摘要
已公开个人信息保护应从“严进宽出”模式转向“宽进严出”模式,在此基础上,已公开个人信息处理规则的解释应被更新。所谓“宽进严出”模式,是指在信息收集上放宽对目的限制的要求,但在信息处理上强化对处理结果的控制。我国《个人信息保护法》第24条已在自动化决策场景中初步确立“宽进严出”模式,该模式在价值判断、理论准备、规则设置上亦能得到支持。“宽进严出”模式下,认定已公开个人信息处理在“合理的范围”内应降低目的限制要求,以处理结果倒推处理方式的关联性与合理性。个人信息处理者无需履行告知义务,个人信息主体行使拒绝权的时间和方式应尊重所在场景的信息处理技术特性。“对个人权益有重大影响”的评估应被置于整体风险评估中,具体为对处理结果和系统风险的评估。从“合理的范围”和“对个人权益有重大影响”中亦可推出,已公开个人信息也应“严出”。
The protection of publicly disclosed personal information should shift from a"strict in acquisition,lenient in dissemination"model to a"lenient in acquisition,strict in dissemination"model.Accordingly,the interpretation of the rules governing the processing of such information must be updated.The"lenient in acquisition,strict in dissemination"principle involves relaxing purpose limitation requirements during information collection,while tightening controls over processing outcomes and their further dissemination.Article 24 of China's Personal Information Protection Law has preliminarily established this"lenient in acquisition,strict in dis—semination"model for automated decision-making,while finding support in its value orientation,theoretical underpinnings,and rule design.Under this model,determining whether the processing of publicly disclosed personal information falls within a"reasonable scope"should lower the threshold for purpose limitation,inferring the relevance and reasonableness of processing methods from the processing outcomes.Personal information processors are not obligated to provide notification,and the timing and manner in which data subjects exercise their right to refuse should respect the technical characteristics of information processing in the given context.The assessment of whether processing has a"major impact on personal rights and interests"should be incorporated into an overall risk assessment framework,focusing specifically on processing outcomes and systemic risks.From the standards of"reasonable scope"and"major impact on personal rights and interests,"it can also be concluded that publicly disclosed personal information must be subject to"strict in dissemination"requirements.
出处
《东方法学》
北大核心
2025年第6期145-159,共15页
Oriental Law
基金
2025年度司法部法治建设与法学理论研究项目“新质生产力促进下数字人虚拟形象人格权保护问题研究”(项目批准号:25SFB3002)的阶段性研究成果。
关键词
宽进严出
择出同意
合理的范围
目的限制原则
个人拒绝权
个人信息保护
lenient in acquisition,strict in dissemination
opt-out consent
reasonable scope
purpose limitation principle
right to refuse
personal information protection
