突发公共卫生事件下的个人信息保护政策鸿沟与弥合策略

Policy Gaps and Bridging Strategies for Personal Information Protection in the Context of Public Health Emergencies

突发公共卫生事件下,公民个体暂时性让渡部分个人信息及相关权利以支持防控措施,但个人信息也因此面临着侵害风险。文章从“信息主体-事件情境-管理活动”3个维度构建了突发公共卫生事件下的个人信息保护政策分析框架,从理论层面将个人信息保护政策划分为3种类型:前瞻型、响应型与补充型;在实践层面,采集了新冠疫情期间的个人信息保护政策数据,通过聚类分析将疫情期间个人信息保护政策条款分为4类:紧急低敏采用型、紧急高敏采用型、缓和高敏退出型、持续低敏采用型。综合理论分类与实证聚类结果,发现疫情期间个人信息保护政策条款多以响应型政策为主,仅持续低敏采用型属于补充型政策范围,缺乏前瞻型政策。对比理论分类与实践聚类的差异,文章分析了个人信息保护与政策实践之间的鸿沟并提出建议。

In the context of public health emergencies,individual citizens are often required to temporarily relinquish some of their personal information rights so as to support governmental prevention and control measures,but their personal information rights might be exposed to the risk of infringement.Therefore,it is necessary to discuss the protection of personal information in emergent situations.In this paper,a framework is proposed to analyze personal information protection policies in the context of public emergencies from the three dimensions of information subject,event context and management activity.In this framework,personal information protection policies could be theoretically classified into three types,i.e.,forward-looking policies,responsive policies,and complementary policies.However,through a cluster analysis of the data related to personal information protection policies during the COVID-19 epidemic,such policies could be divided into four categories,i.e.,emergent hypo-adoption policies,emergent high-sensitivity adoption policies,moderate high-sensitivity withdrawal policies,and continuous hypo-adoption policies.Based on the theoretical classification and the cluster analysis,it is found out that most items of personal information protection policies adopted during the COVID-19epidemic are responsive,while some continuous hypo-adoption policies are complementary,and there are no forward-planning policy items at all.In view of the differences between the theoretical classification and the cluster analysis,it further makes an analysis of the gaps between the theoretical construction of personal information protection and its policy practice,and then puts forward some recommendations for the improvement of current policies.