作者｜白宇思
《個(gè)人信息保護(hù)法》作為中國(guó)首部個(gè)人信息保護(hù)的專門性法律，于2021年11月1日起施行，標(biāo)志著中國(guó)全面依法保護(hù)個(gè)人信息的新時(shí)代正式開(kāi)啟。至今，中國(guó)個(gè)人信息保護(hù)的配套制度逐步完善，形成了基本的框架體系，其中，個(gè)人信息保護(hù)影響評(píng)估制度成為關(guān)鍵制度之一。
*本文首發(fā)于China Business Law Journal《商法》2025年2月刊
This article was originally published in the February 2025 issue of China Business Law Journal
個(gè)人信息保護(hù)影響評(píng)估制度的內(nèi)涵與價(jià)值。中國(guó)的個(gè)人信息保護(hù)影響評(píng)估制度基于風(fēng)險(xiǎn)預(yù)防的理念，要求個(gè)人信息處理者在開(kāi)展高風(fēng)險(xiǎn)的個(gè)人信息處理活動(dòng)前，對(duì)處理目的、處理方的正當(dāng)性、合法性和必要性進(jìn)行評(píng)估，識(shí)別可能對(duì)個(gè)人權(quán)益產(chǎn)生的重大影響，并檢測(cè)監(jiān)控所采取的保護(hù)措施是否合法、有效且與風(fēng)險(xiǎn)程度相適應(yīng)。通過(guò)事前評(píng)估，處理者能提前發(fā)現(xiàn)風(fēng)險(xiǎn)并加以干預(yù)和化解，動(dòng)態(tài)應(yīng)對(duì)風(fēng)險(xiǎn)變化，并在評(píng)估報(bào)告的基礎(chǔ)上，判斷是否實(shí)施該處理活動(dòng)，以及有針對(duì)性地及時(shí)采取控制措施，合規(guī)、安全地實(shí)施該活動(dòng)。
這種早期介入的評(píng)估機(jī)制將個(gè)人信息保護(hù)納入項(xiàng)目設(shè)計(jì)階段，融入個(gè)人信息處理者的制度、業(yè)務(wù)和技術(shù)方案中，既能全面有效地保護(hù)個(gè)人信息權(quán)益，又能幫助個(gè)人信息處理者將風(fēng)險(xiǎn)控制在其承受范圍之內(nèi)，從而降低事后損失，并提升成本效益。
除風(fēng)險(xiǎn)預(yù)防價(jià)值外，在發(fā)生爭(zhēng)議時(shí)，個(gè)人信息處理者對(duì)于高風(fēng)險(xiǎn)的個(gè)人信息處理活動(dòng)進(jìn)行事前評(píng)估并加以記錄，可作為其已依據(jù)法律法規(guī)采取相應(yīng)控制措施、確保處理活動(dòng)合規(guī)與安全的證明，有助于規(guī)范處理者行為并保護(hù)其合法權(quán)益。此外，若發(fā)生個(gè)人信息泄露等安全事件，相關(guān)評(píng)估記錄能夠協(xié)助處理者開(kāi)展原因調(diào)查、分析和追蹤等工作，并降低再次發(fā)生類似風(fēng)險(xiǎn)的可能性。
個(gè)人信息保護(hù)影響評(píng)估的義務(wù)履行。《個(gè)人信息保護(hù)法》明確規(guī)定了個(gè)人信息處理者應(yīng)當(dāng)開(kāi)展個(gè)人信息保護(hù)影響評(píng)估的適用情形，包括處理敏感個(gè)人信息，利用個(gè)人信息進(jìn)行自動(dòng)化決策，委托處理個(gè)人信息、向其他個(gè)人信息處理者提供或公開(kāi)個(gè)人信息，向境外提供個(gè)人信息，以及其他可能對(duì)個(gè)人權(quán)益產(chǎn)生重大影響的個(gè)人信息處理活動(dòng)。因此，只要出現(xiàn)法律規(guī)定的評(píng)估情形，個(gè)人信息處理者就必須履行評(píng)估和記錄義務(wù)，這是其法定義務(wù)。
在實(shí)踐中，一些個(gè)人信息處理者已開(kāi)展相關(guān)評(píng)估工作并取得積極成果，但仍有大量處理者因不了解個(gè)人信息保護(hù)影響評(píng)估的功能與價(jià)值，或不知道如何開(kāi)展評(píng)估工作，而導(dǎo)致數(shù)據(jù)合規(guī)義務(wù)履行不到位。此外，隨著個(gè)人信息處理者的業(yè)務(wù)不斷發(fā)展，個(gè)人信息處理活動(dòng)往往呈現(xiàn)持續(xù)和動(dòng)態(tài)的變化。故個(gè)人信息保護(hù)影響評(píng)估義務(wù)的履行并非一蹴而就，需要建立長(zhǎng)期、持續(xù)、靈活、動(dòng)態(tài)的評(píng)估工作機(jī)制。
個(gè)人信息保護(hù)影響評(píng)估的要點(diǎn)。風(fēng)險(xiǎn)源識(shí)別是影響評(píng)估活動(dòng)的核心內(nèi)容。個(gè)人信息處理中的風(fēng)險(xiǎn)可能源自處理者自身的脆弱性，也可能來(lái)自外部威脅，如處理敏感個(gè)人信息時(shí)不具備特定目的和充分必要性、未充分履行告知同意原則、與第三方共享數(shù)據(jù)時(shí)未取得個(gè)人信息主體的明示同意、超范圍收集信息、信息存儲(chǔ)超過(guò)必要期限、刪除機(jī)制不健全、自動(dòng)化決策缺乏透明度、信息濫用、泄露、篡改等。個(gè)人信息處理者應(yīng)充分分析可能存在的風(fēng)險(xiǎn)，并設(shè)計(jì)和實(shí)施有效的控制措施以降低風(fēng)險(xiǎn)。同時(shí)，應(yīng)在項(xiàng)目設(shè)計(jì)階段將個(gè)人信息保護(hù)要求嵌入各項(xiàng)措施，確保處理活動(dòng)符合法律和行政法規(guī)。
開(kāi)展風(fēng)險(xiǎn)應(yīng)對(duì)是個(gè)人影響評(píng)估活動(dòng)的目標(biāo)。個(gè)人信息處理者應(yīng)根據(jù)評(píng)估結(jié)果及其風(fēng)險(xiǎn)承受水平，選擇風(fēng)險(xiǎn)應(yīng)對(duì)方案，如決定對(duì)某特定類型的信息不開(kāi)展處理活動(dòng)、在隱私政策或者用戶協(xié)議中明確告知處理規(guī)則并取得用戶同意、嚴(yán)格控制信息存儲(chǔ)時(shí)間并保證安全銷毀、健全用戶刪除機(jī)制、信息加密傳輸、對(duì)信息進(jìn)行匿名化、去標(biāo)識(shí)化處理、規(guī)范身份驗(yàn)證和訪問(wèn)控制等。
《個(gè)人信息保護(hù)法》規(guī)定了個(gè)人信息處理者的記錄義務(wù)。評(píng)估報(bào)告應(yīng)包含評(píng)估人員、評(píng)估適用范圍、評(píng)估對(duì)象、評(píng)估規(guī)模、評(píng)估方法、涉及的相關(guān)方等基本事項(xiàng)，以及風(fēng)險(xiǎn)分析結(jié)果、風(fēng)險(xiǎn)應(yīng)對(duì)方案和方案落實(shí)情況。
綜上，個(gè)人信息保護(hù)影響評(píng)估在個(gè)人信息保護(hù)法治體系建設(shè)及執(zhí)法框架中具有重要作用，其功能與價(jià)值對(duì)于處理者履行數(shù)據(jù)安全及合規(guī)義務(wù)意義重大。個(gè)人信息保護(hù)影響評(píng)估活動(dòng)可以充分發(fā)揮預(yù)防功能，最大限度降低個(gè)人信息處理者的風(fēng)險(xiǎn)，全面有效地保護(hù)個(gè)人信息權(quán)益。
Key points of personal information protection impact assessment
The Personal Information Protection Law (PIPL), China’s first specialised legislation on personal information protection, came into effect on 1 November 2021, marking the beginning of a new era of comprehensive legal protection for personal information in the country. Since its implementation, China has gradually improved its supporting systems for personal information protection, establishing a fundamental framework. Among these, the personal information protection impact assessment system has emerged as a critical component.
The connotation and value of the personal information protection impact assessment system. China’s personal information protection impact assessment system is rooted in the concept of risk prevention. It mandates that personal information processors conduct assessments before engaging in high-risk personal information processing activities. These assessments evaluate the purpose of processing, as well as the legitimacy, legality and necessity of the processing parties, while identifying potential significant impacts on individual rights. The system also requires monitoring and verifying whether the protective measures adopted are lawful, effective and proportionate to the level of risk. Through pre-assessment, processors can identify, intervene in and mitigate risks in advance, dynamically respond to changes in risk, and determine whether to proceed with the processing activity based on the assessment report. This enables them to implement targeted control measures promptly, ensuring the activity is carried out in a compliant and secure manner.
This early intervention assessment mechanism integrates personal information protection into the project design phase, embedding it within the systems, operations and technical solutions of personal information processors. This approach not only ensures comprehensive and effective protection of personal information rights but also helps processors control risks within manageable limits, thereby reducing potential post-incident losses and improving cost efficiency.
Beyond its risk prevention value, conducting and documenting pre-assessments of high-risk personal information processing activities can serve as evidence that processors have implemented appropriate control measures in compliance with laws and regulations. This helps regulate processor behaviour and safeguard their legitimate rights and interests in the event of disputes. Furthermore, in cases of personal information breaches or other security incidents, the assessment records can assist processors in investigating, analysing and tracing the causes, while reducing the likelihood of similar risks recurring.
Obligation to conduct personal information protection impact assessments.The PIPL explicitly outlines the circumstances under which personal information processors must conduct impact assessments. These include processing sensitive personal information, using personal information for automated decision-making, entrusting others to process personal information, providing or disclosing personal information to other processors, transferring personal information overseas, and other activities that may significantly affect individual rights. Whenever these legally prescribed scenarios arise, processors are obligated to perform and document such assessments as a statutory duty.
In practice, some processors have undertaken these assessments and achieved positive outcomes. However, many still fail to meet compliance requirements due to a lack of understanding of the purpose and value of impact assessments or uncertainty about how to conduct them. Additionally, as processors’ operations evolve, personal information processing activities often undergo continuous and dynamic changes. Therefore, fulfilling the obligation to conduct impact assessments is not a one-time task but requires the establishment of a long-term, ongoing, flexible and adaptive assessment mechanism.
Key points of personal information protection impact assessments. Risk identification is central to impact assessment activities. Risks in personal information processing may stem from the processor’s internal vulnerabilities or external threats. Examples include processing sensitive personal information without a specific purpose or sufficient necessity, failing to adhere to the principle of informed consent, sharing data with third parties without explicit consent from the data subject, collecting information beyond the required scope, storing information beyond the necessary period, lacking robust deletion mechanisms, insufficient transparency in automated decision-making, and issues such as misuse, leakage, or tampering of information. Personal information processors must thoroughly analyse potential risks, design and implement effective controls to mitigate them. Additionally, personal information protection requirements should be embedded into measures during the project design phase to ensure processing activities comply with legal and regulatory standards.
The objective of personal information protection impact assessments is to implement effective risk responses. Based on assessment results and their risk tolerance levels, personal information processors should adopt appropriate risk response measures. These may include refraining from processing certain types of information, explicitly informing users of processing rules in privacy policies or user agreements and obtaining their consent, strictly limiting data storage periods and ensuring secure destruction, establishing robust deletion mechanisms, encrypting data transmission, anonymising or de-identifying information, and standardising identity verification and access controls.
The PIPL mandates that processors maintain records of their assessments. Assessment reports must include key details such as the personnel involved, scope of application, assessment subjects, scale, methods, relevant stakeholders, risk analysis results, risk response plans, and the implementation status of these plans.
In summary, personal information protection impact assessments play a critical role in the legal framework for personal information protection. Their function and value are significant in helping processors fulfil data security and compliance obligations. These assessments serve a preventive purpose, minimising risks for processors and effectively safeguarding personal information rights.
熱門跟貼