生成式人工智能中个人信息保护风险的类型化与合作规制

Taxonomy and Co-Regulation of Personal Information Protection Risks in Generative AI

从数据生命周期的角度看,生成式人工智能在数据收集、数据清理、数据标注、模型训练、模型评估、模型部署与推理等阶段均可能引发个人信息保护风险,如未经同意处理个人信息、违反目的明确与最小化原则、个人信息滥用及泄露等。然而,位于规制谱系两端的“自上而下的集中式规制”和“自下而上的分散式规制”均存在局限性,难以达到预期的规制效果。因此,有必要采用“自中而外的规制方法”,构建合作型规制空间,调整和激活不同规制体系的回应性和敏捷性,最终实现生成式人工智能中个人信息保护风险的合作规制。为此,有必要建构契合生成式人工智能的科技法律,引入监管沙盒促成行政规制的包容审慎,利用分层治理实现被规制者的自我规制,完善评估认证实现社会的第三方规制。

From a data life-cycle perspective, generative AI may pose personal data protection risks, such as processing personal data without consent, violating the principle of purpose clarity and minimization, and misuse and leakage of personal data, at the stages of data collection, data cleansing, data annotation, model training, model evaluation, and model deployment and inference.However, both “top-down centralized regulation” and “bottom-up decentralized regulation” at the two ends of the regulatory spectrum have limitations that make it difficult to achieve the desired regulatory effect.Therefore, it is necessary to adopt the “middle-out regulatory approach” to build a cooperative regulatory space, adjust and activate the responsiveness and agility of different regulatory systems, and ultimately realize the co-regulation of personal information protection risks in generative artificial intelligence.To this end, it is necessary to construct technology laws suitable for generative AI, introduce regulatory sandboxes to promote the inclusiveness and prudence of administrative regulation, utilize layered governance to realize the self-regulation of the regulated, and improve assessment and certification to realize the third-party regulation of society.