个人信息保护影响评估的程序法规制

The Procedural Law Regulation of the Impact Assessment of Individual Information Protection

个人信息保护影响评估是个人信息保护的重要预防措施,具有多重制度价值和功能。我国现行个人信息保护评估制度突出的缺陷是缺乏程序性规制。未来我国应以现行制度的实体性规则为基础,完善支撑个人信息保护影响评估实施的程序性规则,从实体法和程序法两个方面落实个人信息保护。综合我国现有法律规范和技术规范,借鉴域外有关个人隐私影响评估的程序和实施机制的经验,建议构建我国个人影响评估的程序制度和实施机制应从以下几个方面入手:新设第三方评估制度,完善评估方法以及程序,明晰评估基准,还需明确评估结果的提交、公开和监督制度以及当个人信息处理者对评估结果未予履行时的处置措施等。未来,个人信息保护整个制度都应完善程序法规制。

As an important precautionary measure of individual information protection,the impact assessment of individual information protection has multiple institutional values and functions. A prominent defect of the current Chinese individual information protection evaluation system is the lack of procedural regulation. In the future,China should prefect its procedural rules that sustain the impact assessment implementation of individual information protection,and enhance individual information protection based on both substantive law and procedural law. Proposals are made based on China’s current legal norms and technical specifications as well as foreign experience concerning individual privacy impact assessment procedure and implementation mechanism. The construction of China’s individual impact evaluation system and implementation mechanism should involve the following aspects:a new third-party evaluation system should be established;the evaluation method and procedure should be perfected;the evaluation benchmark should be determined;the system of submission,disclosure,and supervision of assessment result should be clarified;and disposal methods should be announced when the assessment result is ignored. In the future,the whole system of individual information protection should perfect its procedural law regulations.