Section 2 PROTECTION OF PERSONAL INFORMATION Article 16. Principles of personal information protection in network 1. Individuals using network services shall protect their own personal information and compliance with laws on supply of personal information. 2. Organizations, individuals handling personal information shall ensure network information security for the personal information they handle. 3. Organizations, individuals handling personal information shall build up and publicize their policies applicable to handling and protection of personal information of their own organizations, individuals. 4. Personal information protection shall adhere to regulations of this Law and specific regulations of relevant fields. 5. Handling of personal information for the purpose of national defense, security, social order and security or for non-commercial purposes shall observe other regulations of relevant laws. Article 17. Collection and use of personal information 1. Organizations, individuals handling personal information shall: a) Collect personal information only after obtaining the consent of information owner on the scope and purpose of the information collection and use; b) Use collected personal information for any purpose different from the initial one only after obtaining the personal information owner’s agreement. c) Must not share, disperse the collected, accessed or controlled personal information to any third party, unless it is agreed by the personal information owner or requested by competent state bodies. 2. State bodies shall be responsible for the confidentiality and storage of personal information that they collect. 3. The personal information owner shall have rights to require any organization, individual handling personal information to provide his/her personal information that is collected and stored by the organization, individual. Article 18. Updating, change and deletion of personal information 1. The personal information owner shall have rights to require organizations, individuals handling personal information to update, change, and delete his/her personal information that the handling organizations, individuals collect, store or to cease, if he/she previously agrees on, the supply of his/her personal information to a third party. 2. Upon receipt of a valid requirement of updating, change or deletion of personal information from the owner or a valid requirement of ceasing the supply of his/her personal information to a third party, organizations, individuals handling personal information shall: a) Fulfill the requirement and notice the personal information owner thereof or provide the personal information owner with rights to access, update, change or delete his/her own personal information; 7