The "Personal Information Protection Law of the People's Republic of China" has been implemented since November 1, 2021, and it has been one year since then. What is the current effect of the implementation of laws related to personal information protection?
What problems still exist?
How to further enhance the sense of personal information security?
The reporter interviewed relevant experts.
Continuously improve the rules and regulations
Over the past year since the implementation of the Personal Information Protection Law, relevant departments have promulgated relevant regulations and rules, supervision has been continuously strengthened, awareness of personal information protection has been significantly improved, and problems such as abuse of personal information by relevant companies have been greatly improved.
According to the latest data released by the Supreme People's Procuratorate, since 2018, procuratorial organs across the country have arrested 16,459 people and prosecuted 33,417 people for the crime of violating citizens' personal information.
Among them, from January to September 2022, 1,199 people were arrested and 6,223 people were prosecuted, a decrease of 47.2% and an increase of 87.9% respectively compared with the same period in 2018.
At the same time, some problems remain.
For example, as a registered user of the platform, do consumers have the right to request the platform to disclose the personal information collected and related processing?
A few days ago, the Higher People's Court of Guangdong Province released a batch of typical cases of personal information protection. Among them, the judgment result of Zhou Moumou's personal information protection dispute case against an e-commerce company gave an affirmative answer to this.
Zhou Moumou once called and sent emails to the relevant departments of the company, hoping that the platform would disclose his personal information collected, but to no avail.
For this reason, Zhou Moumou appealed to the court to defend his rights.
The effective judgment of the Guangzhou Intermediate People's Court held that Zhou Moumou's request for the platform to disclose personal information to him was, in essence, advocating the right to consult and copy personal information.
The right to access and copy personal information is an important legal right of individuals and should be fully protected in accordance with the law.
The court finally ruled that the company should provide the personal information collected by Zhou Moumou and its processing for Zhou Moumou to check and copy.
Experts in the industry said that this case released at least two signals: one is that the judiciary protects the rights and interests of citizens’ personal information; Operations need to be improved.
"In the field of e-commerce, personal product browsing records, shopping records, follow records, additional purchase information, order information and other consumer behavior information are closely related to personal personality interests, which belong to personal information and should be protected." Beijing Internet Court Comprehensive Judgment Zhang Yaguang, assistant judge of the third court, said that the Personal Information Protection Law clearly states that personal information refers to various information related to identified or identifiable natural persons recorded electronically or in other ways.
As long as it is related to an individual and can have an important impact on the individual, it is considered personal information.
Standard implementation still needs to be refined
"The issue of personal information protection has the characteristics that the infringement is relatively hidden and difficult to find, it is difficult for the parties to provide evidence after discovering that the personal information has been infringed, and the number of infringed persons is large. The subjects of such cases are mainly concentrated in network platforms, application software, and e-commerce platforms. Wait." Qin Jingran, Assistant Judge of the People's Court of Haidian District, Beijing, said.
For the above-mentioned enterprises, how to better implement the provisions of the Personal Information Protection Law?
The most common way is to post a privacy policy.
But for the privacy policy issued by the platform, will users read it carefully?
"Don't read it, just click agree." Ms. Yin, who spends a lot of online shopping, said, because the app cannot be used without agreeing.
Like Ms. Yin, for convenience, few people will carefully read the so-called "privacy policy" of the platform, but choose to agree directly.
"Everyone should be more vigilant and cultivate the awareness of 'non-essential non-provision' of personal information. If the network service provider refuses to provide services because the user does not provide unnecessary information, it can give priority to feedback and communicate with the platform to protect itself. Legal rights and interests. At the same time, the awareness of personal information protection of network service providers is gradually increasing, but the implementation of regulations still needs to be refined.” Zhang Yaguang said that with the continuous improvement of laws and regulations and the increasingly clear rules of adjudication, most network service providers have formulated A special privacy and personal information protection agreement has been established.
Internet service providers have realized that they should not collect and use the collected personal information unscrupulously, but there are still a lot of disputes involving the collection of personal information beyond the scope, excessive claims, and notification and consent of personal information processing. Protection laws still have a long way to go.
Some experts said that there are two main difficulties in the implementation of the Personal Information Protection Law: First, there are difficulties in identifying the information involved in the case.
The classification criteria for various types of information involving the scope of personal information, the scope of anonymized personal information, and the scope of disclosed personal information still need to be clarified; The identification criteria for informed consent need to be further refined; third, as the operator's product marketing model changes to precise and targeted marketing, analyzing user behavior information can greatly improve marketing efficiency, save costs, and properly handle the conflict between personal information protection and the development of the digital economy. Relationships are very important.
Wu Shenkuo, deputy director of the Research Center of the Internet Society of China and a doctoral supervisor at Beijing Normal University, believes that a healthy and sustainable digital ecology lies in the organizational management system and organizational management structure of various units in society, including public and private sectors, related to network governance and data governance. The improvement of the digital literacy of the public and the improvement of the digital literacy of the public.
At the level of utilization of cyberspace and data resources, it is necessary to further enhance digital awareness and necessary digital skills.
Increase regulatory penalties
In recent years, the issue of Internet consumer big data "killing familiarity" has attracted much attention. Big data "killing familiarity" has violated users' right to know, right to choose, and right to fair trade. market order.
According to a survey report released by the Beijing Consumers Association in September, more than 70% of the respondents believed that the phenomenon of "killing familiarity" with big data still existed, and more than 60% of the respondents said that they had the experience of being "killed" by big data. Nearly half (47.68%) of the respondents chose to consider themselves unlucky, and only a very small number (4.95%) of the respondents chose to protect their rights through judicial channels.
This shows that most of the interviewees can realize that the act of "killing acquaintances" with big data violates the legitimate rights and interests of consumers, but not many people choose to protect their rights in accordance with the law.
Li Ya, a lawyer at Beijing Zhongwen Law Firm, said that due to factors such as difficulty in obtaining evidence, high costs, and low awareness, only a small number of users choose to take up legal weapons to defend their rights.
"In terms of law enforcement, there are situations where enforcement is lax and punishments are light, and due to technical difficulties and other reasons, supervision is insufficient. Therefore, it is necessary to further strengthen supervision and punishment, so that the personal information protection law can really grow 'teeth' .” Li Ya said.
The protection of personal information involves many objects and a wide range of fields, and the responsibilities of multiple departments overlap or the positioning of powers is not clear enough, so it is urgent to form a joint regulatory force.
Some experts suggest that in terms of rights protection, relevant departments can introduce more convenient channels for rights protection and complaints, reduce the cost of user rights protection, and at the same time improve the convenience of judicial rights protection to encourage rights protection behavior; Consumer organizations prescribed by law or organizations determined by the national network information department file public interest litigation.
"The "Personal Information Protection Law of the People's Republic of China" has established a scientific, systematic, and comprehensive top-level design for the protection of personal information. With continuous cultivation and in-depth development of international exchanges and cooperation, the general public will surely usher in a new digital governance ecology in which the legitimate rights and interests of personal information are protected, personal information processing activities are regulated, and the rational use of personal information is promoted." Wu Shenkuo said.
Li Wanxiang