论个人生物识别信息应用风险的监管构造

On the Regulatory Structure of the Application Risk of Personal Biometric Information

以人脸识别信息为代表的个人生物识别信息的应用场景日益泛化,隐藏着诸多个人权益侵害风险与社会风险,亟待政府进行有效监管。然而现有的行政监管存在困境,表现为监管依据缺乏针对性与体系性、监管机构分散化、监管措施有限性等问题。为实现对个人生物识别信息应用风险的有效监管,在监管依据方面,应采用实验性立法模式形成中央——地方协同的立法格局,以行为规范为重点确立监管规则内容。在监管主体方面,探索建立独立的信息监管机构,并激励信息处理者建立内部治理结构进行辅助,以形成双层治理结构。在监管措施方面,秉持风险预防理念,运用事前审查机制确立监管底线,综合运用强制命令型监管手段与激励诱导型监管手段,考量多元要素进行差异化监管,通过评估反馈机制对监管措施进行调整,实现贯穿个人生物识别信息生命周期的动态风险监管。

At present,the application scenarios of personal biometric information are becoming more and more extensive,and there are many risks of personal rights and interests infringement and social risks,which need to be effectively supervised by the government.There are some difficulties in the existing administrative supervision system,such as the lack of a specific and systematic regulation,the decentralization of regulatory agencies,and the limited regulatory means.In order to realize the effective supervision of the application of personal biometric information,the experimental legislative mode can be adopted to form a legislative pattern to coordinate between central and local levels,and the content of regulatory rules should be established with the focus on the code of conduct.In the aspect of supervision subject,we should explore the establishment of independent information supervision organization,and encourage information controllers to establish internal governance structure for assistance,so as to form a double-layer governance subject structure.In terms of regulatory measures,we should adhere to the concept of risk prevention,establish the regulatory bottom line by using the prior review mechanism,comprehensively use the mandatory regulatory means and incentive regulatory means,consider multiple factors for differentiated supervision,and adjust the regulatory measures through the evaluation and feedback mechanism,so as to realize the dynamic risk supervision throughout the life cycle of personal biometric information.