平台处理未成年人个人信息的合规审计分析

The Compliance Audit Analysis of Internet Platforms’Handling of Minors’Personal Information

个人信息合规审计制度是信息时代运用审计法治推进人权保障事业的重要制度设计,未成年人个人信息保护合规审计是保护未成年人个人信息权益的重要举措。目前实践中尚未形成体系化的互联网平台治理规范,落实平台履行个人信息合规审计义务的针对性、完整性和有效性规定均存在明显瑕疵,且平台自身开展个人信息合规审计的内生动力不足,外部监管也施力有限。为发挥审计法律规制效力,切实保护未成年人个人信息权益,未成年人个人信息合规审计需坚持最有利于未成年人原则。平台开展个人信息合规审计须凸显未成年人保护的特殊性,强化平台内部治理,建立健全平台个人信息保护合规激励机制,以合作监管模式赋能政企协同监管,形成全社会共同参与的未成年人个人信息保护机制。

The information age has provided convenient Internet services and the“age of first contact”for minors has become significantly younger.Therefore,the protection of the rights and interests of minors,who have already constituted an important user group for Internet enterprises,has entered a new stage.Internet platform service is a significant feature of the digital economy that distinguishes it from the traditional economy.Compared with ordinary adults,minors,as Internet users,are facing greater digital risks while enjoying digital convenience.In fact,in the context of the increasingly prominent behavioral risks of digital platforms and the growing number of underage Internet users,effective governance of Internet platforms needs to be strengthened,and the protection of the rights and interests of minors is urgent.The illegal handling of personal information is currently the main source of risk that harms the security of minors’personal information.In response to problems such as ineffective protection of minors’personal information on the Internet,the establishment of a compliance audit system has thus become an important measure to safeguard the rights and interests of minors.Personal Information Protection Law of the People’s Republic of China and Regulations to Protect Minors in Cyberspace have,to varying degrees,imposed on platforms the obligation to fulfill compliance audits on the protection of minors’personal information,and Administrative Measures for Compliance Audits on the Protection of Personal Information(draft for comments)have also released relevant provisions.However,the existing practices have not yet resulted in systematic norms of Internet platform governance,and there are obvious flaws in the relevance,completeness and effectiveness of the provisions for the implementation of platforms’obligations to conduct compliance audits on the handling of personal information.In addition,Internet platforms themselves also have insufficient endogenous incentives to conduct those compliance audits and the external supervision is also difficult to be imposed.Against the backdrop of the formal implementation of Regulations to Protect Minors in Cyberspace,the compliance audit of Internet platforms’handling of minors’personal information should highlight the particularity of protecting minors and implement the principle of being most beneficial to minors and its related requirements.This means we need to further improve the systematicity and feasibility of legislative design,and build a standardized policy framework and operational standards in all dimensions to provide clear guidelines for compliance audits of personal information protection.What’s more,in order to highlight the special protection for minors and to ensure the smooth implementation of the compliance audits,it is even more necessary to establish a long-term mechanism of government-enterprise co-discipline and collaborative governance,so as to realize the targeted protection for the rights and interests of minors.On the one hand,from the perspective of the relative autonomy of platforms,we should establish a sound incentive mechanism for platforms’compliance audits on personal information protection to motivate them to conduct compliance audits and improve their internal governance capabilities;on the other hand,from the perspective of external supervision,a cooperative supervision model should be employed to empower government-enterprise collaborative supervision so that effective audits would be ensured and supervisory efficiency be enhanced.