Many companies have been punished for failing to fulfill their data security protection obligations

In the past two years since the "Data Security Law" came into effect, the Jiangsu Public Security Bureau's cybersecurity department has focused on information data leakage, abuse, tampering and other industry-related problems, and has stepped up supervision and inspection, notifications and early warnings, and administrative law enforcement.

The police severely punished illegal behaviors that failed to fulfill data security protection obligations, comprehensively tightened the responsibility of network operating units for data security, and handled a total of 336 administrative cases in accordance with the "Data Security Law".

Case 1: A medical testing institution in Suqian

Case of failure to perform data security protection obligations

Recently, the Public Security Department of Suqian, Jiangsu Province inspected a local medical laboratory institution and found that the medical laboratory information platform operated by the institution had network security risks such as SQL injection vulnerabilities and weak passwords. It also failed to establish a data security management system, organized data security education and training, failed to take corresponding technical measures to ensure data security, and failed to carry out risk monitoring and regular risk assessments for its data processing activities, which could lead to the leakage of sensitive business data and allegedly failed to fulfill its data security protection obligations.

In accordance with Article 45 of the Data Security Law, the Suqian Public Security Bureau issued an administrative warning and fined the agency 100,000 yuan.

picture

Case 2: A Chengdu Technology Co., Ltd.

Case of failure to perform data security protection obligations

Recently, the Suzhou Public Security Bureau in Jiangsu Province discovered that a Chengdu technology company failed to establish and improve a full-process data security management system during the operation and maintenance of related systems for a Suzhou information technology company. To facilitate work, it privately uploaded more than 300,000 pieces of the company's operational data to the Internet, and failed to implement any technical protection measures to ensure data security. It also failed to carry out risk monitoring for its data processing activities, which could lead to the leakage of this batch of data and is suspected of failing to fulfill its data security protection obligations.

The Suzhou Public Security Bureau issued an administrative warning and fined the company 50,000 yuan in accordance with Article 45 of the Data Security Law.

picture

Case 3: A real estate registration center in Taizhou

and a science and technology development research center in Beijing

Case of failure to perform data security protection obligations

Recently, the Taizhou Public Security Bureau in Jiangsu Province found that the "Business Training System" of a local real estate registration center had a security vulnerability of unauthorized access to Elasticsearch. It also failed to establish a sound full-process data security management system and failed to implement effective data security protection measures. This could lead to the leakage of more than 240,000 pieces of business data stored in the system, and it is suspected of failing to fulfill its data security protection obligations.

In accordance with Article 45 of the Data Security Law, the Taizhou Public Security Bureau issued an administrative warning to the real estate registration center and ordered it to make corrections.； The system's construction, operation and maintenance unit, a science and technology development research center in Beijing, was given an administrative warning and fined 50,000 yuan.

picture

Case 4: A pharmaceutical company in Yancheng

Case of failure to perform data security protection obligations

Recently, the Public Security and Cybersecurity Department of Yancheng, Jiangsu Province discovered during an inspection of a local pharmaceutical company that the company's medical and health information membership management system contained a large amount of citizens' personal information. After on-site inspection, it was found that the system had network security vulnerabilities, and the company did not establish a data security management system, did not organize data security education and training, and did not take corresponding technical measures to ensure data security. It was suspected of failing to fulfill its data security protection obligations.

In accordance with Article 45 of the Data Security Law, the Yancheng Public Security Bureau issued an administrative warning to the company and ordered it to make corrections within a time limit.

picture

Case Five: A Nantong Technology Co., Ltd.

Case of failure to perform data security protection obligations

Recently, the Jiangsu Nantong Public Security Network Security Department inspected a local technology company and found that the company did not establish a data security management system for the MySQL database (with a data volume of one million entries) containing production process flow, operation manuals, employee personal information and other data, nor did it take corresponding technical measures to ensure data security. In addition, there were cases where "weak passwords" could be used to log in to the platform and access data, and it was suspected of failing to fulfill its data security protection obligations.

In accordance with Article 45 of the Data Security Law, the Nantong Public Security Bureau issued an administrative warning to the company and ordered it to make corrections within a time limit.

Internet police reminder

Once important data in medical, financial, real estate and other industries is leaked, it will cause major harm to public interests, economic operations, personal rights and interests, and even affect national security and social stability.

As my country's first basic legislation in the field of data security, the "Data Security Law" takes the overall national security concept as the legislative goal, focuses on outstanding issues in the field of data security, establishes basic systems such as data classification and classification, important data protection, security risk assessment, monitoring and early warning, emergency response, and transaction management, and clarifies the security protection obligations of relevant responsible entities.

Public security organs will continue to pay close attention to the latest developments in the field of data security, strengthen risk monitoring, supervision and inspection, and administrative law enforcement, continue to standardize various data processing activities, improve data protection technical measures, build a solid data security barrier system, and escort the development of the digital economy.