图书馆处理个人信息的合规义务研究

Research on the Compliance Obligations of Libraries in Handling Personal Information

[目的/意义]图书馆是数字时代重要的个人信息处理者,合规是其进行信息处理和提供服务的前提。剖析合规现状、问题与成因,可为我国图书馆合规处理个人信息提供对策。[方法/过程]通过梳理我国31个省区市图书馆的官网隐私政策、办证须知等文本内容,图书馆存在缺乏处理内容的告知、获取同意规定不一致、缺少处理儿童用户信息的专门规定、“例外情形”的合法性存疑、免责事由有无效之虞等问题。这是因为图书馆合规意识偏弱,行业组织自治作用发挥不足,合规人才稀缺。[结果/结论]采用多元主体共治模式、区分场景履行告知义务、制定处理儿童用户信息的专门规则、合理限制例外范围、厘清免责边界并且构建风险评估机制,以更好地履行图书馆的合规义务,保护用户信息权益。

[Purpose/Significance]The library is an important personal information processor in the digital age,and compliance is the prerequisite for its information processing and service provison.The analysis of its compliance status,problems and causes can provide countermeasures for compliant handling of personal information of libraries in China.[Method/Process]By analyzing the privacy policies,instructions for application of certificates and other documents on the official websites of 31 provincial and municipal libraries in China,this paper found that libraries lacked notification of processing contents,the provision of obtaining consent was not consistent,the special provision for handling information of child users was lacking,and the legality of"exceptions"was questionable and the grounds for exemptions from liability might be invalid.This is because the awareness of library compliance was generally weak,the autonomous role of industry organizations was insufficient,and compliance talents were scarce.[Result/Conclusion ] It is recommended that libraries adopt the model of joint govermance of multiple subjects,differentiate scenarios to fulfill the obligation of notification,formulate special rules for handing child user information,reasonably limit the scope of exceptions,clarify the boundaries of exemptions from liability,and build a risk assessment mechanism to better fulfill the compliance obligations of libraries and protect the rights and interests of user information.