The Judgment Criteria And Processing Rules Of Sensitive Personal Information In China

China’s Personal Information Protection Law summarizes and lists the definition of sensitive personal information,However,after the legal definition of the word "sensitive" in sensitive personal information outside the domain and relevant regulations,Found that the items of sensitive personal information in China’s Personal Information Protection Law are incomplete,The connotation of some of the listed items is unclear,Further explanation is needed;at the same time,For the scene theory in the judgment of sensitive personal information;The premise of sensitive personal information in China requires a specific purpose and sufficient necessity,But this premise is more abstract,It is difficult to apply accurately in practice;The basic requirements and implementation path of the special consent rules for sensitive personal information in China also need to be further clarified.On this basis,this paper combines the application of scenario theory to clarify sensitive personal information in China,to accurately determine whether a certain information type is sensitive personal information,on the basis of the clear legal definition of the sensitive special processing rules of sensitive personal information,give full play to its role as far as possible in practice,fully safeguard the personal property rights and interests of information subject.This paper first explores the criteria for determining sensitive personal information.First,the legal definition of the word "sensitive" in sensitive personal information should be clarified.After comparing the legislation of foreign countries and relevant regulations in China,the "sensitive" law in sensitive personal information should be defined as "the high risk damage of personal property and property rights + the degree of infringement of general rights and interests".Second,after comparing the enumeration items of sensitive personal information in national legislation,this paper holds that the enumeration items in national legislation are typical sensitive personal information,among which the listed items include universal sensitive personal information and special sensitive personal information.Therefore,we explain the list of sensitive personal information in China’s Personal Information Protection Law,and believe that "specific identity" information should be interpreted as identity information including "ethnic and race" information and "identity number" information,"sex" information and "political opinion" information;"track" information is different from "precise geographic location" information,but "track" information covers "precise geographic location" information,the former is wider than the latter.Third,it is necessary to clarify the specific reference elements when the scene theory is applied to the judgment of the sensitive personal information category.Non-sensitive personal information itself does not conform to the legal definition of "sensitive",but under the transformation of the scene,the nature of the information changes,so that it becomes sensitive personal information.This paper holds that the information types with strong tool,strong privacy or strong differentiation can achieve the legal definition of "sensitive",while the five aspects of participant,information type,information status,value specification and scene purpose are the scene investigation elements for the transformation of non-sensitive information to sensitive information.Finally,sensitive personal information judgment criteria should be summarized as list belongs to the typical sensitive personal information,but with the change of the practice scenario,these list is not directly applicable,still need to combine participation subject,information type,information status,value specification,scene purpose five scene elements to determine whether its strong instrumental,strong privacy or strong differentiation to conform to the "sensitive" law of sensitive personal information.This paper is followed by the further interpretation of the special processing rules of sensitive personal information,the processing of sensitive personal information in the premise of "specific purpose",this paper that the specific purpose should be strictly limited to normative legal documents,national and industry standards,public interest,scientific or historical research,social statistics,the judicial and specific law enforcement activities,perform legal duties or obligations,safeguard the rights and interests of natural person,and does not applicable to the purpose of reasonable purpose.As for the "sufficient necessity" in the processing premise of sensitive personal information,this paper believes that it is closely related to the specific purpose and is the strengthening of the minimum necessary principle.At the same time,the information processing and storage period is the shortest period to achieve a specific purpose,and the damage to the information subject must be minimized.For separate consent in the special consent rules for sensitive personal information,This paper considers that the package of consent cannot be obtained indiscriminately for the processing of sensitive and non-sensitive information,Separate consent shall be made after separate notification;Separate consent may be provided in various forms with reference to the relevant technical guidelines,At the same time,separate consent should also meet the voluntary and clear standards under full knowledge;The information processor also has the corresponding obligation to inform it at this time,Innotification increase the full necessity of processing and the impact on individual rights relative to non-sensitive information,Relevant information technology means can be used to adopt a variety of notification methods and achieve the true,accurate and complete separate notification standards;The withdrawal of the separate consent should be convenient enough.Written consent is a further limitation on the basis of separate consent,with stricter requirements on the consent of the information subject;Written consent emphasizes a written consent but does not exclude electronic and not equivalent to paper consent;and is limited to legal and administrative regulations.The last part of this paper is to test and apply the above judgment criteria of sensitive personal information and special processing rules combined with practice,and select face recognition information,a typical sensitive personal information that is widely used in practice and causes widespread concern and even concern.First of all,the attributes of face recognition information are determined.Face recognition information belongs to the category of sensitive personal information because it belongs to the list of sensitive personal information in China.Secondly,because face recognition information belongs to sensitive personal information,special processing rules should be applied,which can be further defined in the specific purpose of processing,and risk and profit should be combined to judge whether it is sufficient necessity.Finally,the consent method of face recognition information processing can be realized by the dynamic consent platform,which gives the information subject more autonomy.