Credit firms must protect personal info

China's first law regulating the credit reporting industry took effect on Friday, preventing credit companies from sharing information about an individual's tax records and health, and clearing bad credit histories after five years.

The Credit Reporting Industry Management Ordinance, which was approved by the State Council late last year, requires credit reporting organizations to acknowledge and get approval from all individuals or entities before collecting and sharing their information.

Su Haopeng, head of the Department of Civil and Commercial Law at the University of International Business and Economics, told the Global Times that China's fast growing, yet poorly regulated credit reporting industry, needs the law to bring order to the sector.

"Individuals' personal information was treated as a product that could be bought and sold, but now any use of that information without the person's permission is illegal," Su said. "This is a very important step toward building a solid privacy protection system in China."

According to the regulation, credit reporting organizations, usually commercial banks or third-party investigation institutes, have to delete information about bad credit records after five years, and offer free-of-charge credit reports upon the carriers' request twice a year.

The regulation didn't define the sort of information that credit reporting companies are entitled to collect, but listed what is not allowed to be gathered. That includes an individual's blood type, tax information and medical history.

Xue Kepeng, associate professor of civil and economic law at the China University of Political Science and Law, told the Global Times that most information being collected is credit histories with banks.

"The law paves the way for information sharing among banks in the future," Xue said. "If someone fails to pay his credit card bill at one bank, he won't be able to hide the bad record and open a new account at another bank as easily as before."

However, letting the bad records haunt an individual forever is unfair, Xue said.

"Since the records have to be deleted after five years, individuals will be able to start anew in rebuilding their credit history," Xue said. "This gives citizens a chance to help construct a trust-based society."

Both Su and Xue said it was too early to say if credit reporting companies will be able to keep the information safe and delete the bad records as required.

"The core issue is any credit reporting company keeping or even leaking such information will now be punished according to the law," Su said, "while it was not even a problem before."

If an entity intends to register as a credit reporting company, it needs to have at least 50 million yuan ($8 million) assets and shareholders who have not been convicted in court for the last three years.