Promulgated by: Hebei Provincial Data and Government Services Bureau.
Document No.: Not stated in the published text.
Issued December 30, 2024. Effective February 1, 2025 (valid for two years).
Translation note — DCC. Translated in full from the official Chinese text of the Measures. Terminology follows DCC’s bilingual glossary and the usage in the national Implementing Specifications for the Authorized Operation of Public Data Resources (Trial). “Data source units” renders 数源单位. “Three majors and one large” (三重一大) is the collective decision-making mechanism for major decisions, major appointments, major projects and large expenditures.
Hebei Province Measures for the Administration of Authorized Operation of Public Data Resources (Trial)
Chapter I General Provisions
Article 1. These Measures are formulated in accordance with the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China, the Opinions of the CPC Central Committee and the State Council on Building a Basic Data System to Better Bring into Play the Role of Data Elements, the Opinions of the General Office of the CPC Central Committee and the General Office of the State Council on Accelerating the Development and Utilization of Public Data Resources and other relevant provisions, and in light of the actual conditions of this Province, in order to advance the orderly development and utilization of public data, regulate the authorized operation of public data resources, and accelerate the cultivation of the data element market.
Article 2. These Measures apply to the authorized operation of public data resources carried out within the administrative area of this Province.
Article 3. For the purposes of these Measures, “public data resources” means data and data collections of utilization value generated by State organs, organizations authorized by laws and regulations to manage public affairs or provide public services, and enterprises and public institutions (hereinafter collectively “data source units”) in the course of performing their duties or providing public services.
“Authorized operation of public data resources” (hereinafter “authorized operation of public data”) means the activity of authorizing, in accordance with laws, regulations and relevant requirements, qualified operating institutions to govern and develop the public data resources held by people’s governments at or above the county level and to provide data products and services to the market on a fair basis.
“Implementing institution” means the unit determined by a people’s government at or above the county level to be responsible for organizing and carrying out the authorized operation of public data within its administrative area.
“Operating institution” means a legal-person organization that has obtained authorization in accordance with laws and regulations to develop and operate the public data resources within the scope of the authorization.
Article 4. The authorized operation of public data shall follow the principles of lawfulness and compliance, fairness and transparency, priority to the public interest, reasonable returns, and security and controllability.
Article 5. The provincial data administration department shall be responsible for organizing and coordinating, guiding and promoting, and supervising and administering the authorized operation of public data across the Province; it shall strengthen overall coordination and cross-regional, cross-industry and cross-level collaboration, promote the integration of public data resources and the enhancement of data-service capabilities, and bring into full play the effects of large-scale application of public data resources.
Data administration departments at or above the county level shall be responsible for organizing and coordinating, guiding and promoting, and supervising and administering the authorized operation of public data within their administrative areas.
Industry competent departments shall strengthen the high-quality collection, aggregation and governance of public data resources in their industries and fields, identify the needs of application scenarios, and perform their responsibilities relating to the authorized operation of public data in accordance with these Measures.
The development and reform, market regulation and other departments shall, in accordance with their respective duties, supervise the circulation and trading of public data products and services.
The cyberspace, cryptography administration, secrecy administration, public security, state security and other departments shall, in accordance with their respective duties, carry out the security supervision of the authorized operation of public data.
Article 6. This Province shall advance the lawful and orderly development and utilization of public data resources, promote the conditional free use of public data used for public governance and public-welfare undertakings, explore the conditional paid use of public data used for industrial and sectoral development, and support administrative areas that have the necessary conditions, and fields closely related to people’s livelihoods, urgently needed by society, with significant industry value-adding potential and of major strategic significance for industry, in carrying out the authorized operation of public data.
Chapter II Administration of Public Data Resources
Article 7. The provincial data administration department shall, together with the relevant departments, formulate the specifications for the preparation of the province-wide catalogue of public data resources and coordinate the preparation of the province-wide catalogue of public data resources.
Industry competent departments at all levels shall prepare the public data resource catalogues for their industries and fields in accordance with the catalogue-preparation specifications and submit them to the data administration department at the same level for review. After review and approval, the data administration department shall consolidate and compile the catalogue of public data resources for its administrative area and aggregate it level by level into the province-wide unified catalogue of public data resources.
Article 8. The data administration department shall, together with the relevant departments and on the basis of the catalogue of public data resources, determine the content and scope of collection of public data resources and form a list of responsibilities for the collection of public data resources.
Data source units shall, in accordance with the list of collection responsibilities, collect, record and store public data digitally; non-digital information shall be digitally converted in accordance with the relevant technical standards. Public data resources that can be obtained by way of sharing shall not be collected repeatedly or through multiple channels.
The collection and aggregation of public data resources shall pay attention to the needs of application scenarios for the authorized operation of public data, so as to provide high-quality data resources for the development of data products and services.
Article 9. The data administration department shall, together with the industry competent departments, organize data source units to aggregate the public data resources collected in accordance with law, on the principle that everything that should be aggregated is aggregated, in accordance with the requirements of the provincial data administration department. Departments at all levels may, according to their needs, apply level by level to the data administration department for the return flow of data, which the data administration department shall implement after seeking the views of the data source units.
Article 10. Data source units shall implement the national and provincial requirements for the classified and graded management of public data resources, carry out the sharing, opening, verification, updating, security and other management of public data in accordance with laws and regulations, and ensure the truthfulness, accuracy, completeness, timeliness and usability of the data.
Chapter III Authorization of Public Data Resources
Article 11. The authorized operation of public data shall not endanger national security or the public interest, and shall not infringe trade secrets, personal privacy or personal information rights and interests.
Where public data resources of another region or department obtained by way of government data sharing are used for authorized operation, the implementing institution shall obtain the consent of the unit providing the shared data.
Article 12. The data administration department shall coordinate the needs for the authorized operation of public data and, together with the relevant industry competent departments, prepare an implementation plan for the authorized operation of public data (hereinafter the “implementation plan”). The implementation plan shall mainly include the following:
(1) the name of the authorized operation;
(2) the implementing institution for the authorized operation (the data administration department);
(3) a study of the necessity and feasibility of the authorized operation, organized by the data administration department with the participation of representatives of the relevant industry competent departments and regulatory departments and of experts, covering, without limitation, full-lifecycle management services for the data under authorized operation, social demand, market size, expected results and risk prevention and control;
(4) the selection criteria for operating institutions, including requirements as to capital, management, technology, service and security capabilities;
(5) the authorized-operation model;
(6) the scope of public data resources under authorized operation, the resource catalogue, the frequency of updates and the state of data quality;
(7) the term of authorized operation, construction content, technical safeguards, implementation schedule, evaluation standards, exit mechanism and asset management;
(8) the list of public data products and services to be provided, which shall cover the two major categories of support for public governance and public-welfare undertakings and for industrial and sectoral development, together with the expected forms of products and services;
(9) the mechanism for accounting for the operating institution’s operating costs and revenues within the scope of the authorization, and the revenue-distribution mechanism;
(10) data security and personal information protection measures and emergency-response measures;
(11) the rights and obligations of the implementing institution, the operating institution and the other participants;
(12) the supervision and administration and assessment and evaluation requirements for the authorized operation;
(13) other matters that should be specified.
Article 13. The implementation plan shall be implemented after deliberation and approval in accordance with the requirements of the “three majors and one large” decision-making mechanism of the people’s government at the same level. Within 10 working days after approval, the data administration department shall file it level by level with the provincial data administration department for the record.
An approved implementation plan shall not be changed at will. Where an adjustment is genuinely necessary because of a major change in the application scenarios, the scale of public data resources, the selection criteria for operating institutions, the accounting mechanism for operating costs and revenues, the revenue-distribution mechanism or the like, it shall be re-submitted for approval in accordance with the prescribed procedures.
Article 14. The aggregation and governance, confirmation and registration of rights, and compliance certification of public data resources shall be organized and implemented by the data administration department or by a public institution undertaking the relevant data functions. The cleansing, de-identification, declassification or primary processing of public data resources may, on the principle of “whoever commissions pays,” be entrusted to a qualified institution selected in an open, fair and impartial manner, and the relevant content shall be set out in the implementation plan.
Where the services of a third-party professional service institution are needed, the public resources trading center shall be entrusted to select it through fair competition in accordance with laws and regulations.
Public data resources and primary-processed products included within the scope of authorized operation shall be published in list form at the public resources trading center.
Article 15. The authorized operation of public data shall adopt the scenario-based authorization model; the implementing institution shall determine the operating institution through the public resources trading center by fair-competition methods such as public tender, invited tender or negotiation, and shall implement the authorized operation on the principle of “one scenario, one authorization.”
Article 16. The implementing institution shall sign an authorized-operation agreement with the operating institution and shall in advance seek the views of the relevant industry competent departments and regulatory departments on the content of the agreement and submit it to its own “three majors and one large” decision-making mechanism for deliberation and approval.
Within 10 working days after the authorized-operation agreement is signed, the implementing institution shall file it level by level with the provincial data administration department for the record.
Article 17. The content of an agreement on the authorized operation of public data shall include:
(1) the scope of public data resources under authorized operation and the data resource catalogue;
(2) the term of operation, which in principle shall not exceed three years;
(3) the list of public data products and services to be provided and their technical standards, security review requirements and business-normativity review requirements;
(4) the technical support platform for the authorized operation of public data;
(5) ownership of assets, including ownership of software and hardware equipment and of public data products and services;
(6) requirements for the disclosure of information on the authorized operation;
(7) the requirements for accounting for the operating institution’s operating costs and revenues within the scope of the authorization, and the revenue-distribution mechanism;
(8) data security and personal information protection requirements and risk-monitoring and emergency-response measures;
(9) evaluation of operating effectiveness and the renewal or exit mechanism;
(10) liability for breach;
(11) the method of dispute resolution;
(12) the conditions for amendment and termination of the agreement;
(13) other matters that need to be specified.
Article 18. On expiry of the term of authorized operation, the authorized-operation agreement terminates automatically; where authorized operation needs to continue, the operating institution shall, within three months before expiry, apply to the implementing institution to sign a new authorized-operation agreement.
Where, during the term of authorized operation, the operating institution voluntarily requests to withdraw from the authorized operation in accordance with the agreement, the authorized-operation agreement may be terminated with the consent of the implementing institution.
Chapter IV Operation of Public Data Resources
Article 19. The operating institution shall, within the scope of the authorized operation and in accordance with the requirement that “raw data does not leave the domain and data is usable but not visible,” develop and utilize the public data resources, and shall not use or covertly use the public data resources for other purposes.
The implementing institution and the operating institution shall, in accordance with the requirements for the registration and administration of public data resources, respectively register the public data resources under authorized operation and the public data products and services developed.
Article 20. In carrying out the authorized operation of public data, the operating institution shall perform the following obligations:
(1) comply with the requirements stipulated in the authorized-operation agreement and develop high-quality public data products and services;
(2) carry out the authorized operation of public data in accordance with laws and regulations, and not leak, tamper with or damage public data;
(3) establish and improve efficient security technical-protection and operation-management mechanisms for the authorized operation of public data, perform its primary responsibility for data security, strengthen internal-control, technical and personnel management, use sampled and de-identified public data for the training and validation of models for data products and services, safeguard the security of public data and personal information, and strictly guard against data security risks in the links of data processing, handling, operation and service;
(4) formulate measures to prevent the authorized operation of public data from endangering national security or the public interest or infringing personal information, trade secrets, confidential business information or the like;
(5) separately itemize and independently account for the input costs, revenues and expenditures used for public data products and services in accordance with financial management provisions, and accept supervision in accordance with law;
(6) other requirements stipulated in the authorized-operation agreement.
Article 21. Where, in the course of processing or providing services, the operating institution finds that public data resources do not meet the requirements stipulated in the authorized-operation agreement, it may submit a data-governance request to the implementing institution, which shall urge the relevant units to provide public data resources meeting the agreement within the prescribed time limit.
Article 22. The provincial data administration department shall be responsible for planning and building as a whole a province-wide unified public data platform to provide a secure and trusted space for authorized operation. Where a municipal-level platform has already been built or genuinely needs to be newly built, it shall comply with the construction standards formulated by the provincial data administration department and be brought under the supervision of the province-wide unified public data platform. In principle, no new public data platform shall be built at the county level.
The public data platform shall have functions including secure de-identification, access control, algorithmic modeling, regulatory tracing, interface management, sealing and destruction, and whole-process recording, and shall adopt the necessary security management measures and technical means to ensure that operation records are trackable, data transmission is traceable and data exports are manageable.
Article 23. The authorized operation of public data shall be conducted within the public data platform.
With the review and consent of the implementing institution, the operating institution may import enterprise data and personal information data obtained lawfully and compliantly into the public data platform for fusion computing and product development with the public data resources under authorized operation.
Article 24. Data products and services formed by the operating institution through the processing of public data under authorized operation shall undergo compliance review in accordance with the requirements of the implementing institution.
Raw data, and data products and services from which raw data can be restored through reversible models or algorithms, shall not be exported from the public data platform.
Article 25. The ownership of rights and interests in public data products and services shall comply with the relevant laws and regulations and be specified in the authorized-operation agreement; where there is a dispute over ownership that cannot be resolved by negotiation, it shall be submitted to the competent authority for handling in accordance with law.
Article 26. Data products and services formed by the operating institution through the processing of public data under authorized operation may freely enter the circulation and trading market in accordance with the relevant national and provincial provisions and the authorized-operation agreement. Trading through the provincial and municipal public resources trading centers is encouraged.
Article 27. The operating institution shall strengthen the internal management of costs, revenues and expenditures relating to public data products and services, manage the financial receipts and payments relating to public data products and services in accordance with the existing financial management system, and accept supervision in accordance with law.
Article 28. The pricing of operational public data products and services for which a charge is genuinely necessary shall be subject to government-guided pricing and shall be implemented in accordance with the relevant provisions of the national pricing authority.
This Province shall explore the establishment of a reasonable mechanism for distributing the proceeds of the authorized operation of public data between government and enterprises, distributing proceeds among the participants in the authorized operation of public data on the principle of “who invests, who contributes, who benefits.”
Chapter V Security and Supervision and Administration
Article 29. The authorized operation of public data shall implement a security responsibility system under which “whoever holds, manages, uses or operates is responsible.”
The implementing institution shall establish and improve data management systems, strengthen data governance, improve data quality, specify the security-protection requirements for the classification and grading of data, strengthen technical support and data security management, strictly prevent and control the direct entry into the market of raw public data resources included within the scope of authorized operation, and strengthen internal-control audits of the operating institution in respect of the authorized operation of public data.
The operating institution shall perform its primary responsibility for data security, strengthen internal-control, technical and personnel management, not use public data resources beyond the scope of authorization, and strictly guard against data security risks in the links of data processing, handling, operation and service.
The implementing institution and the operating institution shall, through management and technical measures, strengthen the identification and control of the risks of data association and aggregation, so as to safeguard data security.
Article 30. The data administration department shall, together with the relevant departments, establish a supervision mechanism for the authorized operation of public data and strengthen coordinated departmental supervision and routine supervision and inspection. The authorized operation of public data shall be subject to audit supervision in accordance with law.
In carrying out the authorized operation of public data, the security hazards arising from improper operations in the conversion of data into assets and the capitalization of data assets shall be effectively identified and controlled, so as to effectively prevent and defuse financial risks.
Article 31. The implementing institution shall establish a mechanism for disclosing the state of the authorized operation of public data, make the authorized operation public as required, and periodically disclose to the public the authorized parties, content, scope, time limits and other particulars, accepting public supervision.
The operating institution shall publish its list of public data products and services, periodically disclose to the public the use of public data resources, and accept public supervision.
Article 32. The operating institution shall, in accordance with the requirements of the implementing institution, report promptly on the authorized operation of public data and accept routine supervision and inspection.
The data administration department shall consolidate and review the authorized operation of public data within its administrative area and report semi-annually and annually to the people’s government at the same level and the data administration department at the next higher level.
Article 33. The implementing institution shall, together with the relevant units or by entrusting a third-party institution, periodically evaluate the operating institutions it has authorized; the evaluation results shall serve as an important basis for the termination of an operating institution’s qualification or for its re-application for authorized operation.
The operating institution shall, in accordance with the evaluation requirements, truthfully provide the relevant materials and operating information and cooperate in the evaluation; it shall not refuse, obstruct or evade evaluation, and shall not falsely report, conceal or under-report the relevant circumstances.
Article 34. The operating institution shall promptly rectify the relevant problems in accordance with the supervision, inspection and evaluation requirements of the relevant departments. The implementing institution shall urge the operating institution to complete rectification within a time limit and shall temporarily close its privileges to obtain public data resources during the rectification period.
Article 35. The implementing institution has the right unilaterally to terminate the authorized-operation agreement in any of the following circumstances:
(1) the authorized operation of public data is discontinued because of an adjustment to laws, regulations or relevant national or provincial policies;
(2) the operating institution has failed to carry out the authorized-operation activities as stipulated in the authorized-operation agreement;
(3) a data security incident, loss or leakage of secrets or similar accident has occurred in the course of the operating institution’s operations;
(4) the operating institution has failed to rectify as required the problems found in supervision, inspection and evaluation by the relevant departments;
(5) other circumstances in which the operating institution violates laws, regulations or relevant national or provincial provisions.
Article 36. Where the authorized-operation agreement is terminated, the implementing institution shall simultaneously revoke the operating institution’s privileges to call public data and shall irreversibly destroy the raw data and copies of the public data authorized for use. Data-destruction operations shall be recorded and the relevant network logs retained for not less than six months.
Within 10 working days after the termination of the authorized-operation agreement, the data administration department shall file it level by level with the provincial data administration department for the record.
Article 37. The operating institution shall carry on its business within the scope of authorization in accordance with laws and regulations; it shall not abuse administrative power or a dominant market position to exclude or restrict competition, shall not use advantages in data, algorithms, technology or capital to engage in monopolistic conduct, and shall not engage in acts of unfair competition.
Article 38. The implementing institution, the operating institution and other relevant departments shall strengthen the management of electronic documents relating to the authorized operation of public data, reasonably determine retention periods and the scope of archiving in accordance with law, and archive promptly in accordance with archival management requirements, except as otherwise provided by laws and regulations.
Article 39. No unit shall, in violation of these Measures, carry out the authorized operation of public data without authorization, or directly or indirectly obtain rights and interests relating to public data by way of cooperative development or entrusted development of information systems, the provision of data-governance services, or other means.
Where the authorized operation of public data is carried out in violation of laws, regulations or relevant national or provincial provisions, the competent authority shall deal with it in accordance with laws and regulations.
Chapter VI Supplementary Provisions
Article 40. These Measures shall come into force on February 1, 2025 and shall be valid for two years.