数据企业的个人信息保护责任:从GDPR到中国

Data Enterprise's Responsibility for Personal Data Protection:from GDPR to China

大数据技术的冲击使得原有的个人信息保护方式已无法保障个人信息安全。欧盟近年颁布的《通用数据保护条例》摒弃了传统告知同意机制,在提供多样化个人控制手段的同时,从事前防范、事后告知、数据管理架构三方面对数据企业的个人信息保护责任做出了系统性规定。我国现行法律体系中对数据企业的个人信息保护责任仅有原则性规定,相关国家标准也存在不少局限,这些问题在将来的个人信息单独立法中应加以完善。

The impact of big data technology makes the original personal data protection mode unable to protect personal data security.The General Data Protection Regulation promulgated by the European Union in recent years abandon the traditional notification consent mechanism.While providing a variety of personal control means,the EU has systematically stipulated the personal data protection responsibility of data enterprises from three aspects:pre-prevention,post-notification and data management framework.In the current legal system of our country,there are only principled provisions on the personal data protection responsibility of data enterprises,and there are many limitations in the relevant national standards.These problems should be perfected in the future individual legislation of personal data.