Case Study and Exploration for Legal Protection of the Rights and Interests of Credit Information Subjects Under Chinese Law

: Credit investigation report is an important social name card for individuals, enterprises and other information subjects. All kinds of wrong information in the credit investigation report will cause negative evaluation and actual losses to the information subject. Through the relevant cases analyzed by the people's court, the rights and interests protection of the subject of credit information involves the subject of credit information as a civil subject, the agency of credit information and the provider of credit information including civil and administrative subjects. It is still unclear how does the information subjects choose civil and administrative proceedings to safeguard their rights and interests. This is not only due to the imperfect legal provisions on the protection of credit information subjects in China, but also due to the uncertain boundary between the government's disclosure of personal information and personal privacy. For this, the author suggested to improve the legislation to Enhance the Responsibility of Regulatory Authorities to Protect the Rights and Interests of Information Subjects, set up the individual credit dispute arbitration mechanism host by the credit supervision authority, and participated by the information subject, credit agency, credit center or the information provider, processing the credit objections through the form of administrative arbitration.


A Series of Cases Involving Zhang Mou v. People's Bank of China D Center Branch
Zhang Mou purchased the property from the developer, and due to problem such as quality problems, advertising fraud, selling more than one house and repeated mortgages, Zhang Mou filed a lawsuit with the developer. During the trial, it was found that the developer and the staff of Bank J conspired to obtain a loan of 238,655 yuan by using the relevant information of the plaintiff in the property purchase and sale contract. And Zhang Mou inquired about the credit investigation center of the People's Bank of China and obtained a personal credit report (2011 bank version), which showed that Zhang had overdue loans that were not repaid. Zhang Mou thought that the overdue loan in the credit report was not true, so he filed an objection application and got a reply letter. It stated that Zhang Mou had loaned at Bank J was clear and the objection was invalid. Zhang Mou refused to accept the reason and filed two administrative lawsuits with the people's court where the D center branch is located. the credit report. After receiving Zhang Mou's lawsuit, the court considered that it did not belong to the scope of administrative case acceptance after examination, so it ruled that the damages dispute case of Zhang Mou was not accepted by them.

Cases for Non-fulfillment of Legal Duties Involving Zhang Mou v. D People's Bank of China D Center Branch
After the damage compensation dispute case was not accepted by court, Zhang Mou filed a lawsuit for the reasons that, D Center Sub-branch of the People's Bank of China has the function of supervising and managing the credit reporting agencies that issue personal credit reporting, and the defendant has failed to perform the corresponding functions, so he required the defendant to perform the statutory functions and punish the credit reporting agencies and revoked the credit reporting reports with errors. After hearing the trial, the court of first instance held that in prosecuting a case of failing to perform statutory duties, the plaintiff should provide evidence of its application to the defendant. Except in one of the following situations: (1) the defendant should actively perform its statutory duties according to his duties (2) the plaintiff is unable to provide it for legitimate reasons. There were no exceptions in this case, and the plaintiff failed to provide relevant evidence that required the defendant to perform statutory duties, so the plaintiff's various claims were rejected. Zhang refused to accept the appeal and instituted an appeal, and the court of second instance rejected the appeal and upheld the original verdict.

Determination of the Administrative Legal Status of Credit Supervisory and Management Authorities and Credit Reporting Agencies
Zhang once filed an administrative compensation lawsuit before filing a dispute over the performance of statutory duties, because he mixed up the credit supervisory and management authority and the credit reporting agency, and the lawsuit of the credit supervisory and management authority with the wrong information in the credit report should be a civil and commercial case according to the analysis of the nature of the claim, but it became an administrative case because the defendant was an administrative agency. In the end, the court ruled that the compensation case was not accepted. The function of credit supervision and management refers to the government's supervision and management of credit reporting industry according to relevant laws and regulations, and the institution exercising this function is called the credit supervision and management institution. Personal information has extremely high economic value in the market. While unlimited collection and abuse of personal information will inevitably lead to the disappearance of personal privacy. While blindly prohibiting the collection of personal information will affect the smooth development of social and economic life. The balance between the two cannot only rely on the credit investigation agencies with economic properties, nor can we completely rely on the weak individuals, but can only rely on a middle agency with the force of law. Major countries in the world are currently adopting government administrative-led supervision and management of the credit reporting industry. Its main responsibilities are to regulate the business behavior of credit reporting agencies, maintain the normal order of the credit reporting market, safeguard the legitimate rights and interests of both parties to credit transactions, and promote the development of credit reporting industry more standardized and healthy. The People's Bank of China and its branches are responsible for the supervision and management of credit reporting in China.
Credit reporting agencies refer to third-party agencies established in accordance with the law and independent of both parties to credit transactions, specializing in the collection, sorting, processing and analysis of corporate and personal credit information, issuing credit reports, providing diversified credit reporting services, and helping customers make judgments and control the credit risks. Credit reporting agencies are the backbone of the credit reporting market. They play a vital role in the modern market economy and are a necessary prerequisite for expanding the scale of market transactions in the context of asymmetric information. Without the social functions undertaken by credit reporting agencies, the social credit is difficult to fully play the role.
According to the nature of ownership, credit reporting agencies in various countries can be divided into public credit reporting agencies, private credit reporting agencies and hybrid credit reporting agencies. Public credit reporting agencies are represented by Germany and France, the United States is a typical private credit reporting agency model, and Japan is a typical hybrid credit reporting agency model. Nowadays, the establishment of a credit reporting agency that operates personal credit reporting business in China should meet the company establishment conditions and the following conditions stipulated in the "Company Law of the People's Republic of China", and should be approved by the credit reporting supervision and management department of the State Council: (1) The main shareholder has a good reputation and has no record of major violations of laws and regulations in the last 3 years (2) The registered capital is not less than RMB 50 million (3) It has the facilities, equipment, systems, and measures to ensure information security as required by the credit investigation supervision and management department of the State Council (4) The proposed directors, supervisors and senior managers meet the requirements stipulated in Article 8 of the regulations (5) Other prudential conditions stipulated by the credit investigation supervision and administration department of the State Council [1]. From the above regulations, the nature of my country's stipulated credit reporting agencies is closer to the US-type private organization model. In reality, the main body responsible for issuing personal credit report in China is the Credit Information Center of the People's Bank of China, which is a self-supporting business legal person directly under the People's Bank of China.
In 1997, Shanghai launched a pilot program for corporate credit rating in accordance with the instructions of Zhu Rongji,  [3] to grant the People's Bank of China the responsibility of "managing the credit reporting industry and promoting the establishment of a social credit system" and approved the establishment of a credit reporting administration. In the following two years, the People's Bank of China respectively built or completed the national centralized and unified personal credit information basic database and enterprise credit information basic database. In March 2006, the People's Bank of China established the People's Bank of China Credit Information Center, as a directly affiliated institution for the construction, operation and maintenance of corporate and personal credit reporting systems. In May 2008, the Credit Information Center officially held a listing ceremony in Shanghai, and its registration place is Pudong New District, Shanghai. The credit reporting center has been built into the world's largest basic database of credit information with the largest number of people, comprehensive information collection, coverage and wide use. It has basically established a credit file for every domestic enterprise and individual with credit activities. It takes bank credit information as the core, and also includes public information such as social security, provident funds, environmental protection, tax arrears, civil rulings and enforcement. It also accessed with various lending institutions such as commercial banks, rural credit cooperatives, trust companies, finance companies, auto finance companies, and small loan companies; The information query port of the credit investigation system is spread all over the country's financial institutions, and the credit information service network covers the whole country. The credit reporting center has credit reporting sub-centers in 31 provinces and 5 separate cities across the country.
[4] In March 2013, the "Regulations on the Administration of the Credit Investigation Industry" was formally implemented. According to the requirement that the state establishes the basic database of financial credit information, and the professional operation organization which is not for profit and supervised and managed by the credit supervision and administration department of the State Council is responsible for the construction, operation and maintenance of the database, the Credit Information Center of the People's Bank of China has become the professional operation organization of the basic database of financial credit information.
In summary, the People's Bank of my country is the administrative department that performs the supervision and management responsibilities of the credit investigation industry in China, and it has the status of the administrative subject under the administrative law, while the People's Bank of China Credit Information Center is a professional operating institution of my country's financial information basic database, which is a public institution legal person. It does not perform the administrative functions authorized by the law and does not have the status of the administrative subject in administrative law. Therefore, Zhang regarded the D Center Branch of the People's Bank of China as the defendant to file civil damages compensation, but the court ruled not to accepted. Zhang Mou also regards the information objection raised by the Credit Information Center as an application to the D Center Sub-branch of the People's Bank of China for fulfilling the statutory supervision and management duties, which led to the result that his application was rejected by the court.

The Legal Status of Each Subject in the Credit Reporting Activities
Credit reporting activities usually include credit reporting agencies [5], information providers, information users and information subjects. It usually includes four subjects. Credit reporting agencies have already explained in the above paragraph, and information users are generally not involved in the collection of credit reporting information errors, so this paragraph will not discuss on the two subjects.

Information Provider
Information providers refer to two types, banking institutions and non-banking institutions. The latter usually includes government departments, public institutions and others. These institutions often obtain the information of the information subject for some reason in the course of performing their statutory duties or conducting their own business, and thus may be the providers of personal information. According to the official introduction of the Credit Information Center, at present, there are other personal information besides non-bank financial information in the basic database of enterprise and personal credit information in China, such as social security, environmental protection, tax arrears, court enforcement ruling and other documents. While the credit database of Shanghai Credit Information Company also includes basic personal identity information, payment records of mobile communication protocol users, payment records of some public utility fees, and the information on the execution of economic cases and effective criminal conviction in Shanghai provided by Shanghai Higher People's Court [6]; Information user refers to an organization that obtains the credit information of the information subject from the credit reporting agency in order to know the credit status of the information subject. [7]

Information Subject
In the entire credit reporting activities, the information subject is often in a weak and passive position, is the initial source of information obtained by the credit investigation agency, the object of information obtained by the information provider, and the individual of the personal information held by the information user. The credit activity is a dynamic process in which the information flow undergoes a linear flow, it includes three stages: in the first stage, as the main body of information, individuals or enterprises bring their own information to various social departments through economic and social activities. In the second stage, information providers provide the information obtained in their management and operations to credit reporting agencies; in the third stage, the credit reporting agency processes, adjusts and screens the collected information provided by the information providers, and finally generates credit reports and other related credit reporting products, and provides them to the information users.
In summary, we believe that the subjects of credit reporting activities include various civil legal subjects such as individuals and enterprises as information subjects; commercial banks as information providers; as credit reporting agencies that collect and process credit reporting information also include various administrative entities, such as the People's Bank of China as a credit reporting management agency; as the administrative agencies such as government as an information provider, institutions that perform public management functions, and others. According to this, they have produced various activities that overlap between administrative and civil legal relations.

Types of Administrative and Civil
Legal Disputes Among the Subject in the Credit Reporting Activities

The Civil and Administrative Legal Relationship Between the Information Subject and the Information Provider
Disputes between information subjects and civil subjects as information providers such as commercial banks due to credit reporting activities are generally brought to the court through cases such as reputation rights and goodwill rights. For example, in 2015, the court in the city of S province and L city heard a dispute between Guan Mou and Yong Mou suing a certain city credit cooperative and a branch of the People's Bank of China.
[8]In the case, the two plaintiffs stated that they were husband and wife, and they provided guarantees for a loan applied by the outsider to the defendant's cooperation 10 years ago. Later, the loan contract was not performed for some reason, and the cooperative never asked the plaintiff to perform guarantee obligation. In 2014, the cooperative reported the loan to the Credit Information Center of the People's Bank of China [9]for no reason. As a result, the highest mortgage contract signed by the plaintiff at another bank could not be fulfilled. It could only rely on high-interest loans to maintain daily life and business operations. The plaintiff's credibility and reputation were degraded, and the two parties divorced. The plaintiff believed that the related losses suffered by the defendant were caused by the reporting behavior of the defendant's cooperative, and the People's Bank of China, as the credit information production agency, was also responsible for this. Therefore, the two defendants were sued to the court and demanded that the two defendants revoke the information, compensate 100,000 yuan for mental losses and 1 million yuan for direct losses caused by infringement, and pay monthly interest losses caused by the failure to perform the maximum mortgage contract. After hearing the trial, the court of first instance held that the cooperative was at fault in reporting the above-mentioned information to the Credit Information Center, which caused damage to the plaintiff's reputation and should be eliminated. This information was not the only factor leading to the divorce of the two plaintiffs, nor it did not cause the plaintiff's external borrowing losses. Therefore, the plaintiff's request for compensation for mental damage and other damages is not supported. The certain branch of the People's Bank of China is not a credit reporting agency, information provider, or information user and should not be held responsible. After the judgment of the first instance, the two plaintiffs appealed against their dissatisfaction. After the court of second instance, the court of second instance found that the defendant cooperative's reporting of the loan was improper and should be revoked. The act also caused actual damage to the plaintiff's reputation, so the cooperative was ordered to revoke the information and compensate for mental distress compensations 5000 yuan.
The disputes caused by the information subject and the government agencies providing the information subject or the institutions performing public management functions, whether should be handled through administrative reconsideration, administrative litigation or the modification of credit information in administrative processing should remain to be clarified.
The author believes that the revocation lawsuit is the most important and basic type of lawsuit in administrative litigation. Revocation of litigation refers to the type of administrative litigation in which citizens, legal persons, or other organizations believe that an act of public power violates the law and infringes their legitimate rights and interests and request the court to revoke the act. It forms rights by repealing the public power act of setting a burden for the plaintiff,[10] therefore it is also a form of litigation. Generally, the public power behavior reviewed by the court in the revocation proceedings is a unilateral punishment decision of the administrative agency, not an administrative contract or a factual act. Revocation is actually the minimum requirement for the handling of administrative cases by the people's courts. At the same time, revocation of litigation is a natural and most important means of remedy. Unless expressly forbidden by law, it does not need provision of law. For example, the French Supreme Administrative Court believes that the provisions of the law that exclude all complaints cannot deprive the parties of the right to initiate a revocation action (ultra power action).
[11] Dismissal litigation is the most important and basic type of administrative litigation.
Administrative subject report the illegal activities of information subjects to the credit investigation system, which has been used as an administrative warning measure by more and more administrative agencies. Therefore, while at the same time correcting the wrong administrative actions through administrative litigation or administrative reconsideration, in order to avoid the burden of litigation, it conforms with the interests of all parties to order the administrative agency to withdraw the wrong information in the credit investigation system.

The Relationship Between the Information Subject and the Credit Reporting Agency
The credit reporting agency should be a civil subject as mentioned above. Disputes between the information subject and the credit reporting agency should within the scope of civil disputes. The credit reporting agency collects information from the information provider and prepares a credit reporting report. At present, the law does not review the authenticity of information content by credit reporting agencies. Therefore, it remains to be clarified whether credit reporting agencies should be held responsible for the loss of information subjects caused by incorrect information in the report.
The author believes that the credit reporting agency acts as the producer of the credit reporting report, and when the information subject is also the information user, the credit reporting agency only bears the contractual obligation to provide a credit reporting report based on the collected information. As long as the information provided is consistent with the information obtained from the information provider, and the information user is provided with credit reporting services as required by the contract, it should be deemed to have completed the credit reporting contract obligations and should not be liable for breach of contract due to information errors.
In the case where the information subject infringes on its reputation and other civil rights and interests by providing wrong information by the credit reporting agency, the author believes that the wrong information is only generated by the credit reporting agency or input by mistake or the information provider submits to the credit reporting agency to correct the wrong information and credit reporting, only when the agency fails to deal with it in a timely manner, such as when the credit investigation agency is obviously at fault for causing the information subject, it should bear civil liability to the information subject.

The Relationship Between Information Subjects, Information Providers and Credit Reporting Agencies
Just as mentioned in the case in this section, the current rights protection of information subjects is mainly achieved through a civil lawsuit with the information provider, requiring them to revoke the relevant credit information, but it ignores that the producer of the credit report is not the information provider. Whether the civil liability of the information provider should be imposed on the credit reporting agency, whether the credit reporting agency has a statutory obligation to delete the credit information on which time and through what manner, and what responsibility it should bear for refusing to delete the information are not clearly stipulated. The current civil entities of credit reporting agencies only exist in the relevant laws and regulations, while most of the agencies that actually engage in personal credit reporting business are official or semi-official in nature. It seems that whether the lawsuits of these credit reporting agencies are of course a civil lawsuit is still questionable point. However, when the information subject sues both the administrative organ as the information provider and the credit reporting agency, there are no relevant laws and regulations to be quoted involved the nature of the litigation.

The Legal Regulations on the Scope of Information Collection of Credit Investigation Subjects Are Not Complete
At present, the regulations on the scope of information collection of credit investigation subjects can be found in administrative regulations, departmental regulations and local government regulations in our country. At the level of administrative regulations, the "Regulations on the Management of Credit Reporting Industry" formulated by the State Council is the most important and core regulation in the field of credit investigation at present. Its introduction provides a legal basis for the protection of the rights and interests of the subject of personal credit information, but the content stipulated in the Regulations is relatively macro. The "personal religious belief, gene, fingerprint, blood type, disease and medical history information" is strictly prohibited to be collected by credit investigation agencies only by means of prohibited enumeration. In the real life, there are usually some sensitive information for individuals, which often involve personal privacy and easily infringe on the subject of personal information to varying degrees. It plays an important role in the accurate assessment of personal credit status, but is insufficient to standardize the collection, processing and dealing of such information and legislation of samples mode. Credit information is the object of the protection of the rights and interests of the personal information subject. But the protection of the rights and interests of the information subject should not ignore the protection of the credit information of the information subject itself, such as the accuracy and timely update of information, information processing standards and rating standards, so the protection of the rights and interests of information subjects is inseparable from the protection of credit information. The regulation and protection of credit information itself still need further protection. Among the departmental regulations, the People's Bank of China promulgated the "Interim Measures for the Management of Basic Personal Credit Information Databases" on August 18, 2005, which mechanically implement evaluation standards for records of negative information regardless of circumstances.
In the local government regulations, Shanghai issued the "Shanghai Municipal Personal Credit Information Management Trial Measures" in 2003. The method limits the collection scope of personal credit information, including the information that requires the permission of the person being credited and the information that is prohibited from being collected. The scope of personal credit information that can be collected by credit reporting agencies includes: the information used to identify identity and reflect the basic situation of individuals, credit information between individuals and financial institutions, and personal credit information generated by credit relationship between individuals and housing provident fund management centers, the arrears and payment information between individuals and public service providers due to credit purchases, administrative agencies, public records and other information related to personal credit during the exercise of its powers. The measures also stipulate some personal credit information that can be collected without permission. For example: bad credit information formed in economic activities, records of intermediary service practitioners being punished by industry organizations for violating the principle of good faith, the public records formed by the administrative and judicial organs in the process of exercising their functions and powers can be consulted by the public, and public personal credit information.
[12] In a certain degree, these regulations constitute an infringement of the right to know the personal credit information subject. The information subject is recorded by the credit agency without knowing the bad information, which will have a great impact on future credit transactions. The big impact is also the risk of litigation for credit reporting agencies.
Shenzhen Municipal People's Government promulgated the "Shenzhen Measures for the Administration of Personal Credit Investigation and Credit Rating" in December 2001. This approach is the introduction of relatively early local government regulations, which stipulate the establishment of credit reporting agencies, the scope of personal credit information, the collection and rating of personal credit information, and the scope of use of personal credit information rating reports. Among them, the scope of personal credit information is limited to four aspects: The first is about personal identity, the second is commercial credit records, the third is social public information records, and the fourth is special records, such as those involving court decisions and administrative penalties. [13]

Disclosure of Government Information and Protection of the Privacy of Information Subjects
The difference between "information" and "privacy" is that each has an independent extension and connotation. The main difference between the two words is that personal privacy is only a certain part of personal information, and the two express an inclusive relationship. From the legislative concept of privacy, the object of the law to be protected is only the personal privacy contained in the personal information. But in practice, the law wants to protect the personal information in a certain situation, which contains personal privacy, but not all. We know that "identification" is the legal objective element of personal information, [14] which can directly or indirectly complete the selection and shaping of information parties, and ultimately achieve screening status. [15] For example, the German "Federal Personal Information Protection Act" and the French "Information Protection Act" of 1978 adopt this kind of regulation. Therefore, the simple alternative to using personal information or private information is a conceptual confusion. Because the personal privacy information of the conceptual extension of the situation will also change. [16] The prohibition of illegal spying and disclosure of personal privacy is the essence of privacy protection. Therefore, "privacy" and "hidden" are the two most basic characteristics of the right to privacy, thus drawing a dividing line between personal information and private information, that is, "whether it can be disclosed". [16] The third type of exceptional information stipulated in my country's "Regulations on Disclosure of Government Information" involves personal privacy. When the "Regulations on Disclosure of Government Information" was drafted, a personnel tried to enumerate the types of personal privacy. However, most experts and comrades in relevant units believe that, in my country, it is currently difficult to find a clear definition of the right to privacy, whether it is in laws or judicial interpretations. [17] Therefore, the judicial interpretation to enumerate this lacks a legislative basis, and it is also difficult to enumerate comprehensively. In such cases, it is necessary to refer to some relevant foreign legislation. As mentioned in Japan's Personal Information Protection Law, "personal information" refers to the part of information related to living individuals that identifies a specific individual because it contains name, date of birth and other contents. [17] In addition, some countries also have relatively clear regulations on the specific content of privacy rights. For example, in the judicial practice of the United States, the following information is subject to privacy protection ： birth date, physical health status, marital status, legality of child status, religious belief, welfare, social insurance number, nationality status, sexual orientation, criminal history and others. [17] According to the opinions of the French Committee for Access to Administrative Documents, the information that belongs to personal privacy includes: basic personal information, such as date of birth, address, telephone number, and nationality; family information, such as marriage and family burden, kinship; other useful information, including bank account, education and occupation, motor vehicle license number, income, and social security and anxious situations. [18] In summary, although personal privacy exists as a subordinate concept of personal information. However, the freedom of private life as an independent freedom of value should be mainly through the establishment of a special privacy law to clarify the protection scope of the privacy right in the administrative law, and to set the specific boundary of the privacy right for the administrative power. Therefore, the establishment of a privacy law is the first thing. Only in this way can the government start with the protection of personal privacy information to restrict its administrative power.

Legislation to Enhance the Responsibility of Regulatory Authorities to Protect the Rights and Interests of Information Subjects
The necessary prerequisite for personal credit reporting activities is to realize the full sharing of personal credit information. Personal information is inseparable from its privacy. A core feature of the content of information privacy rights is that individuals have the right to control their own information. Personal information is private to a certain extent. Personal information is private information that they don't want to make public. No matter whether the information has economic value or not, it is a manifestation of personality interests. In addition, from the perspective of the infringement of the rights and interests of information subjects, the disclosure of personal information is also an important form of expression. But currently, our country lacks the protection of the basic law in terms of personal information security, and the basic principles, procedures and systems that should be followed in the collection, storage, processing and use of personal information lack a unified framework. We should attach importance to the legal protection of personal information, clarify the rights enjoyed by the subject of personal information, and strengthen the responsibility of credit supervision and management agencies in the protection of personal information, further refining the information subject's administrative remedy procedures for credit reporting agencies that infringe on the legitimate rights and interests of the information subject when collecting, storing, using, and providing personal information to the outside world. In the legal construction of personal information protection, the first thing is to clarify the rights enjoyed by the information subject. And from another perspective, this is also the obligation of credit reporting agencies, and it is also the main content of supervision by regulatory agencies. The experience obtained by the European Union, with a relatively complete in personal information protection is that information subjects should enjoy the following rights: individuals can decide whether the information is collected, processed, and used by the credit reporting agency, as well as the purpose, scope of the collection of information by the credit reporting agency, and the right to use and process in what way; individuals can inquire about my personal credit information and its processing in the credit reporting agency, and have the right to request appropriate changes and deletions. When the credit reporting agency violates the regulations on the protection of financial information and the customer's rights and interests are harmed, the customer has the right to demand the credit reporting agency to bear the liability for damages, unless the credit reporting agency can prove that it is not at fault.
The credit reporting agency should legally collect and process personal credit information, and should inform the parties for the information processing; The credit reporting agency should adopt corresponding technical means and organizational measures to ensure the confidentiality and security of information processing, and accept the supervision of information processing by supervisory agencies; The credit reporting agency are obliged to keep confidential to the personal credit information they hold, and without the individual's permission, they should not disclose their credit information, especially sensitive information. The disclosure of sensitive information must be permitted by the information subject. Of course, there should be specific definitions of sensitive information in the personal information protection law. At the same time, in order to enable credit reporting agencies to operate healthily and maximize their role in economic development, it should be clearly stipulated that credit reporting agencies enjoy the right to exempt confidentiality obligations for the purpose of safeguarding national interests and social public interests. For example: situations that can be exempted clearly in legal provisions; situations that are expressly authorized and agreed by the information subject; situations that are required to maintain national security or social public interest. In order to protect the interests of the information subject. Under the existing regulatory system of our country, it is necessary to establish a department specifically responsible for monitoring the protection of personal credit information. The supervisory authority should perform the following specific duties: Establish norms and standards for the protection of personal credit information, and promote the establishment of systems and mechanisms for personal information protection by credit reporting agencies; Conduct on-site inspections and off-site monitoring for the personal credit information protection of credit reporting agencies; Supervise credit reporting agencies to strengthen the management of the information security system, standardize the management of personal credit reporting information databases, and prevent the abuse of information; For violation behavior of the credit agency's individual credit information disclosure of the information subject, should be given punishment and taken regulatory measures according to the specific circumstances.

Establish an Administrative Objection Arbitration Mechanism of Personal Credit Investigation to Protect the Information Subject's Right of Relief
The administrative regulations stipulate that the information subject can raise objections to the information in the credit report, and complain to the credit management department if they are dissatisfied with the handling of the objection. However, there are no clear regulations on the specific procedures for complaints. The handling of complaints about dissatisfaction with the handling of objections is still in a mysterious state that is not known to strangers. This situation is not conducive to the establishment of credibility of administrative agencies, and it is also not conducive to the legal protection of individual rights. Therefore, the establishment of an arbitration mechanism for individual credit reporting objections hosted by the credit reporting supervisory authority and jointly participated by the information subjects, credit reporting agencies, credit reporting centers or information providers. Due to the unique form of arbitration, it can not only accommodate civil and administrative content, but also resolve individual credit disputes objectively, impartially, and efficiently.

Subject of Credit Information Protection and Their Mutual Legal Relations
The subject of credit information protection includes information subject, information provider, credit investigation agency and credit investigation management agency. Generally, the information subject is civil subject, and the information provider contains both civil subject and administrative subject. Although the main credit investigation agency is established by administrative organs, it still belongs to civil subject. The People's Bank of China is the credit investigation supervision and management institution in China. The legal relationship between the subjects constitutes the civil, administrative and interwoven legal relations.
The disputes between information subjects and information providers belonging to civil subjects should be regulated by civil laws. But whether the dispute between the information subject and the administrative organ as the information provider should be regulated by civil law or administrative law is not clear. The author thinks that this kind of disputes can be dealt according to administrative revocation. Whether the credit reporting agency should be bound by the above-mentioned dispute judgment between the information subject and the information provider is still need to be clarified.
As the producer of the credit report, the information collected by the credit reporting agency comes from the information provider, and the information provider should bear the responsibility for the damage caused to the information subject due to the wrong information reported. Credit reporting agencies should only bear civil liability for the infringement of information subject caused by their own faults.

China's Credit Subject Legal Norms Are Not Complete
At present, the provisions on the scope of information collection of credit reporting subjects in China can be found in the administrative regulations, departmental rules and local government rules. The State Council has formulated the "Regulations on the Administration of Credit Industry" as an administrative regulation, the People's Bank of China has formulated the "Interim Measures for the Administration of Basic Database of Personal Credit Information" as a departmental regulation, Shanghai and Shenzhen also formulated the "Trial Measures for the Administration of Personal Credit Information in Shanghai" and "Measures for the Administration of Personal Credit Information and Credit Rating in Shenzhen". The above regulations mainly stipulate the administrative management of credit reporting activities, but lack of relevant provisions on the protection of credit reporting subjects.

The Scope of Personal Privacy and Personal Information That Can Be Publicized by Administrative Organs Is Not Clear
The "Provisions on the Disclosure of Government Information" stipulates that personal privacy should not be publicized, but the scope of personal privacy is not clear. Personal privacy is a part of the personal information. How to separate personal privacy from personal information and not disclose it. The author thinks that we should establish a special privacy law to clarify the scope of protection of privacy in administrative law, and set specific boundaries of privacy for administrative power.

Legislation to Strengthen the Responsibility of Credit Supervision and Management Institutions to Protect the Rights and Interests of the Information Subjects
Personal credit reporting activities should balance the sharing of personal credit information with the protection of personal privacy, and ensure the correctness of personal credit information. In China, we should improve the legislation of personal credit information protection and strengthen the supervision mechanism of personal credit information. And set up a department responsible for supervising the protection of personal credit information, and the supervision department should perform the following specific duties: establish norms and standards for personal credit information protection, and promote credit reporting agencies to establish systems and mechanisms for personal information protection; conduct on-site inspection and off-site monitoring of personal credit information protection work of credit reporting agencies; urge the credit reporting agencies to strengthen the management of information security systems, standardize the management of personal credit information databases, and eliminate the abuse of information; violation of the credit information disclosure of information subject personal credit information by credit reporting agencies should be punished and taken regulatory measures according to the specific circumstances.

Establish the Arbitration Mechanism for Personal Credit Administrative Objection to Protect the Right of Relief of the Information Subject
Civil litigation and administrative litigation apply to different procedural laws. Credit disputes often involve both civil subjects and administrative subjects, thus bringing obstacles in the applicable procedure of the people's courts. The author suggests that to establish an arbitration mechanism of personal credit objection, which is presided over by the credit supervision authority and participated by the information subject and credit reporting agencies, credit reporting centers or information providers, and dealt with the credit objections through administrative arbitration. In view of the unique form of arbitration, it can not only accommodate both civil and administrative contents, but also solve personal credit disputes objectively, fairly and efficiently.