The Cyberspace Administration of China unveiled a document on Tuesday that details draft recognition criteria to identify apps that illegally collect and use personal information.

According to the document which has been released to solicit public opinions, the app owners are only allowed to collect the personal information related to their services after obtaining the consent of users. They are obliged to keep users informed of how their personal information is to be collected and used, and are legally bound to store, handle and delete the personal information in an appropriate way according to the law.

The problem is these practices, which most apps already adhere to, as required by the Network Security Law and Regulations on Personal Information Security, have not prevented leaks of personal information and violations of privacy.

A recent survey by the China Consumers Association found that nearly 86 percent of consumers think their personal information is being misused.

The crux of the problem is that the app owners compromise the good intentions of the compulsory practices by taking advantage of legal loopholes.

For instance, the user agreements are in small characters and often so long that users simply scroll down and click "Yes, I agree", without ascertaining what it is they are agreeing to. In other words, the app businesses create a context in which the users agree to their personal information being collected and used whether that is the case or not.

Instead of highlighting these well-known problems again, the administration should have focused more on how to plug the legal loopholes, eliminating the space for such practices. This requires a change of approach.

So far the draft criteria still aim to make it harder for the app providers to steer clear of the law and regulations, which were introduced several years ago with high hopes they would be able to put an end to the illegal collection and misuse of personal information.

The administration should switch its focus from the app providers to the users, who should not only have the right to know what it is being done with their personal information, but also the right to veto it. Users should have the power to cease their contract relations instantly with the app company if they suspect their personal information is being stolen or misused by the app provider. The burden of proof should be shifted to app providers, in cases where users doubt their behavior. Doing so would prompt the app companies to make their collection and handling of the users' personal information more transparent.

By switching the focus from the app providers to the users, it would end the cat-and-mouse game that exists at present, and give users the final say over whether the personal information can be collected and how it is used.