社会风险控制抑或个人权益保护——理解个人信息保护法的两个维度

个人信息在《民法典》中被确认为一种人格法益,在理论和立法上确立了我国个人信息的私法保护面向。个人权益保护成为构建和理解个人信息保护的重要维度和线索。由于个人信息保护的公共目标和功能可能被个人私益保护的进路所覆盖或消解,因此有必要将社会风险控制作为个人信息保护的重要维度来对待。社会风险控制一直是电子化时代个人数据保护的基础性目的,它对于个人信息保护的相关理论和制度具有很强的解释力和动态构建作用。社会风险控制和个人权益保护两种进路在相关基础问题上出现分歧,如个人信息与隐私的基础关系、一般性保护与场景化保护以及本权与保护权的关系等。在《个人信息保护法》实施过程中,社会风险控制进路有助于合理解读和执行法律,把握风险大小与控制措施的合理匹配,以及在平衡相关立法价值的前提下,释放信息的流动性。

Social Risk Control or Protection of Individual Rights?-Two Dimensions of Interpretation of the Personal Information Protection Law

Chinese Civil Code recognizes personal information as a kind of personality legal interests, thereby establishing the private law protection orientation of personal information in theory and legislation and making the protection of personal rights and interests an important dimension of and a clue to the construction and understanding of personal information protection. Personal information protection laws around the world have sought to improve the path of personal information protection from different dimensions, and these paths are not mutually exclusive, but are all based on a major value orientation or starting point, which in turn covers all possible ways and means. At present, the public objectives and functions based on personal information protection cannot be covered or eliminated by the approach of personal private interest protection, so it is necessary to recognize social risk control as an important dimension of personal information protection. Social risk control has always been the basic objective of personal data protection in the electronic era. It has a strong explanatory power and plays the role of dynamic construction in the relevant theories and systems of personal information protection. There are contradictions between the social risk control approach and the personal rights protection approach on some basic issues, such as the basic relations between personal information and privacy, between general protection and scenarized protection, and between the right itself and the protective right. In the future implementation of the Personal Information Protection Law, the social risk control approach is conducive to reasonably interpreting and implementing the law, achieving the reasonable matching between the scale of risk and control measures, such as the matchings of different risk dimensions and corresponding restrictions for data security, data migration and facial recognition. In the meantime, the mobility of information should be released on the premise of balancing the relevant legislative values. For example, for the application scope and exclusion rules of personal information protection, the right to deletion of personal information subjects and the legitimacy basis of personal information processing, the corresponding application scopes and exclusions should be balanced according to the corresponding risk matching degrees. In short, with the development of cyber technology and its application, new risks continue to emerge, are iteratively updated along with technological development, and bring new challenges to humanity. The method of thinking and construction of risk dimension is very important in the field of personal information protection, because the law can only confirm and regulate the existence of personal information rights and interests once, and for the states of continental law system, the stability of law may conversely imply a rigidity, but the risks in the use of personal information are unpredictable or even infinite. Therefore, the thinking and institutional construction in the risk dimension is more important and worthy of attention.