敏感个人信息的法律基准与范畴界定——以《个人信息保护法》第28条第1款为中心

The Legal Attributes and Definition of Sensitive Personal Information: Centered on the First Paragraph of Article 28 of Personal Information Protection Law of PRC

《个人信息保护法》第28条第1款中敏感个人信息的"敏感"是指法律规制的高反应度,其以信息处理的权益侵害风险为法律基准,风险内容指向除个人信息权益之外的人格尊严和人身、财产权利,风险程度则以达到"一般权益侵害程度+更高风险兑现概率"为必要。敏感个人信息的界定应采取场景抽离和场景融入双重路径。场景抽离关注作为内因的信息内容,内容具有强工具性和唯一识别性的个人信息为敏感个人信息;场景融入关注作为外因的场景要素,信息处理者的认知能力、信息应用能力及信息存在状态是改变信息内容属性的主要场景要素,可以促成敏感个人信息的转化。因未成年人信息控制能力弱、信息暴露程度高,立法将其个人信息归入敏感个人信息具有合理性。第28条第1款列举的各项信息具有涵括性,不能直接作为敏感个人信息的认定依据,是否属于敏感个人信息仍须进行具体判定。

The sensitivity of sensitive personal information refers to the high responsiveness regulated by law, which is measured by the risk of infringement of rights in the processing information. Its definition should take a dual path of de-contextualization and contextualization. Its scope shall be defined by referring on the one hand to the de-contextualized information content itself, and on the other hand to the external factors that constitute the elements of the scene in the context, for the general personal information can be transformed into sensitive ones when it is contextualized to produce strong instrumentality and unique identification.