元规制模式下的数据保护与算法规制——以欧盟《通用数据保护条例》为研究样本

Data Protection and Algorithms Regulation Basing on the Mode of Meta-Regulation: Taking EU General Data Protection Regulation as a Sample

算法和数据保护之间形成了互相掣肘又互相促进的复杂关系,实际体现了科技与法律的互动关系。算法技术的突破加剧权力失衡和技术风险,导致个人权利实现效果不彰。个人法益保护有赖强化数据控制者责任。在监管机构缺乏必要资源或信息时,适宜采用元规制模式,即通过正反面激励,促使数据控制者本身针对问题做出自我规制式回应。这种模式切实体现在欧盟数据保护改革中。在检讨GDPR第22条算法条款的基础上,应发展数据控制者自我治理机制予以补足。在透明度原则和问责原则指引下,数据控制者有义务通过数据保护影响评估、经设计的数据保护等工具,构建完备的算法审查机制;同时通过革新算法解释方法矫正权力失衡,为个人权利救济提供保障。

The algorithm and the data protection form a complex relationship that mutually restrains and promotes each other, which reflects the interaction between technology and law. Breakthroughs in algorithmic technology have exacerbated power imbalances and technical risks, making the individual rights-approach ineffective. Personal legal protection depends on strengthening the responsibility of data controllers. When the regulator lacks the necessary resources or information ,it is appropriate to adopt the meta-regulation model. Through positive and negative incentives, the data controllers themselves should make self-regulatory responses to the problems. This model is reflected in the EU data protection reform. Based on reviewing the Article 22 which is called algorithm clause of GDPR, the data controller self-governance mechanism should be developed to complement. Under the guidance of transparency and accountability principle, data controllers are obliged to construct a complete algorithmic review mechanism through tools such as data protection impact assessment and data protection by design. At the same time, innovative algorithmic interpretation methods could help correct power imbalances and guarantee the personal relief.