Regulations Governing the Clearinghouse’s Plan of Security Measures for Personal Information files Article 21

The clearinghouse shall adopt the following operation management measures:1.Setting instructions for the respective operation.2.Setting rules for the use of portable storage media when computer and relevant apparatuses are used for processing personal information.3.Determining whether encryption is necessary for the storage of personal information, and if it is necessary, adopting proper encryption mechanism.4.Determining whether encryption is necessary for the transmission of personal information in terms of the mode of transmission used, and if it is necessary, adopt- ing proper encryption mechanism and verifying the information accuracy of recipient.5.Evaluating whether it is necessary to make a backup copy of personal information in accordance with the importance of information retention, and if it is necessary, saving a backup copy of such information; Determining whether encryption is necessary for the backup information, and if it is necessary, adopting proper encryption mechanism; keeping proper care of media for storing backup information and conducting restore testing regularly to ensure the validity of the backup information.6.Ensuring to properly delete information stored in the media or destroy the media physically before the media storing personal information are transferred to other people or disposed.7.Properly preserving the passwords used in authentication mechanism and encryption mechanism, and taking proper actions when it is necessary to give such passwords to other people.