个人信息的内生安全机制及其实现  

On the Inherent Security Mechanism for Personal Information and Its Realization

作　　者：崔聪聪[1] Cui Congcong

机构地区：[1]北京邮电大学法律系

出　　处：《东方法学》2024年第1期96-107,共12页Oriental Law

基　　金：国家社科基金重大项目“网络空间政策法规的翻译、研究与数据库建设”(项目批准号:20&ZD179)的阶段性研究成果。

摘　　要：个人信息处理的技术性、隐蔽性,使自上而下的“命令式”监管范式失效。数字时代,个人信息治理的重点是防止个人信息处理者滥用数据权力威胁国家安全、盘剥和操控个体。为有效控制数据权力这一风险源,国家应当督促个人信息处理者建立健全涵盖制度保障、组织程序保障的个人信息内生安全机制。通过监管激活个人信息处理者内部的自我规制机制,增强其内部的组织控制和行为规范化程度,消减个人信息处理的负外部性,实现个人信息处理的正和博弈。通过监管督促个人信息处理者强化内部治理机制,严格落实个人信息保护影响评估制度,遵从“三同步”要求将个人信息保护法规定的各项义务嵌入产品“代码”中,防控个人信息处理过程中妨害个人自主性、减损人格尊严的风险。The technical and hidden nature of personal information processing renders the top-down"commanding"regulatory paradigm ineffective.In the digital age,the focus of personal information governance is to prevent personal information processing entities from abusing data power to threaten national security,exploit and manipulate individuals.In order to effectively control the risk of data rights,the state should urge the entities to establish and improve the inherent security mechanism of personal information that covers institutional guarantees and organizational procedures.Through supervision,the internal self-regulatory mechanism of the entities is activated,their internal organizational control and behavioral standardization are enhanced,the negative externalities of personal information processing are reduced,and the positive-sum game of personal information processing is realized.Through supervision,the entities will be asked to strengthen their internal governance mechanism,strictly implement the personal information protection impact assessment system,comply with the"three-level synchronization"requirements to incorporate various obligations prescribed by the Personal Information Protection Law into the"code"of their products,so as to prevent and control the personal information processing risks that would impair personal autonomy and human dignity.

关 键 词：个人信息处理 内生安全 负外部性 正和博弈 自我规制 数据权力 

分 类 号：DF529[政治法律—民商法学]