b) Take suitable measures to protect personal information; notice the personal information owner thereof in cases that it is not yet possible to fulfill the requirement due to technical or other factors. 3. Organizations, individuals handling personal information shall delete the stored personal information when the purpose of use is accomplished or the storage period expires and shall notice the personal information owner thereof, unless otherwise stipulated by laws. Article 19. Protection of personal information security in network 1. Organizations, individuals handling personal information shall take appropriate managerial and technical measures to protect personal information that they collect and store; comply with technical standards and norms of network information security. 2. In cases of technical incidents or risks thereof, organizations, individuals handling personal information are required taking remedial, blocking measures as soon as possible. Article 20. Obligations of state administration agencies in network personal information protection 1. Establishing online information channels to receive feedbacks and recommendations by organizations, individuals in relation with personal information security. 2. Periodically inspecting, examining organizations and companies handling personal information; inspecting without prior notice when needed. Section 3 INFORMATION SYSTEM PROTECTION Article 21. Classification in security of information systems 1. Security classification of an information system means determination of its network information security level in the increment order from 1 to 5 to take managerial and technical measures to protect it accordingly. 2. Information system shall be categorized into security levels as follows: a) Level 1 is the level that when an information system is sabotage, it will damage legitimate rights and benefits of organizations, individuals, not public benefits, social order and safety, national defense or security; b) Level 2 is the level that when an information system is sabotage, it will severely damage legitimate rights and benefits of organizations, individuals, damage public benefits, not social order and safety, national defense or security; c) Level 3 is the level that when an information system is sabotage, it will severely damage production, public benefits, social order or damage safety, national defense or security; d) Level 4 is the level that when an information system is sabotage, it will extremely damage public benefits, social order or damage safety, or severely damage national defense or security; e) Level 5 is the level that when an information system is sabotage, it will extremely damage national defense or security; 8