欧盟个人数据匿名化的立法经验与启示

Legislative Experience and Enlightenment of Anonymisation of Personal Data in the EU

大数据时代来临,个人隐私与数据效用之间的张力也随之出现。数据匿名化在保护个人隐私的同时,也致力于发挥数据的最大效用。本文主要运用文献研究法对已有文献及公开资料进行分析,对欧盟个人数据匿名化的立法背景与立法内容进行考查,对欧盟个人数据匿名化引发的争议进行评析,得出对我国个人信息匿名化的启示。研究发现,欧盟个人数据匿名化是以"情境化"的个人数据概念为前提,并确立了个人数据匿名化的有效性标准,即数据控制者与任何第三方均不能通过"一切"、"可能"和"合理"的手段来识别数据主体,同时强调对匿名数据的风险评估。中国有必要借鉴欧盟的经验,完善"个人信息"的法律概念,建立个人信息匿名化之有效性标准,强化匿名信息之风险性评估。

With the advent of the era of big data, the tension between personal privacy and data utility has also emerged. Data anonymisation is also committed to maximizing the data utility while protecting personal privacy. Through the analysis of existing literature and public information,literature research method is used to examine the legislative background and content of the anonymisation of personal data in the EU, analyze the disputes it caused, and finally conclude the enlightenment for the anonymisation of personal information in China. The study found that the anonymisation of personal data in the EU is based on the concept of "contextualized" personal data and establishes the validity criteria, that is,the data controller and any third party cannot identify data subject by "every", "reasonably likely" means, while emphasizing risk assessment of anonymous data. It is necessary for China to learn from the experience of the EU, improve the legal concept of "personal information", establish the validity criteria for the anonymization of personal information, and strengthen the risk assessment of anonymous information.