作为政府工具的隐私影响评估:缘起、价值、实施与启示

Privacy Impact Assessment as A Government Tool: Origin,Value,Implementation and Enlightenment

隐私影响评估作为政府保护公民隐私的重要工具,已在西方发达国家隐私管理实践中有着二十多年的应用与发展历程。西方隐私影响评估缘起于公众隐私保护诉求和政府隐私管理需要,在特定的政府信息数据管理项目中通过识别隐私风险因素、评估隐私风险影响和制定隐私风险应对方案发挥着一系列积极作用。隐私影响评估的实施分为准备阶段、分析阶段和落实阶段。准备阶段的任务是描述评估锚定项目、选择评估执行时机、确定评估执行主体和明确评估协商对象,分析阶段的任务是描述项目信息流动、识别项目隐私风险和制定风险应对方案,落实阶段的任务是发布隐私评估报告、实施风险应对方案和持续更新评估结果。西方隐私影响评估的丰富实践给我国制定隐私影响评估指南、设置隐私影响评估机构、构建多元主体协商机制和建立隐私风险管理体系提供了重要启示。

As an important tool for the government to protect privacy of citizens,privacy impact assessment has been applied and developed for more than 20 years in the practice of privacy management in Western developed countries. Western Privacy Impact Assessment,which is based on claims of public privacy protection and needs of government privacy management,created a series of positive values in a specific government data management project by identifying factors of privacy risk,assessing privacy impact and developing response program of privacy risk. The operation of the privacy impact assessment can be divided into three stages: preparation,analysis and implementation. The task of preparation phase is to describe the evaluation project,select the timing of assessment,identify the subject of assessment and clarify the target audience to negotiate. The analysis phase involves the description of information flow,the identification of privacy risks and the formulation of response plans. And the task of implementation phase is to release the assessment reports,implement the response programs and update the results of assessment. The rich practice of Western Privacy impact assessment brings important enlightenment to China,including developing the Guide of Privacy Impact Assessment,setting up privacy impact assessment institutions,constructing a multi-subject consultation mechanism and establishing a privacy risk management system.