经设计的个人信息保护机制研究  

Reseach on Designed Personal Information Protection Mechanism

作　　者：张继红 Zhang Jihong

机构地区：[1]上海政法学院,上海201701

出　　处：《法律科学（西北政法大学学报）》2022年第3期31-43,共13页Science of Law：Journal of Northwest University of Political Science and Law

基　　金：国家社科基金项目(21BFX094)“互联网企业数据合规义务研究”。

摘　　要：技术与法律分别属于网络空间与现实空间的规制工具。随着数字空间的不断拓展,以个人控制与行为规制为核心的个人信息保护法律规范模式面临困境。技术标准因其弹性、灵活性发挥了及时的补充作用,但其自身的弱规范性难以得到推广和遵循,技术法律化成为一种新的立法趋势。欧盟GDPR第25条“经设计和默认的数据保护”作为技术法律化的典范,实现了技术标准事前预防与法律规范事后问责的有机结合,将个人信息保护原则嵌入产品设计的基础构架,弥合了技术与法律之间的鸿沟。我国立法有必要进一步明确经设计的个人信息保护规则,建立并完善问责和认证两大机制,以惩戒与激励相结合的方式实现政府、企业、个人的多元协同共治。Technology and law are regulatory tools in cyberspace and real world respectively. With the continuous extension of digital space, the inherent governance mode of personal information protection legal norms with personal control and behavior regulation as the core factors is facing difficulties. Technical standards play a timely supplementary role because of their flexibility and flexibility, but their own weak norms are difficult to be promoted and followed, so the legalization of technology has become a new legislative trend. As a model of legalization of technology, data protection by design and by default of Article 25 of the EU GDPR realizes the organic combination of prevention of technical standards and accountability of legal norms, embedding the principle of personal information protection into the basic framework of product design, bridges the gap between technical standards and legal norms. It is necessary for China to further clarify the rules of personal information protection by design in the legislation, and establish and perfect the two mechanisms of accountability and certification to realize the combination of discipline and incentive to achieve a multi-dimensional collaborative governance of the government, enterprises and individuals.

关 键 词：技术法律化 经设计的个人信息保护 问责机制 数据认证 

分 类 号：D923.49[政治法律—民商法学]