大型互联网平台企业个人信息保护独立监督机构研究

Independent Supervision Institutions for Personal Information Protection of Large Internet Platform Enterprises

个人信息保护法第58条规定了大型互联网平台企业需承担的个人信息保护特别义务,该义务来源于行政法上的第三方义务,与“基于风险的进路”的个人信息保护理念相适应。大型互联网平台企业应当健全个人信息保护合规体系,设立独立监督机构。独立监督机构的具体适用对象即大型互联网平台企业,对应的是《互联网平台分类分级指南(征求意见稿)》中的超级平台经营者与大型平台经营者。外部独立监督机构既是大型互联网平台企业公司治理的一部分,又与公司内部机构保持相对独立性,其组成人员应满足一定的资质要求。在职责范围上,外部独立监督机构需要对大型互联网平台企业个人信息保护的合规情况,以及企业对商业用户的个人信息处理活动予以规范的合规情况进行监督、指导或提出建议和意见。

Article 58 of the Personal Information Protection Law imposes special obligations on the large Internet platform enterprises to protect personal information,which is derived from the third-party obligations under administrative law,and adapts to the concept of"risk-based approach"in personal information protection.Large Internet platform enterprises should improve the personal information protection compliance system and establish an independent supervisory body.The large Internet platform enterprises,subject to the independent supervisory body,refer to the super platform operators and large platform operators based on the Internet Platform Classification and Grading Guidelines(Draft for Comments).The external independent supervisory body should be a part of the corporate governance of the large Internet platform enterprises,and maintains relative independence from the internal agencies of the company,and its composition should also meet certain qualification requirements.In terms of the scope of responsibilities,the external independent supervisory body is required to supervise,guide or make suggestions and comments on the compliance of large Internet platform enterprises in respect of personal information protection and the compliance of enterprises in respect of regulating the personal information processing activities of commercial users.