Caixin
Oct 12, 2020 04:58 PM

社论 | 保护个人信息不是“走钢丝” Editorial: Data Protection Law Should Put Citizens Ahead of Business (Bilingual)

A tourist is told to submit his personal information in WeChat to get into a scenic spot in Nanjing, East China’s Jiangsu province, on Feb. 23.
A tourist is told to submit his personal information in WeChat to get into a scenic spot in Nanjing, East China’s Jiangsu province, on Feb. 23.

个人信息保护立法提速。在10月13日至17日举行的十三届全国人大常委会第二十二次会议上,备受社会关注的个人信息保护法草案即将亮相。对这部重要法律,各界已呼吁多年。能否满足公众期许,切实严格保护个人信息,减少侵犯个人信息的违法行为,是检验这部法律质量的“试金石”。

China is fast-tracking legislation for the protection of personal information. At the 22nd meeting of the Standing Committee of the 13th National People’s Congress (NPC), which will be held from Tuesday to Saturday, the much-anticipated draft of the Personal Information Protection Law will be unveiled.

People from all walks of life have called for this important law for many years. The litmus test for its quality lies in whether it can meet public expectations, strictly protect personal information and reduce data violations.

多年来,囿于文化传统、社会观念和法治进程,中国对个人信息保护力度不足。方兴未艾的数字经济又带来了新挑战。不只是身份、姓名等基本个人信息,交易信息、上网痕迹等新型个人信息也具有了巨大的市场价值。大数据、人工智能、云计算、物联网等新技术使得个人信息泄露和被滥用的风险空前增加,而侵权责任追究则困难重重。这一领域可谓乱象丛生。远有“徐玉玉事件”,近有知名法学教授对人脸识别的较真,个人信息保护屡屡成为热点事件,也使得人们对这部法律寄予厚望。当前,个人信息保护的相关规定分布在全国人大常委会出台的《关于加强网络信息保护的决定》,刑法修正案(九)整合规定的侵犯公民个人信息罪,以及《网络安全法》和《民法典》等各种法律法规中。制定统一的专门的《个人信息保护法》事在必行,这也是全球的普遍做法。

For many years, constrained by cultural traditions, social concepts, and the progress of the rule of law, China has not done enough to protect personal information. The ascendant digital economy has brought new challenges. Personal data now has huge market value — not just basic information like names and identities, but also our transaction data and online footprints. New technologies like big data, artificial intelligence, cloud computing, and the internet of things have unprecedentedly increased the risk of personal data leakage and abuse, and complicated efforts to investigate violations.

A series of breaches have made personal data protection a hot topic in China in recent years. No wonder, then, that people have high hopes for the new law. Currently, the country’s regulations on personal information protection are laid out in a decision by the NPC Standing Committee, a criminal law amendment on the infringement of citizens’ personal data, the internet security law and the civil code, among other statutes. But it is imperative that we formulate a unified and specialized law for safeguarding personal data, which is already common practice worldwide.

当前,有一种说法颇为流行,即需要做好数字经济发展与个人信息保护之间的平衡。这一观点似是而非,把产业发展与信息保护视为对立物,二者实际上相辅相成。当前的主要问题不是保护个人信息过度,而是严重不足,应当分清主流与支流,莫把开头当过头。所以,这部法律绝非一部产业促进法,而是公民的权利或权益的保护法。

A popular catchphrase in China at the moment holds that we must balance the development of the digital economy and the protection of personal information. This is a misnomer, because it regards industrial development and data protection as two opposing forces when they actually complement each other. Our main problem is not that we excessively protect personal data, but that we don’t protect it anywhere near well enough. In the end, this law will exist to defend citizens’ rights, not boost industry.

保护个人信息,不是“走钢丝”,而是一个严肃的治理问题,事关社会正义与公民权利。如果个人信息保护不是从权利视角出发,而是在功利平衡中左摇右摆,公民权利必然为企业短期利益所牺牲,产业也绝不会取得长远发展。以公众反映格外强烈的各种App而言,它们获取与服务无关的个人信息,不严格履行告知义务,或者打各种“擦边球”迫使个人不得不同意;个人的敏感信息被各种机构据为己有,如何使用,个人却无从知晓。这类行为的合法、正当、必要性令人生疑,却依然大行其道,迟迟得不到纠正。“以隐私换便利”的思维在不少企业主脑中根深蒂固。种种乱象,反映的是野蛮生长背后对公众权利或权益的漠视和损害。

There is no tightrope to walk when it comes to protecting personal information. Instead, it’s a serious governance issue that concerns social justice and civil rights. If the new law does not start from the perspective of rights, but tries to strike a utilitarian balance, civil rights will inevitably be sacrificed for short-term business interests and the industry will never secure long-term development.

For instance, a variety of widely used apps in China obtain personal data that has nothing to do with their services, collect information without notifying users, or exploit loopholes in the rules to force individuals to hand over their data. Although such behavior may not be legal or necessary, it remains rampant. Many business owners force people to trade privacy for convenience, and care little about the resultant damage to citizens’ rights.

个人信息保护法的主要任务就是定分与止争。它不仅要明确各方权利或权益归属,还要化解纠纷。只有规则明确了,产业发展才可能进入良性循环,稳定企业预期,避免“劣币驱逐良币”或者比拼谁更没有底线。个人信息保护法为今后各地的具体实施和执法明确了权责,划定了边界,为司法提供裁量依据。没有明晰的授权和限权,监管执法极易陷入要么不作为、要么乱作为的怪圈。这必将增大企业的成本,影响产业的长远发展。

The main task of the new law is to establish definitions and stop conflict. It must not only clarify the rights and privileges of all parties, but also resolve disputes. Only when the rules are clear can industry enter a virtuous circle of development, stabilize business expectations, and prevent “bad” money from driving out the “good” or competing in a race to the bottom.

The law therefore clarifies the powers and responsibilities for its specific implementation and enforcement, sets limits on its scope, and provides a basis for judicial discretion. Without clear authorization and restrictions, regulators and law enforcement can easily fall into vicious circles of inaction or overreach, raising business costs and affecting long-term industrial development.

个人信息保护法的成色,一是取决于保护力度,是否真能使违法者“不敢、不能、不想”;一是取决于受害者的救济渠道,能不能做到及时便捷地伸张正义。

The maturity of the law depends firstly on whether it is strong enough to deter offenders and hinges on providing channels for victims to seek financial redress and bring lawbreakers to justice in a timely and convenient manner.

对于该法的定位、体系和内容,不同观点交锋激烈。比如在民法典关于个人信息保护的条款中,就曾有一些人士力荐设定“个人信息权”,后来这一表述并未被采纳。个人信息保护的法律定位,究竟是私法还是公法,至今存在争议。有学者坚定主张,个人信息控制权是一项新型公法权利。这些争论并非纯属学理之争,而有着深广的现实影响,特别是监管部门和司法机关的责任。应该说,这部法律是在迫切的现实需求下,暂时搁置重大争议,先立法再完善这一思维的产物。这一务实态度也是可以理解的。

Opinions abound on the law’s positioning, systems and content. For example, some scholars once strongly recommended that the phrase “personal information rights” be included in the provisions of the Civil Code, but this expression was not adopted later. Others continue to argue over whether data protection should fall under the rubric of public or private law. Still more scholars firmly argue that the control of personal data represents a new type of public legal right.

These disputes are not purely academic, but may have profound practical impacts on the responsibilities of regulators and judicial organs. It should be noted that officials have landed on the current version of the law by focusing on urgent practicalities ahead of controversial issues, a pragmatic and understandable attitude.

个人信息不能止步于民事权利保护,而要强化事前事中的政府监管与执法。提供更多“公共产品”,是当前保护个人信息亟待完善的环节。监管与执法的缺位,无疑会刺激助长侵犯个人信息的行为。目前存在的多头治理、各自为政的格局应该尽快改变。加强协同配合机制,或者建立专门的执法机制,都是未来的可选项。

Personal data issues do not stop at the protection of civil rights, but must also strengthen the government’s supervision and law enforcement. China urgently needs to improve its provision of more so-called public goods as part of efforts to protect personal information. The absence of government oversight will undoubtedly spark data violations. In the future, we should consider strengthening coordination or establishing special law enforcement mechanisms to fix our current enforcement model, which is spread too diffusely across multiple government bodies.

各级国家机关以及承担部分公共职能的机构也是个人信息的收集使用者。人们容易假定它们比商业机构道德高尚。须知机关是由有着种种利益纠葛的个人组成的,其行为并不注定服务于公共利益。因此,各级机关和各种机构在收集、处理以及使用个人信息过程中,亦须遵守比例原则、正当程序原则、最小化原则,也必须有严格的规范,明确其权力、责任和义务。目前,对于国家机关对个人信息的侵权,学者多围绕国家赔偿展开,其实,更重要的是对具体人员的责任追究。

State agencies at all levels and institutions with public roles also collect personal information. Although we might assume they are more ethical than commercial enterprises, such agencies are still composed of people with various interests who may not necessarily always serve the public.

Therefore, we must make sure these bodies comply with the principles of proportionality, due process and minimal intervention when collecting, processing and using personal data, as well as abide by strict regulations that clarify their rights, responsibilities and obligations. Currently, scholars are mostly focusing on how state organs might compensate individuals for personal data violations. In fact, the accountability of specific personnel is far more important.

有些人担心,严格保护个人信息,会使得企业束手束脚,妨碍数据资源积累,从而影响中国数字经济在全球的竞争力。以中国人口之众和市场之大,这种担心纯属杞人忧天。我们对中国数字经济的前景满怀信心,同时期待在个人信息保护上,比起在建章立制先行一步的欧美发达经济体,中国也能迎头赶上。

Some people worry that strict personal data protection will frustrate companies, hinder their ability to accumulate information resources, and impact the global competitiveness of China’s digital economy. Given the country’s vast population and huge market, these concerns are unfounded.

We are full of confidence about the prospects for China’s digital economy. At the same time, we look forward to Chinese citizens enjoying better personal data protections than they do currently — an arena where China can catch up with developed economies in Europe and the United States, which have already established such rules and regulations.

The Chinese version of this article was published in Caixin Weekly on Oct. 12, 2020, and is only available for Caixin Global’s app users. To unlock more bilingual articles, download the Caixin app.

如果你对中英文报道感兴趣,欢迎订阅财新双语通。

If you are interested in our bilingual articles, subscribe to the English & Chinese Combo Pack.

Share this article
Open WeChat and scan the QR code