匿名化个人信息再识别风险的层理透视与靶向治理  

The Re-identification Risk of A nonymized Personal Information:Stratified Perspective and Targeted Governance

作　　者：汪文涵 Wang Wenhan(Law School/School of Intellectual Property,Jinan University,Guangzhou 510632,Guangdong,China)

机构地区：[1]暨南大学法学院/知识产权学院,广东广州510632

出　　处：《征信》2024年第11期50-59,共10页Credit Reference

基　　金：上海市哲学社会科学规划课题(2023BFX014)。

摘　　要：匿名规则在多数国家因个人信息的保护与利用利益的平衡而被普遍规定。实践中匿名化个人信息的再识别风险演变为打破匿名规则利益平衡的挑战。没有彻底删除标识符的匿名化个人信息无法避免再识别的可能,但既有方案关注匿名规则的体系化重塑,而在再识别风险的治理举措上缺乏针对性。从再识别风险的生成逻辑看,个人信息可识别性的场景依赖特征和匿名化信息的流通预设,使匿名化在去识别处理上呈现出相对性;算法分析聚合数据则是风险生成的诱因。通过对再识别风险的现状和缘起的透视,构建一种基于法律技术融合的靶向治理路径,包括使用风险阈值确定可接受风险水平,设定保护措施处理偶发性风险,以及通过数据共享协议明确风险控制义务。In most countries,the anonymous rules are generally stipulated to balance the protection and utilization of personal information.In practice,the re-identification risk of anonymized personal information has evolved into a challenge to break the balance of interests of anonymous rules.Anonymity without the complete deletion of identifiers cannot avoid the possibility of the re-identification of personal information,but the existing schemes focus on the systematic reshaping of anonymity rules,leading to the lack of targeted governance measures to re-identification risks.From the perspective of the generation logic of re-identification risk,the scene-dependent characteristics of personal information identification and the flow preset of anonymous information make the anonymity in the de-identification processing relative;algorithm analysis and aggregate data is the inducement of risk generation.Through the perspective of the present situation and origin of identifying risk,it builds a targeted governance path based on the fusion of legal and technology,including using the risk threshold to set an acceptable level of risks,setting protection measures to deal with accidental risks,and ensuring the obligations of controlling risks through the data sharing agreement.

关 键 词：匿名规则 个人信息 再识别风险 算法聚合 可接受风险水平 

分 类 号：DF414[政治法律—经济法学] F832.4[政治法律—法学]