《个人信息保护法》视域下的企业合规义务与建议

Corporate Compliance Obligations and Recommendations in the Context of the Personal Information Protection Law

在侵犯公民个人信息犯罪频发的背景下,我国《个人信息保护法》颁布实施,这意味着企业应建立个人信息合规体系,其价值主要体现在降低企业风险并减少损失,增强品牌价值和市场竞争力,主张减轻或免除企业法律责任。企业的合规义务包括但不限于制定内部管理制度和操作规程,对个人信息实行分类管理,保障信息查阅、复制、更正等权益,数据与算法的合规义务等。《个人信息保护法》要求企业重视个人信息保护合规建设,制定内部管理制度和操作规程;对个人信息分类分级进行管理;采取安全技术措施处理个人信息;加强对从业人员的管理,进行教育和培训;制定关于个人信息安全事件的应急预案。

Against the backdrop of the frequent occurrence of crimes against citizens’personal information in China,Personal Information Protection Law(PIPL)came into being.The enforcement of the PIPL means that enterprises should establish a personal information compliance system,the value of which is mainly reflected in the reduction of enterprise risks and minimization of losses,the enhancement of brand value and market competitiveness,and the assertion of mitigating or exempting enterprises from legal liabilities.The compliance obligations of enterprises include but not limited to,the establishment of internal management systems and operating procedures,the implementation of classification management of personal information,the protection of rights and interests such as access,copying,and correction of information,and the obligation of data and algorithm compliance.The PIPL has caused enterprises to emphasize compliance building for personal information protection,and this article suggests that enterprises should formulate internal management systems and operating procedures;manage personal information in a categorized and graded manner;adopt security technology measures to handle personal information;strengthen the management of practitioners,and provide education and training;and formulate contingency plans for personal information security incidents.