摘要
[目的/意义]欧盟一般数据保护条例(GDPR)引入的数据保护影响评估(DPIA)制度给数据控制者提出新的要求。通过解析GDPR中DPIA制度的相关规定,研究其立法思路和核心理念,可以为我国相关立法工作提供借鉴。[方法/过程]通过查阅和梳理以GDPR为代表的欧盟数据保护领域的法律文件,归纳DPIA制度的出台背景和演化过程,深入剖析DPIA制度的数据保护模式、适用情形、基本流程和执行过程等主要内容。[结果/结论]DPIA制度能够应对愈加复杂多变的数据安全风险环境,具有重要的实践价值和参考意义。我国个人信息保护法应确立DPIA制度,具体内容包括DPIA的规制对象、适用情形以及数据控制者的事先咨询义务,并提出数据风险评估模型。
[Purpose/significance]The Data Protection Impact Assessment(DPIA)introduced by the General Data Protection Regulations(GDPR)imposes new requirements on data controllers.By analyzing the relevant provisions of DPIA in GDPR and studying its legislative ideas and core concept,it could provide reference for relevant legislative work in China.[Method/process]This paper reviews the legal documents in the field of data protection in the EU represented by GDPR,summarizes the background and evolution of the DPIA system,and then deeply analyzes its data protection pattern,applicable situations,basic processes and execution processes.[Result/conclusion]The DPIA can cope with the increasingly complex and variable risk environment of data security,which has important practical value and reference significance.China's personal information protection law should establish the DPIA system,which includes DPIA's regulatory objects,applicable situations,data controllers'prior consulting obligations,and data risk assessment model.
作者
崔聪聪
许智鑫
Cui Congcong;Xu Zhixin(Institute of Internet Governance and Law,Beijing University of Posts and Telecommunications,Beijing 100876)
出处
《图书情报工作》
CSSCI
北大核心
2020年第5期41-49,共9页
Library and Information Service
基金
国家社会科学基金重大项目"国家网络空间安全法律保障机制研究"(项目编号:13&ZD181)研究成果之一。
