比较法视域下科学研究处理个人数据的法律界限

Legal Boundaries of the Processing of Personal Data in Scientific Research from the Perspective of Comparative Law

在数字化时代,科学研究成为一种典型的数据应用场景。科学研究大规模处理个人数据隐含的“道德伦理问题上的非对称性”引致个人权利与公共利益之间的权益冲突。中国既有法制对于科学研究处理个人数据行为的规制呈现规范内容不一致、指向模糊、保障措施不足等问题。以《一般数据保护条例》为代表的域外法制从规范定位、可处理数据范围、目的限制原则的适用、数据主体同意的规定、数据主体权利克减、技术性与组织性保障措施等方面确立了相对完整的法律规制体系。可以考虑在《中华人民共和国个人信息保护法》中增设“科学研究”相关条款,同时,通过适当豁免研究人员的数据处理义务、附条件克减数据主体的个人权利以及调整同意模式,打造激励相容的数据处理行为要件,此外,尚需完善技术性和组织性保障措施以确保数据处理规范有序。

In the digital age, the coexistence of the value and risk of using personal data for scientific research prevails, and the key question is not whether the data should be used for research, but how to obtain the benefits of scientific research based on the basic principles of respecting ethics and privacy. In this regard, when research may bring harm to the subject of research or other relevant persons, the law needs to intervene in a timely manner and set limits for it, and this restriction itself should also abide by the provisions of the law.In spite of the promulgation of Personal Information Protection Law of the People’s Republic of China in 2021, it does not directly stipulate the purpose of "scientific research", and the regulation of scientific research behavior in China’s established legal system is in a sporadic state, far from being systematized. It does not provide clear and appropriate guidance for scientific research on the processing of personal data, whether based on the direct content of the provisions or the normative interpretation. Moreover the legal regulation of similar scientific research behaviors sometimes shows inconsistencies, and there is a lack of special data processing supervision authorities and supervision mechanisms in the legal norms.The study has the following findings. First, the legislative model for "scientific research" in most countries is to adopt the legislative path of the Basic Law positioning and supplemented by other relevant norms of a lower rank. Second, the trend of legislation is not to impose absolute restrictions on scientific research in terms of the type and scope of individuals, but to impose restrictions on data processing behavior, thereby creating a relaxed environment for scientific research. Third, the innovation of scientific research stems from its uncertainty, the discovery of new materials or the improvement of research methods will change the specific purpose of the original research. If the purpose of its data processing behavior is strictly limited, it may inhibit the vitality of scientific research, and thus the principle of unconstrained purpose has become the mainstream model of extraterritorial legislation. Fourth, the consent of the subject or alternative measures needs to be sought for personal data with legibility, and consent is not required for personal data that is not identifiable. In general, the binding force of consent is weakening in cases where the principle of limitation of purpose is exempted from application. Fifth, the extraterritorial legal system basically recognizes the derogation of personal data rights in scientific research acts, but there are different approaches in the types and degrees of derogations of derogation rights. The current consensus is that derogations from the rights of data subjects should not only comply with the statutory preconditions, but also take corresponding protective measures. Sixth, at present, the safeguards for scientific research to process personal data include both technical and organizational measures. Specific types of measures for both types of measures are still being explored.It is proposed that first the normative construction of China’s scientific research on the handling of personal data should be provided by the Personal Information Protection Law, and the special law regulating various specific research acts needs to provide more detailed rules according to their respective circumstances. Second, in terms of the assumption of the obligations of data processors, scientific researchers can receive special preferential treatment for the processing of personal data based on the consideration of public welfare expansion. Third, consent of data subjects is a developing concept, and as scientific research clarifies the data types of individuals, the precise application of tiered consent and layered consent models will highlight the effectiveness of consent. Fourth, in scientific research, absolute de-identification cannot be blindly required for different types of research, and processed data that is extremely unlikely to be identified or not harmed in the context of the current situation are acceptable, but it is still necessary to regularly assess and monitor whether there are new risks and if the technical means already taken are necessary to update and adjust. Fifth, it is necessary to improve the technical and organizational safeguards for data processing in scientific research.