My information is over-collected and must be stopped
□ Our reporter Zhu Ningning
Installing a weather forecast app is required to access the address book, downloading a fitness software is required to access the phone photo album... This kind of "polite" inquiry has been experienced by many mobile phone users.
On the surface, the business seems to have fulfilled the obligation of notification, but in fact, users can only passively accept.
Because if you don’t accept it, you cannot download or use these apps normally.
Currently, a large number of apps are collecting personal information beyond the scope.
When their own functions are unnecessary, some apps excessively obtain user privacy and collect personal information.
Not long ago, the draft personal information protection law was first submitted to the Standing Committee of the National People's Congress for deliberation. How to pass legislation to effectively curb and combat excessive collection of personal information has become the focus of attention.
Individuals have the right to know and decide on information processing
In order to fully realize the protection of the personal information rights and interests of natural persons, and to be in line with the provisions of Chapter 6 "Privacy and Personal Information Protection" of the Personal Rights of the Civil Code, Chapter 4 of the draft provides "rights of individuals in personal information processing activities". Detailed regulations have been made to clarify the rights of individuals in personal information processing activities, including the right to know, the right to make decisions, the right to inquire, the right to correct, the right to delete, etc., and require the personal information processor to establish the acceptance and processing of applications for individual exercise of rights mechanism.
According to Cheng Xiao, the vice dean and professor of Tsinghua University Law School, these regulations are worthy of recognition.
In particular, Article 44 of the draft stipulates that individuals have the right to know and make decisions about the processing of their personal information, and the right to restrict or refuse the processing of their personal information by others; unless otherwise provided by laws and administrative regulations.
"This content can be said to really lay the foundation for other powers of personal information rights." Cheng Xiao specifically pointed out that it is precisely because of the right to know and make decisions that personal information processors have not fully informed and obtained natural persons' consent. Under circumstances, it cannot process their personal information unless otherwise provided by laws and administrative regulations.
At the same time, personal information processors are also obliged to explain their personal information processing rules to natural persons.
Natural persons have the right to request personal information processors to delete their personal information when they meet the prescribed conditions.
More clear regulations on connection with the Civil Code
In the face of personal information processors, especially those Internet companies with strong economic power, how to exercise the personal information rights of natural persons is a very real problem.
Article 49 of the draft stipulates that: personal information processors shall establish an application acceptance and processing mechanism for individuals to exercise their rights.
If an individual's request to exercise his rights is rejected, the reasons shall be explained.
"This means that personal information processors are obligated to establish a procedural mechanism to protect natural persons' exercise of their personal information rights and are bound by the procedural mechanism. When they refuse to exercise their rights, they should also explain their reasons." Cheng Xiao said.
It is worth mentioning that the second paragraph of Article 1037 of the Civil Code stipulates: “If a natural person discovers that an information processor violates the provisions of laws, administrative regulations, or the agreement between the two parties to process his personal information, he has the right to request the information processor Timely deletion.” However, the regulation is more principled, and it is not clear under which circumstances natural persons can request personal information processors to delete personal information in time.
The draft details this, not only stipulating the circumstances under which individuals can request deletion, but also clearly stipulating the circumstances under which the personal information processor should take the initiative to delete, including: the agreed retention period has expired or the processing purpose has been achieved; the personal information processor stops Provide products or services; individuals withdraw their consent; personal information processors violate laws, administrative regulations, or agreements to handle personal information; other circumstances stipulated by laws and administrative regulations.
Suggest legislation to explicitly prohibit excessive collection
The reporter noted that the issue of excessive collection of personal information was also a hot topic when members of the Standing Committee of the National People's Congress deliberated the draft in groups.
"In the process of personal information collection, excessive collection or overlord collection should be prohibited." Member Chen Welfare suggested that in the chapter of personal information processing rules, the collection, storage, use, processing, transmission, and provision of personal information in the concept of personal information processing should be addressed. For activities such as, disclosure, and other activities, consider formulating appropriate rules separately, especially the two key links of personal information collection and use.
"There are provisions in relevant laws that you must not collect information that is not related to your business, and you cannot use this information without your consent when it is not related to your business. It is recommended that this law should be added to prevent abuse of the power and opportunity to collect information. And conditions." Committee Member Fu Ying suggested adding content restrictions that have no boundaries and arbitrary requests for personal information collection.
One is that there should be no collection of information irrelevant to the business; the second is that there should be a two-way commitment. After the user "agrees", the service provider should also promise not to use the information in unrelated businesses at will.
Qian Fangli, a member of the Finance and Economic Committee of the National People’s Congress, believes that although the provisions of Article 6, Article 14, and Article 17 of the current draft can regulate excessive collection of personal information, there is still the possibility of circumventing the law. The purpose of processing personal information is vaguely stated as "in order to ensure user experience", etc. Therefore, it is recommended that the type of personal information to be processed, the detailed processing purpose and processing method of each type of personal information should be informed, so as to ensure the full knowledge of individuals.
"The current draft protection of personal information is mainly based on the principle of informed consent. When Internet companies have a large amount of personal information, it is necessary to avoid prior notification as a mere formality." The first member of the Zuo Zhongyi believes that in addition to strengthening government supervision, it should also introduce effective Industry governance, play the role of industry associations, and help information subjects make better decisions.
Suggest further refinement and refinement of legal responsibilities
In addition to significantly improving the standard of administrative punishment, the draft also stipulates civil liability for infringement of personal information rights and interests, clarifies that the principle of liability for infringement of personal information rights and interests is presumption of fault liability, and determines the method of compensation for damages to personal information.
The draft also provides for public interest litigation for infringement of personal information rights.
This provision will help resolve the dilemma faced by individual natural persons in defending their rights due to economic power, professional knowledge and other reasons when large-scale infringement of personal information occurs.
"It is very important to stipulate civil liability for infringement of personal information rights and interests, especially civil liability for compensation." Cheng Xiao said that the current draft stipulates the principles and methods of compensation for infringement of personal information rights and interests, and it is recommended to be divided into two paragraphs.
At the same time, it is clear that natural persons have the right to request personal information processors to stop the infringement, eliminate obstacles, and eliminate dangers.
In addition, it is recommended that different principles of liability should be determined on the basis of distinguishing between sensitive and non-sensitive personal information, that is, liability for infringement of the rights and interests of sensitive personal information, liability for danger, ie no-fault liability, and compensation for infringement of non-sensitive personal information Responsibility can be presumed at fault.
"Effectively curbing and reversing the current situation of excessive personal information collection is not only an important indicator for measuring my country's rule of law civilization and level of the rule of law, but also an inevitable measure to protect citizens' rights and interests of personal information and promote the rational use of personal information." Executive Director of Beijing Normal University International Center for the Rule of Law , Wu Shenkuo, secretary general of the Research Center of the Internet Society of China, believes that the draft can be further refined and refined by focusing on the current ecological environment of personal information collection and processing.
At the level of legal liability allocation, consideration can be given to the provision of higher-strength punishment rules for acts of infringement of sensitive personal information.
At the level of rights relief channels, in view of the relatively weak position of ordinary people in the level of cognition and ability in the new technological environment, it is possible to consider drawing on the practice of foreign legislation, adding class action clauses in the field of personal information infringement, and enriching the judicial relief of personal rights protection the way.