based, and science and technology-driven development of the industry. Following the promulgation and implementation of the Regulation on the Administration of Credit Reporting Industry by the State Council in 2013, the PBC introduced multiple regulations such as the Measures for the Administration of Credit Reporting Agencies, continuously improving the legal framework for credit reporting services.
In recent years, with the rapid development of digital economy, new technologies such as the Internet and big data have been widely applied in credit reference. A large amount of effective “alternative data” was collected, analyzed and used to judge the credit status of enterprises and individuals, and credit reference has gone beyond the traditional scope of sharing lending information. Meanwhile, financial institutions have a greater demand for the credit information of micro and small businesses (MSBs) financing and inclusive financial services for underserved customers, and the general public also put forward higher requirements for high-quality credit reporting services. In the new era, existing laws, regulations, and systems cannot completely cover the new forms of business and features of credit reference.
To better carry out the development philosophy of “facilitating credit reporting services for the benefit of the people”, satisfy the needs of regulated development of credit reporting industry in the new era, and effectively protect the legitimate rights and interests and information safety and security of market entities in the credit reference market, the PBC, in line with the fact-based principle, after thorough investigation and research, and wide solicitation of opinions from all parties, formulated and released the Measures for the Administration of Credit Reporting Services.
2. What are the main contents of the Measures for the Administration of Credit Reporting Services?
The Measures focuses on full-process compliance management including collection, organization, reservation, processing, provision, and security of credit information, with the key tasks of clarifying the boundary of credit reporting services and enhancing the protection of rights and interests of information subjects.
Firstly, it specifies the definition of credit information and boundary of the administration of credit reporting services. The Measures defines credit information as the basic information, lending information, and other relevant information, as well as the analyses and evaluations made based on the forgoing information. The information should be lawfully collected, facilitate financial and other activities, and be used to identify and assess the credit status of enterprises and individuals. Businesses that engage in credit reporting services for individuals shall lawfully obtain licenses; businesses that engage in credit reporting services for enterprises and credit rating services shall lawfully complete the filing process.
The Measures does not pertain in information services for non-commercial cooperation. For instance, when state organs or organizations with mandates to administer public affairs provide personal or enterprise information to financial institutions directly based on their duties, or when market institutions such as automobile dealers and real estate marketing agencies lawfully collect consumer information on behalf of financial institutions with no profit made from consumer information analysis or processing, this Measures shall not be applicable. Where assistance for loan acquisition conducted by Internet platforms and other businesses meet the definition of credit reporting business, the Measures shall apply.
Secondly, it regulates the whole process of credit reporting services. The Measures makes stipulations on all links of credit reporting services, including collection, organization, reservation, processing, provision, and use of credit information. Main contents include: consumer credit information shall be collected in accordance with the principles of data minimization and strictly on an “as needed” basis, while excessive data collection is prohibited. Any credit reporting agency that collects consumer credit information shall obtain consent from the information subjects and expressly inform them of the purposes of collection. A credit reporting agency shall review the source, quality, and safety and security of credit information and the authorization from the information subjects. An information user shall use the credit information for lawful and legitimate purposes and upon the authorization of information subjects and shall not misuse it, among others.
Thirdly, it stresses the security and lawful cross-border use of credit information. The Measures stipulates that credit reporting agencies shall enhance security management of credit information by designating the person in charge of information security and setting up a specialized department responsible for information security. A credit reporting agency shall strengthen information security management within its staff members, improve internal controls for information security, and prevent information leakage. The Measures allows lawful and compliant use of credit information in economic and financial activities such as cross-border trades, investment, and financing on the condition of information security.
Fourthly, it improves the transparency of credit reporting services. The Measures stipulates that a credit reporting agency shall present the credit information they provide in an objective manner, and establish the assessment criteria for credit scoring products to ensure its evaluation rules can be explained and the information is traceable. A credit reporting agency shall submit its assessment methodology, models, and major analytical dimensions and elements to the PBC, and proactively disclose to the public such information as the types of credit information collected, basic format and contents of the credit report, and dispute handling process.
3. What is the significance of the Measures for the Administration of Credit Reporting Services for the development of credit reference market?
By clarifying the definition of credit information and regulating the whole process of credit reporting services, the Measures will further push forward the market-oriented, law-based, and technology-driven development of the credit reporting industry and facilitate the healthy and orderly development of the credit reference market.
Firstly, it clearly defines credit information and standardizes the process of credit reporting services, which can ease market uncertainty about policy to a large extent, encourage market entities to adapt to demands for transformation in credit reporting products and services in the digital era, increase investment in credit reference infrastructure, and better apply emerging technologies to promote innovative development of credit reporting services.
Secondly, it brings the application of alternative data of credit reference into regulation and highlights the requirement of legal qualifications before conducting credit reporting services, which effectively solves the issue of “unlicensed practice”, by bringing the emerging credit reporting activities previously unregulated into the track of legal regulation. This way, market fairness is promoted and national financial stability and security are safeguarded.
Thirdly,it outlines more specific regulations for the whole process of credit reporting services, which not only complements the Regulation on the Administration of Credit Reporting Industry and other existing laws and regulations on the credit reporting industry, but also concretely implements the Civil Code, Cybersecurity Law, Data Security Law, Personal Information Protection Law and other laws and regulations in the field of credit reference. This way, the Measures effectively protects the legitimate rights and interests of subjects participating in credit reporting activities.
Fourthly, this Measures further strengthens compliance requirements for credit reporting agencies, information providers and information users, reduces compliance risks and costs of all participants, promotes professional labor division and cooperation between financial institutions and credit reporting agencies, improves the efficiency of the credit reporting industry, and enhances the level of compliance management of subjects in the credit reference market.
4. How does the Measures for the Administration of Credit Reporting Services implement the Personal Information Protection Law?
The Measures follows the principle of law-based protection and limited sharing of personal information, which fully matches the provisions on the protection of the rights and interests of personal information subjects in the Personal Information Protection Law.
Firstly, its legislative concepts and basic principles are consistent with the Personal Information Protection Law. The Measures implements the personal information processing rules of “inform-consent” in the Personal Information Protection Law, where consumer credit information shall be collected in a lawful and justifiable manner, in accordance with the principles of data minimization, and strictly on an “as needed” basis, while excessive data collection is prohibited. Credit reporting services and related activities shall be conducted on an independent, objective, and impartial basis, and shall not pose threats to state secrets, invade personal privacy, or commit breach of confidential business information.Credit information shall be used for lawful and justifiable purposes and shall not be misused, and so on.
Secondly, it highlights protection of the rights of personal information subjects to consent. The Measures stipulates that any credit reporting agency that collects consumer credit information shall obtain consent from the information subjects and expressly inform them of the purposes of collection. Each information user shall obtain the consent of the relevant information subjects when querying consumer credit information and use such information for the purposes agreed upon.
Thirdly, it stresses protection of the rights of personal information subjects to know. The Measures specifies that a credit reporting agency that provides credit reports and other credit information products and services shall present the requested credit information in an objective manner and provide explanations on the contents and specialized terms therein. Any credit reporting agency that provides credit assessment products and services, such as credit profiling, scoring, or rating, shall establish the assessment criteria, which must not contain any element that is irrelevant to the credit status of the information subjects.
Fourthly, it highlights protection of rights of personal information subjects to raise disputes and file complaints. The Measures specifies that an information subject believing that there is any error or omission in his/her credit information has a right to file a dispute; an information subject believing that his/her legitimate rights and interests are violated has a right to file a complaint. According to laws and regulations, such disputes shall be handled by credit reporting agencies and financial institutions, while complaints handled by PBC branches.
5. What is the PBC’s plan for the development of credit reporting industry in the 14th Five-Year Plan period?
The credit reporting industry plays an important role in optimizing resource allocation, forestalling and defusing financial risks, safeguarding financial security and encouraging the financial sector to serve the real economy. During the 14th Five-Year Plan period, the PBC will resolutely implement the decisions and arrangements of the CPC Central Committee and the State Council, stick to market-oriented, law-based and technology-driven development, focus on regulating market development and encouraging innovations, follow the basic requirements of rights and interests protection and information security, and make efforts to build a modern credit reference system adaptive to high-quality economic development in the digital era.
Firstly, the PBC will promote regulated and orderly development of credit reporting industry through enhanced regulatory rules. Following the release and implementation of the Measures, the PBC will, with reference to the Civil Code, Personal Information Protection Law, Regulations on the Administration of Credit Reporting Industry and other regulations on the credit reporting industry, urge relevant market entities to earnestly implement the regulatory requirements in the Measures and operate in strict compliance with laws and regulations. Agencies illegally engaged in credit reporting services and such illegal acts shall be severely scrutinized and punished according to laws and regulations.
Secondly, the PBC will deepen the supply-side structural reform of credit reporting industry in a market-oriented manner. Following the goal of “establishing a credit reference system that covers the entire society,” it will continue to promote infrastructure construction in the credit reference market, expand the coverage of credit information sharing, and build a multi-level, all-round and wide-coverage credit reference system. Based on consolidating and developing public credit reporting service platforms, it will guide state-owned capital, private capital, and social forces to actively participate according to market demands, orderly develop market-oriented credit reporting agencies and increase multi-tiered supply of credit reporting services. It will also strictly prevent disorderly capital expansion in the field of credit reference and maintain the fairness and justice of its supply.
Thirdly, the PBC will encourage technology application to safeguard legitimate rights and interests and information security of entities in the credit reference market. It will innovate regulatory approaches, strengthen compliance requirements for credit reporting agencies, push towards dynamic and sustainable regulatory technology for credit reference, safeguard legitimate rights and interests and information security of entities in the credit reference market, and ensure the safety and reliability of network environment and technological architecture of various credit reference systems. It will also encourage credit reporting agencies to apply new technologies lawfully in innovating credit reporting services, and ensure information safety and security while improving service capabilities.
6. What is the arrangement for the transition period of the Measures?
Taking into full account of adjustments in business cooperation modes between financial institutions and agencies such as Internet platforms and data companies, the Measures grants institutions that substantively engage in credit reporting services but have not obtained qualification for credit reporting services before the effectiveness of this Measures with a transition period to achieve compliance, which goes from its effective date to the end of June 2023. During such period, the PBC will enhance its guidance in the businesses of relevant institutions and promote smooth transition step by step.
