動態(tài)與觀點
? 引言
中國《個人信息保護法》（下稱《個信法》）已經(jīng)頒布，將于2021年11月1日生效?？梢粤隙ǎ袊鐣械膫€人信息處理活動（本文提到這個概念，是指受《個信法》管轄的個人信息處理活動。下同），將會出現(xiàn)一段由亂入治的過程。
歐盟2018年5月25日生效了《數(shù)據(jù)保護通用規(guī)定》 （General Data Protection Regulation。下稱GDPR)，對歐盟境內(nèi)的個人信息處理活動進行了規(guī)范。
鑒于中歐經(jīng)濟交流的深度與廣度，對于兩部法規(guī)進行比較研讀，對于機構(gòu)，特別是有跨境業(yè)務(wù)的企業(yè)和其它私人機構(gòu)，建立同時滿足兩部法律要求的組織架構(gòu)及制度，十分有益。
?立法目的：個人信息保護與個人信息利用平衡
中國：保護個人信息權(quán)益，但也要促進個人信息的合理利用 （第一、二條）。
歐盟：保護個人數(shù)據(jù)相關(guān)自由和權(quán)利，但不得因此限制或禁止歐盟范圍內(nèi)的信息自由流動（第1（2）（3）條）。
個人信息保護法的必要性，是隨著電子信息產(chǎn)業(yè)的大發(fā)展而日益顯現(xiàn)出來的。由于信息產(chǎn)業(yè)的發(fā)達，處理個人信息的規(guī)模、速度及對個人生活的影響與此前的時代大相逕庭，不可同日而語。但是個人信息的使用又是數(shù)字化經(jīng)濟環(huán)境下許多經(jīng)濟活動的基礎(chǔ)。因此，中歐法律都同樣強調(diào)了兩者的平衡。
?個人信息的定義
中國：個人信息是與已識別或者可識別的自然人有關(guān)的各種信息（第四條）。
歐盟：個人數(shù)據(jù)是與已識別或者可識別的自然人有關(guān)的各種信息（第 4（1））。
《個信法》使用個人信息一詞，GDPR使用個人數(shù)據(jù)一詞，但兩者的內(nèi)涵并無實質(zhì)區(qū)別。
《個信法》強調(diào)，匿名化后的信息就不屬于個人信息（第四條）。這只是對“與已識別或者可識別的自然人有關(guān)”這一點的進一步闡述，并未縮小個人信息概念的外延。
《個信法》還強調(diào)，是否以電子方式記錄，不是定義個人信息的要件（第四條）。GDPR則規(guī)定，只要個人數(shù)據(jù)進入文檔系統(tǒng)，便屬于個人數(shù)據(jù)，無論該文檔系統(tǒng)是否是自動化的（第2（1）條）。鑒于自動化的文檔系統(tǒng)只能是電子的，而在電子文檔系統(tǒng)中存在的信息只能是電子方式記錄的，所以，在這一點上，兩部法律表述方式不同，但效果是一樣的。
?個人信息的處理者與控制者
中國：個人信息處理者是指在個人信息處理活動中自主決定個人信息的收集、存儲、使用、加工、傳輸、提供、公開、刪除等處理目的、處理方式的組織、個人（第四條二款，七十三條一款一項）。
歐盟：數(shù)據(jù)控制者是指獨自或聯(lián)合決定數(shù)據(jù)處理目的和方式的個人或法人、公共當(dāng)局、機構(gòu)或其它組織（第4（7）條第一句）；數(shù)據(jù)處理者是指代表數(shù)據(jù)控制者收集、記錄、組織、建構(gòu)、存儲、改編或改變、取回、咨詢、使用、披露、校準或合并、限制、刪除或拆解數(shù)據(jù)的個人或法人、公共當(dāng)局、機構(gòu)或其它組織（第4（2），（8）條）。
《個信法》中只有“處理者”，而沒有“控制者”。但是，《個信法》中的處理者是能決定處理目的和處理方式的個人或組織，因此應(yīng)該理解為包含了歐盟法意義上的控制者，因為只有控制者才能決定處理的目的以及方式。
另一方面，因為即使是狹義意義上的處理者，比如提供數(shù)據(jù)處理服務(wù)的獨立第三方，雖然在處理目的上不能自主，但在數(shù)據(jù)處理方式上必然有某種范圍的自主權(quán)，比如存儲服務(wù)器設(shè)于何處，服務(wù)器如何加密，采用光纖還是電纜傳輸?shù)?，否則就不成其為獨立第三方，而是控制者的關(guān)聯(lián)公司了。
因此，《個信法》中的個人信息處理者也包含歐盟法意義上的處理者?？傊?，《個信法》上的個人信息處理者的范圍，與GDPR的“控制者+處理者”的范圍，并沒有實質(zhì)區(qū)別。
?境內(nèi)管轄與境外管轄
中國：在中國境內(nèi)進行的個人信息處理活動，受管轄（第三條一款）。在中國境外進行的處理中國境內(nèi)自然人個人信息的活動，如果該活動是以向中國境內(nèi)自然人提供產(chǎn)品或服務(wù)為目的，或該活動是在分析、評估中國境內(nèi)自然人的行為，或有法律法規(guī)規(guī)定的其它情形，也受管轄（第三條二款）。
歐盟：由歐盟境內(nèi)的信息控制人或處理人的機構(gòu)進行的數(shù)據(jù)處理活動受管轄，無論處理活動是否發(fā)生在歐盟境內(nèi)（第3（1）條）。設(shè)立的在歐盟境外的信息控制人或處理人進行的數(shù)據(jù)處理活動，如果該活動是為了向歐盟境內(nèi)的數(shù)據(jù)主體提供產(chǎn)品或服務(wù)，或該活動是為了監(jiān)控歐盟境內(nèi)發(fā)生的行為，也受管轄（第3（2）條）。
顯然，在信息主體（可能的受害者）所在地這一判斷依據(jù)，中歐兩部法律在實際效果上是一致的。
值得辨析的是中國“在境內(nèi)進行的處理活動”與歐盟“境內(nèi)控制人或處理人的機構(gòu)進行的活動”兩者的不同。因為問題較為復(fù)雜，所以我們舉個例子來測試這個問題：假定，一家境內(nèi)公司的境外機構(gòu)處理有關(guān)境外人的信息，事情如何？
這要分兩種情況分析。
第一種，當(dāng)境外機構(gòu)的行為是獨立的，比如境外機構(gòu)為境外第三方提供信息處理服務(wù)。此時，按PIPL的規(guī)定，因活動不在中國境內(nèi)，故不適用。但在GDPR來看，答案就不明確。有的認為GDPR不適用，因為此時境內(nèi)公司既非處理人，也不是控制人。但筆者曾服務(wù)的一家歐盟公司總部的信息安全專員認為適用GDPR，故其要求其中國子公司要遵守GDPR，盡管其中國公司中沒有歐盟人的個人信息。
第二種，當(dāng)境外機構(gòu)的行為受境內(nèi)機構(gòu)某種范圍的控制。此時，在GDPR來看，是明確有管轄權(quán)的，因為屬于歐盟境內(nèi)控制人的機構(gòu)從事的活動。但在PIPL似乎就可以爭議。因為，比如中國總部要求境外機構(gòu)貫徹某種技術(shù)標準或服務(wù)標準，是不是PIPL定義的“自主決定處理方式”？答案尚不確定。
就這些問題，我們建議客戶密切觀察中歐兩地的立法發(fā)展。
要提醒的是，信息控制人或處理人的“機構(gòu)”，GDPR英文版的表述“establishment”不能理解為是一個公司，甚至不能理解為一個辦公室。法律形式并不是標準。一個聘請的顧問，也可構(gòu)成establishment。
?境外管轄權(quán)的貫徹
中國：個人信息處理者應(yīng)當(dāng)采取必要措施，保障境外接收方處理個人信息的活動達到本法規(guī)定的個人信息保護標準（第三十八條3款）。
歐盟：個人數(shù)據(jù)控制人或處理人只有在采取了恰當(dāng)保障措施，并且以數(shù)據(jù)主體的權(quán)利可以執(zhí)行和法律救濟途徑可以獲得為前提，除非歐盟已經(jīng)認定第三國的保護水平足夠。任何有關(guān)向境外傳輸個人數(shù)據(jù)的規(guī)定都應(yīng)保障GDPR的保障水平?jīng)]有削弱（第44、46（1）條）。
盡管法律為向境外傳輸個人信息設(shè)置了很多要求，如果境外接收人在得到數(shù)據(jù)后不執(zhí)行怎么辦？中歐兩國法律都對其境內(nèi)數(shù)據(jù)控制者、處理者賦予了“保障”義務(wù)。
這實際上一方面是要求境內(nèi)機構(gòu)審慎地審查境外接收方的保護理念、方法、能力等，另一方面是要求境內(nèi)機構(gòu)應(yīng)當(dāng)通過協(xié)議等工具對境外接收方加以控制，以便在發(fā)生侵害個人信息權(quán)時，個人信息主體、境內(nèi)機構(gòu)可以通過適當(dāng)?shù)耐緩綄で缶葷?，比如依?jù)協(xié)議對境外機構(gòu)提起訴訟。
當(dāng)然，沒有履行“保障”義務(wù)的境內(nèi)機構(gòu)，根據(jù)情節(jié)不同，可能會受到行政處罰。在中國境內(nèi)的責(zé)任人，也有可能被追究刑事責(zé)任。
個人信息保護合規(guī)問題，對于信息處理者，尤其是企業(yè)來說，是一個需要從治理層面上重點關(guān)注的問題：企業(yè)應(yīng)當(dāng)根據(jù)法律要求在內(nèi)部設(shè)置合適的個人信息保護機構(gòu)，投入足夠的資金建設(shè)信息保護基礎(chǔ)設(shè)施并對人員提供足夠的培訓(xùn)，同時制訂適當(dāng)?shù)囊?guī)章制度，確保員工的職務(wù)行為合乎法律要求。
英文版
China Personal Information Protection Law and EU General Data Protection Regulation Comparative Reading: Five Basic Concepts
?introduction
China has published the Personal Information Protection Law (PIPL), which takes effect on November 1, 2021. It can be expected that personal information processing activities will take some time to turn from chaos now into disciplined.
European Union has made the General Data Protection Regulation (GDPR) effective from May 25, 2018, that regulates personal data processing in the EU.
Given the depth and wideness of economic exchange between China and the EU, it is very useful for organizations, especially businesses and others with cross CN-EU border business, to read the PIPL and GDPR comparatively, in order that they can prepare their organization and institution pursuant to legislation in both regions.
?Objectives: balance of protection and use of personal information
CN: protect personal information rights, but also promote use of personal information ( Art. 1;2).
EU: protect personal rights to the protection of personal data,while free movement of personal data within the Union should neither be restricted nor prohibited (Art. 1(2)(3)).
The necessity of personal information protection is getting prominent along the growth of electronic information industry. With advance of the e-information industry, the scope, speed of and impact on personal life by personal information processing activities are tremendously different from the days before. Use of personal information, however, is also the foundation for many economic activities in digital economy environment. Both China and EU therefore have emphasized the balance of the two sides.
?Definition of personal information
CN: personal information means any type of information relating to an identified or identifiable natural person (Art. 4).
EU: personal data means any information relating to an identified or identifiable natural person (Art. 4(1)).
PIPL uses the word Personal Information whilst GDPR uses Personal Data, but there is no difference in essence between.
PIPL has affixed to the above definition a sentence "pseudonymized information" is not personal information. This however is just an additional emphasis of the point "relating to an identified or identifiable", with no further essential development in the definition.
PIPL has also emphasized that whether information is recorded electronically is not a component of the definition. GDPR on the other hand stipulates that it applies as long as personal data enter a filing system which no matter is automated or not. As an automated filing system can only be electronic, and data in a electronic filing system can only be recorded electronically, these two pieces of legislation therefore are talking about the same thing with different ways of expression.
?Personal information controller and processor
CN: personal information processor is an individual or organization which autonomously determines in personal information processing activities the purposes and means of personal information processing, such as collection, storage, use, working on, transfer, providing, disclosure, deletion (Art. 4 par. 2;73 par.1 item 1).
EU: personal data controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (Art4(7) sentence 1). Personal data processor means a natural or legal person, public authority, agency or other body which, on behalf of the controller, processes personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, alignment or combination, restriction, erasure or destruction (Art4(2),(8)).
In PIPL, only there is the concept of processor, no controller. Nonetheless, the processor in PIPL is an individual or organization which can determine the purposes and means of processing, thus should be understood in the way it covers the concept of controller in GDPR. After all it is the controller that determines purposes and means of data processing. On the other hand, a processor, even in a strict sense,for instance an independent third party data processing service provider, though without autonomy on processing purpose, must have some sort of autonomy on the means of processing to a certain scope, such as where to place servers, how to encrypt data, transfer data by what technique. Otherwise it is an associated organization, not a third party anymore.
Therefore a processor in PIPL also covers the concept of processor in GDPR. In short, a processor in PIPL is not essentially different from "controller + processor" in GDPR.
?Application inside and outside border
CN: PIPL applies to personal information processing activities within China (Art. 3 par. 1). PIPL also applies to an activity conducted outside China to process personal information of natural persons within China when the activity is purported to provide goods or services to the natural persons within China, or analysis or assessment of behaviour of natural persons within China, or fall inside other criteria provided for by laws or regulations.
EU: GDPR applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not (Art. 3 (1)). GDPR also applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to the offering of goods or services to such data subjects in the Union, or related to the monitoring of their behaviour as far as their behaviour takes place within the Union (Art. 3(2)).
Apparently, the two pieces of legislation by China and EU are consistent in effect on the point of taking location of information subjects as basis for law application.
It is interesting to compare the criterion "activity within border" by China and the criterion "activity of an establishment of a controller or a processor within border". Not to make it too complex, an example is here to test the question: what happens if, for example, an outside establishment of an inside company processing personal information of subjects outside the border?
It’s necessary to split it into two cases for analysis.
The first case is where outside establishment behaves independently, for example, it provides processing service to an outside third party. In this case PIPL does not apply as the activity is outside China border. But answer is not so definite when comes to GDPR. Some think GDPR does not apply either, because the inside company is neither a controller nor a processor in this case. The headquarter information security commissioner of a EU company I used to service seemingly thought differently. The China branch was requested to follow GDPR, though the China branch processed nothing in relation to EU persons.
The second one is where behaviour of outside establishment is controlled to a certain extent by inside company. In this case GDPR definitely applies as it is an "activity of an establishment of a controller in the Union". It is arguable when comes to PIPL. For example, when the China headquarter enforces a certain sort of technical or service quality standards, is it an activity of "autonomously determine processing means" as defined by PIPL?
For those just discussed, we recommend clients to closely observe legal development within the the two regions.
One tip here is, the expression in GDPR English version "establishment" of a controller or a processor, should not be understood simply as a company, even not simply as an office. Legal form is not the criterion. An engaged consultant may also constitute an establishment.
?enforcement outside border
CN: personal information processor must take necessary measurements to assure personal information processing activities of an outside recipient reach the standards of personal information protection provided by PIPL. (Art. 38 par. 3).
EU: a controller or processor may transfer personal data to a third country or an international organization only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available, unless EU has decided that the third country, a territory or one or more specified sectors within that third country, or the international organization in question ensures an adequate level of protection. All provisions in relation to transfer of personal data to third country or international organization shall be applied in order to ensure that the level of protection of natural persons guaranteed by GDPR is not undermined.(Art 44、46(1))
Although many requirements are put up for transfer of personal data to recipient outside border, what if the outside recipient does not comply after reception? Both China and EU has impose duty of "assurance" on the insider controller and processor.
In practice, this requires the inside organization carefully examine personal information protection idea, method, capacity and the like of outside organizations on one hand and on the other hand the inside organization is required to control outside organizations via instruments such as agreements, so that, in case victimization takes place, an information subject is able to seek remedies via proper approach, for instance, sue the outside and/or inside organization in the light of agreements.
Meanwhile, the inside organization not properly performing "assurance" duty may, depending on situations, be given administrative punishment. Responsible person in China may also face criminal penalty.
conclusion
To a personal information processor, compliance to personal information protection law is a corporate governance issue , in some sense: a company must set up proper personal information protection institute internally in line to legal requirements, invest adequately to construct personal information protection infrastructure and give staff sufficient training, and in the meanwhile prepare proper corporate regulations to ensure staff behave in accordance to requirements of the law.
