with relevant law or administrative regulations and be disclosed to the public. Article 68 Where a State agency fails to perform any of its personal information protection duties prescribed in this Law, its superior agency or the authorities performing personal information protection duties will order it to make a correction; as well as impose disciplinary sanctions on any person in charge or any other individual of the agency who is directly liable for the failure. Any staff member of an authority performing personal information protection duties who commits any neglect of duty, abuse of authority, or misconduct for personal gains which does not constitute a criminal offence shall be subject to disciplinary sanctions in accordance with the law. Article 69 Where any damages are caused due to an infringement of personal information rights and interests in the processing of personal information, the infringing personal information processor if unable to prove no fault on its/his/her part shall bear tort liability, including the liability for damages. The liability for damages specified in the preceding paragraph shall be determined based on the losses incurred to the infringed individual due to the infringement, or the gains derived by the infringing personal information processor from the infringement; or the amount of damages shall be determined based on the actual situation if such losses or gains are difficult to be ascertained. Article 70 A people's procuratorate, a consumer organization as specified by law, or an organization as determined by the national cyberspace authority may legally bring a lawsuit in a people's court against a personal information processor whose processing of personal information violates this Law and infringes the rights and interests of a large number of individuals. Article 71 Any violation of this Law that constitutes a violation of public security administration shall be subject to penalty under public security administration rules in accordance with the law; and any such violation that constitutes a criminal offense shall be investigated for criminal liability in accordance with the law. Chapter VIII Supplementary Provisions Article 72 This Law does not apply to the processing of personal information by natural persons due to their personal or family affairs. Where any law provides for the processing of personal information during the statistical or archives management activities organized or conducted by a people's government at any level or a relevant department thereof, such provision shall prevail. Article 73 For the purposes of this Law, the following terms are defined as follows: 1. "Personal information processor" refers to any organization or individual that independently determines the purpose and method of processing in their activities of processing of personal information. 2."Automated decision-making" refers to an activity of conducting any analysis or assessment of the behavior and habits, interests and hobbies, financial, health or credit status or other information of an individual, as well as any decision-making automatically through a computer program. 3."De-identification" refers to the process in which any personal information is processed to the extent that it cannot identify a specific natural person without the help of additional information. 4."Anonymization" refers to the process in which any personal information is processed to the extent that it cannot identify a specific natural person and cannot be restored to its original state. Article 74 This Law shall come into force on November 1, 2021 12