论我国个人信息可携带权的客体范围

On the Object Scope of the Right to Personal Information Portability in China

《个人信息保护法》第45条第3款确立了个人信息可携带权,但权利客体范围尚未明确。个人信息可携带权客体范围的判断,应结合我国设立可携带权的立法初衷、数据的权属界分、关涉主体的利益平衡等因素综合考量。个人信息可携带权客体范围的具体设置上,应采取普适性规定与弹性处理相结合的方式。普适性规则下,可从“个人信息定义”“信息主体提供”“禁止损害第三方权益”等方面对可携带权的客体范围进行多层次限定,建立具有可操作性的最低标准。同时,可由个人信息控制者在最低标准的基础上拟定自治细则,报行业协会和有关部门批准后实施,并通过实践经验总结,对可携带的个人信息范围进行动态调整。

Clause 3 of Article 45 in the Personal Information Protection Law of the People’s Republic of China establishes the right to personal information portability, but does not make its object scope clear. The object scope of the right to personal information portability should be judged comprehensively by the original legislative intention of establishing the right, the ownership division of different types of personal information, the interest balance of the subjects involved, and so on. Specifically, the object scope of the right to personal information portability should be set by combining universal rules and flexible treatment. Under the universal rules, the portable object scope of the right can be limited at multiple levels from the aspects of “definition of personal information”, “provision of information subject” and “prohibition of damaging the rights and interests of the third party”, so as to establish an operable minimum standard. At the same time, personal information controller is expected to formulate specific rules on the basis of the minimum standard, which will be implemented after being approved by the industry association and relevant departments. Dynamical adjustment to the scope of portable personal information will be made after practical experience.