识别与再识别:个人信息的概念界定与立法选择

Identification and reidentification: The definition of personal information and the legislative choice

大数据时代,数据已成为社会生产和经济发展的关键要素,个人信息在提高政府决策水平、企业精准营销、社会管理创新等方面具有巨大的潜在利用价值。纵观全球,以欧盟为代表的个人信息保护单行立法模式成为当前世界各国的主流做法。国际社会在个人信息的界定上基本形成了以可识别性为核心判定标准的共识;但个人信息界定的动态性和场景性不仅带来了司法认定上的困难,也使企业在匿名化处理问题上无所适从。充分借鉴国外立法,以加强个人信息权顶层设计为核心,通过事前同意、事中风险评估和事后个案认定机制来弥补个人信息界定的固有缺陷,是提升中国未来民法典人格权编和个人信息保护法科学性的应有之义。

In big data era,data has become a key element in social production and economic development,and there is enormous potential value in personal information in improving government decision-making,enterprise s precision marketing, innovation of social management and so on. Globally, the legislation of personal information protection law represented by the European Union has become the mainstream practice in the international community. As for the definition of personal information, the international community has basically formed an approach based on identifiability. But the dynamicity and contextual nature of the definition of personal information not only leads to the difficulty of judicial application,but also makes the enterprise not be able to deal with the problem of anonymization appropriately. In order to make up for the inherent defects of personal information definition,it is necessary to take full advantage of foreign legislation,strengthen the top-down design of personal information rights and construct a prior consent, risk evaluation and case-based mechanism, which constitute the proper meaning of promoting the rationality of civil code and personal information protection law in the future.