Research On The Construction Of Enterprise Personal Information Protection Compliance Syste

As a hot topic in the theoretical and practical circles,the construction of compliance system is not only the manifestation of the system of preventing enterprise illegal crimes,but also the practical result of enterprises’ self-management and self-supervision to promote the modernization of social governance.From the results of our compliance practice,due to the lack of basic conditions in the legal system,the implementation of enterprise compliance has many problems.However,corporate compliance,as a way of social governance,is unstoppable.Compliance systems are more needed in the area of personal information protection.With the integration and development of network technology,information technology and Internet technology,human beings have entered the digital society.In the data society,personal information has strong mobility.The rise and development of algorithm technology brings new interaction space to people,which brings great convenience to life communication but also brings great risks to personal information protection.The data and information generated by people on the Internet no longer belong to themselves,but become the raw materials for Internet enterprises to pursue economic value.In order to obtain more personal data and information,the means taken by enterprises may greatly infringe the rights and interests of citizens’ personal information.As a part of personal rights and interests,personal information needs to be protected by various means.With the promulgation and implementation of the Personal Information Protection Law,China has further strengthened the protection of personal information.The law also clearly puts forward the requirements of personal information processing personnel to undertake the compliance obligations,and provides legal support for the construction and perfection of the enterprise personal information protection compliance system.From the perspective of laws and regulations,the current legislation stipulates the protection of personal information through the Criminal Law,the Civil Code,the Personal Information Protection Law,the Network Security Law and other laws,among which the personal Information Protection Law clearly stipulates the compliance obligations of personal information processors(including enterprises)as legal obligations.Personal information,as an important asset in the digital age,will involve the use and protection of personal information in both external business development and internal management.In terms of substantive law,the personal Information Protection Law puts forward general compliance obligations for personal information handlers,that is,to formulate management systems within enterprises and conduct classified management of personal information,and to strengthen the obligations for special handlers.In terms of procedural law,citizens can seek remedies from civil and criminal aspects when their rights and interests of personal information are infringed.However,due to the opacity of algorithm technology,citizens’ rights and interests relief means and methods are generally lacking,and citizens even do not know that their rights have been infringed.Therefore,the responsibility for personal information protection needs to fall more on the shoulders of personal information processors.From the perspective of enterprises,enterprises need to assume more protection responsibilities and fulfill their due social responsibilities.From the perspective of compliance practice,"administrative compliance" and "criminal compliance" are in full flow both in theory and practice,and the effect of practice is also reflected.However,due to the problems of legal connection,there are still the following problems in the implementation of compliance system: first,the construction of enterprise personal information protection compliance system is incomplete;Second,the personal information processing enterprise algorithm is not transparent resulting in the infringement of personal information rights and interests;Third,there are difficulties in capital,capacity and risk identification in the construction of enterprise compliance system,which leads to difficulties in pre-prevention.At the present stage,the Supreme People’s Procuratorate is carrying out the vigorous pilot reform of enterprise compliance non-prosecution in Shanghai,Jiangsu,Shandong,Guangdong and other places,and the pilot reform places are gradually expanding to more provinces,but all these are promoting compliance construction by external compulsory means.In today’s complex and changeable risks,enterprise governance needs to transform into proactive compliance management.In the face of the hot issue of personal information protection to strengthen responsibility and supervision,enterprises need to transform the response results into pre-risk prevention,establish a complete,comprehensive and systematic protection network,and form a chain of preventive measures,in-process control and post-remedy.Enterprises may identify compliance risks according to the degree of personal information involved in processing and the type and scope of their own business,establish a unique compliance risk database,formulate internal systems,operating procedures and personal information classification according to the provisions of the provisions,and review regularly according to the requirements of laws and regulations.In addition,it is also necessary to strengthen the degree of self-discipline of the industry,integrate legal norms into the algorithm norms,and regulate possible illegal and criminal behaviors through legal norms in the first step of algorithm operation,so as to stifle infringement at the source and realize the protection of personal information data.