What are the privacy issues in 1. corporate credit reports?

Privacy refers to the right or interest that an individual or organization does not want to be known or interfered with by others in certain information or behavior of himself or his organization under certain circumstances. Privacy protection refers to the use of law, technology, management and other means to prevent privacy from being illegally collected, used, processed, transmitted, and disclosed.

As the main body of social and economic activities, enterprises also enjoy the right to privacy and need privacy protection. The enterprise credit report is a document that reflects the comprehensive credit status of the enterprise and is one of the important products provided by the consulting company for customers. It contains the basic information of the enterprise, credit information, business status, financial data, legal disputes and other aspects of the content, involving the sensitive information and trade secrets of the enterprise. If this information is illegally obtained, leaked or misused, it may bring serious losses and risks to the enterprise, affecting its reputation, competitiveness and development prospects.

As a result, there are several types of privacy issues in corporate credit reporting:

（1) Personal privacy issues. The enterprise credit report may contain personal information of natural persons associated with the enterprise, such as the names, ID numbers, contact information, and equity ratios of legal representatives, shareholders, and executives. If such personal information is illegally collected or disclosed, it may infringe on the personal privacy rights of natural persons, resulting in identity theft, harassment or other adverse consequences.

（2) Trade secret issues. Trade secrets refer to technical information and business information that is not known to the public, can bring economic benefits to the right holder, is practical, and has been kept confidential by the right holder. The enterprise credit report may contain the business secrets of the enterprise, such as core technology, patents, trademarks, customer resources, market strategy, financial situation, etc. If these trade secrets are stolen or leaked by competitors or other illegal elements, it may damage the legitimate rights and interests of enterprises and affect their market position and competitive advantage.

（3) Data security issues. Data security refers to the state in which the integrity, availability and confidentiality of data are guaranteed. Enterprise credit reports contain a large amount of data information, which, if not effectively protected and managed, may face the risk of tampering, deletion, damage or disclosure, resulting in a decline in data quality or loss of data value.

What principles and norms should 2. consulting firms follow in dealing with sensitive information in corporate credit reports?

Consultants should follow the following principles and norms when dealing with sensitive information in corporate credit reports:

（11) Principles of legality, legitimacy and necessity. When collecting, analyzing, preparing and providing enterprise credit reports, consulting companies shall abide by relevant laws and regulations, respect the privacy rights of enterprises, and shall not obtain or process enterprise information by means of misleading, fraud, coercion, etc. The consulting company shall clarify the reasonable purpose of the treatment, which is directly related to the purpose of the treatment, and adopt the method that has the least impact on the rights and interests of the enterprise. The consulting company shall be limited to the minimum scope to achieve the purpose of processing and shall not excessively collect or process enterprise information.

（2) The principle of openness and transparency. When handling the enterprise's credit report, the consulting company shall make public its handling rules, clearly state the purpose, method and scope of the processing, and inform the enterprise of its name or name and contact information. The consulting company shall obtain the consent or authorization of the enterprise, or handle the enterprise information within a reasonable scope in accordance with the provisions of laws and regulations. The consulting company shall promptly feed back its handling results to the enterprise and accept the supervision and evaluation of the enterprise.

（31) Confidentiality and safety principles. When handling the enterprise credit report, the consulting company shall keep the enterprise information it handles confidential and shall not disclose, sell or illegally provide it to a third party. The consulting company shall take necessary measures to ensure the security of the enterprise information handled and prevent the risk of tampering, deletion, damage or disclosure. The consulting company shall regularly audit and evaluate its handling activities, and establish and improve emergency plans and disposal mechanisms.

How do 3. consulting companies establish and improve corporate information protection systems and mechanisms?

In order to effectively protect and deal with the sensitive information in the enterprise credit report, the consulting company shall establish and improve the following systems and mechanisms:

（11) Formulate personal information protection policies. Personal information protection policy refers to a series of rules formulated and disclosed by consulting companies to protect personal information. The personal information protection policy shall include the following contents: the purpose, scope and method of personal information collection and use; the storage period of personal information; the sharing, transfer and disclosure of personal information; the way individuals exercise their rights; personal information security measures; risk response measures such as personal information leakage; and the way to update and change the personal information protection policy. The consulting company shall regularly update and improve the personal information protection policy according to the actual situation, and notify the enterprises and individuals in a timely manner.

（2) Establish an enterprise information protection committee. The Corporate Information Protection Committee is a specialized agency established by a consulting firm to protect corporate information. The enterprise information protection committee shall be composed of senior management personnel, legal advisers, technical experts and customer representatives of the consulting company. It shall be responsible for formulating and implementing the strategy, plan, standard and process of enterprise information protection, supervising and evaluating the effect of enterprise information protection, handling complaints and disputes of enterprise information protection, and improving the awareness and ability of enterprise information protection.

（3) Formulate enterprise information security management system. Enterprise information security management system refers to a series of rules formulated and implemented by consulting companies in order to ensure enterprise information security. The enterprise information security management system shall include the following contents: enterprise information security objectives, responsibilities and functions; enterprise information security risk assessment and control methods; enterprise information security technical measures; enterprise information security personnel management; enterprise information security education and training; enterprise information security audit and inspection; enterprise information security emergency plan and disposal procedures, etc.

（4) Establish a cooperation mechanism for enterprise information protection. Enterprise information protection cooperation mechanism refers to the way in which consulting companies communicate, coordinate and collaborate with other relevant parties in the protection of enterprise information. The consulting firm shall establish good relations of cooperation with the following parties: (1) Client: The consulting company shall sign a contract or agreement with the client to clarify the rights and obligations of both parties in providing or using the enterprise credit report, regulate the collection, use, sharing, transfer and disclosure of enterprise information by both parties, and stipulate the responsibilities of notification, assistance and compensation of both parties in the event of risk events such as enterprise information leakage. (22) Regulatory department: The consulting company shall abide by the laws, regulations and guidance of the regulatory department, report its handling activities to the regulatory department in a timely manner, cooperate with the regulatory department in supervision and inspection, and accept the punishment and rectification of the regulatory department. (3) Industry organizations: Consulting companies shall join relevant industry organizations, participate in the formulation and revision of industry standards and norms, abide by industry self-discipline rules, participate in industry exchanges and training, and jointly improve the industry level. (4) Third-party service providers: Consulting companies should carefully select third-party service providers, such as data collection, analysis, storage, processing, transmission and other service providers, sign strict confidentiality agreements with them, clarify their rights and responsibilities in handling enterprise information, and regularly review and evaluate them to prevent them from infringing on enterprise information.

How do 4. consulting firms respond to risk events such as the disclosure of sensitive information in corporate credit reports?

Despite the various measures taken by consulting firms to protect and handle sensitive information in corporate credit reports, risk events such as accidental or intentional disclosure of corporate information may still occur. Consultants should follow the following steps in responding to such risk events:

（1) Discovery and confirmation. The consulting company shall establish an effective monitoring and reporting mechanism to detect and confirm the occurrence of risk events such as enterprise information leakage in a timely manner, and determine the scope, degree and cause of its impact.

（2) Notifications and Reports. The consulting company shall promptly notify and report to the affected enterprises and individuals, regulatory authorities, industry organizations, third-party service providers and other relevant parties of the situation of enterprise information leakage and other risk events, and explain its response measures and progress.

（3) Disposal and recovery. Consultants should take emergency measures, such as cutting off network connections, encrypting or deleting data, changing passwords or keys, etc., to prevent or reduce the spread and impact of risk events such as corporate information leakage. The consulting company shall resume normal processing activities as soon as possible, repair or update damaged data, systems, equipment, etc., and eliminate or reduce the consequences of risk events such as corporate information leakage.

（4) Analysis and summary. Consulting companies should conduct in-depth analysis and summary of corporate information leakage and other risk events, find out their root causes and lessons, put forward suggestions and measures for improvement and prevention, improve corporate information protection systems and mechanisms, and improve corporate information protection levels.

How can 5. consulting companies enhance their awareness and ability to protect sensitive information in corporate credit reporting?

The protection of sensitive information in corporate credit reporting is not only the responsibility of the consulting firm, but also the advantage of the consulting firm. How to improve the awareness and ability of sensitive information protection in corporate credit reporting is a problem worthy of attention and discussion. Here are some possible ways:

（1) Strengthen the education and training of enterprise information protection. The consulting company shall regularly conduct education and training related to corporate information protection for its employees, so that they can understand the importance and value of sensitive information in corporate credit reports, and master relevant laws and regulations, standards and specifications, technical methods, and management of corporate information protection. Knowledge and skills such as procedures to form good corporate information protection awareness and habits.

（2) Establish an incentive mechanism for enterprise information protection. Consulting companies should establish effective incentive mechanisms to encourage and reward employees to make contributions or innovations in the protection of sensitive information in corporate credit reports, such as making suggestions for improvement, discovering and solving problems, and developing new technologies or products. At the same time, consulting companies should also establish a strict punishment mechanism to impose corresponding penalties or accountability on employees who violate corporate information protection rules or cause corporate information leakage and other risk events.

（3) Promote corporate information protection culture. Consulting companies should promote corporate information protection culture through various means, such as holding theme activities, publishing promotional materials, displaying successful cases, etc., to convey the concept and value of sensitive information protection in corporate credit reports to internal employees and external customers, and establish consulting The company's image and reputation in this regard.

Conclusion:

The protection of sensitive information in corporate credit reporting is an important and complex issue, involving law, technology, management and other aspects. As the provider and user of enterprise credit reports, consulting companies should attach great importance to this issue, follow the relevant principles and norms, establish and improve the corresponding systems and mechanisms, enhance their own awareness and ability, protect the safety and legal use of enterprise information, provide high-quality services for customers, and contribute to social and economic development.