Article 73 of the Personal Information Protection Law gives the definition of automatic decision-making: "It refers to the activity of automatically analyzing and evaluating an individual's behavior habits, hobbies or economic, health and credit status through computer programs, and making decisions". Can the analysis, evaluation and decision-making process in this definition include human intervention?
This paper holds that the above process can only be carried out through computer programs without human intervention. On the one hand, from the point of view of literal interpretation, the definition makes it clear that analysis, evaluation and decision-making are automatically carried out by computer programs. On the other hand, it is more obvious from the perspective of systematic interpretation. Paragraph 3 of Article 24 stipulates that "individuals have the right to ask their personal information processors to explain the decisions that have a significant impact on their rights and interests through automated decision-making, and have the right to refuse personal information processors to make decisions only through automated decision-making." What an individual has the right to refuse is the decision made by the personal information processor only through automatic decision-making, and the "automatic decision-making method" does not include human factors.
Second, can you refuse marketing advertisements "for free"?
It has become a normal state in the industry for merchants to combine consumer personal information and behavior data obtained in the process of providing goods and services to make user portraits and conduct precise marketing. If the above-mentioned behaviors are made through automated decision-making, they will be adjusted by Article 24 of the Personal Information Protection Law, requiring that "options that are not specific to their personal characteristics should be provided at the same time, or refusal methods that provide convenience to individuals". Judging from the legislative process, the first draft does not require personal information processors to provide refusal services for commercial marketing and information push to individuals, but the formal draft further requires that refusal services should be "convenient".
However, there is no direct regulation on whether the subject of personal information can refuse "free". For example, who will pay for sending an unsubscribe push message? However, the star clause stipulates that it is the obligation of the information processor to refuse to provide convenience to individuals. If the expenses arising from visa refusal are borne by the personal information subject, it will bring heavy and possibly unnecessary obligations to the personal information subject. Judging from the judicial practice, the court also adopted similar views and logic.
In the online shopping contract dispute case between Wang and a company tried by Beijing Internet Court (see (2020) Jing 049 1 Civil Judgment No.9057 at the beginning of the Republic of China), the user agreement and privacy policy on a company platform provide users with three ways to refuse information: one is to ask a company to stop pushing; Second, according to the SMS unsubscribe guidelines, a company is required to stop sending promotional information; Third, by setting it in the mobile device, you will no longer receive messages pushed by the company. The court held that it was effective for a company to unsubscribe from commercial advertising messages and commercial advertising information to Wang. Wang's unsubscribe from commercial messages was an act of refusing to receive, not an act of fulfilling his obligations. Therefore, the cost of unsubscribing commercial SMS should be borne by one of the contractual obligations, that is, a company.
Third, who will judge whether it has a "significant impact" on personal rights and interests?
Judging from the legislative procedure, the first draft adopts subjective standards. As long as "individuals think" that the automatic decision-making process of personal information processors has a significant impact on their rights and interests, personal information owners will enjoy the corresponding relief rights. This kind of subjective judgment standard completely depends on the owner of personal information, and the second review draft is not used. The second draft deleted "personal opinions" and was adopted by the official draft. In terms of expression, it can be regarded as an objective standard. Only "personal opinions" have a significant impact on personal rights and interests, and may not be enough as a reason for obtaining relief.
Four, how to define "a significant impact on the rights and interests of personal information subjects"?
(Article 7.7 of Information Security Technology Personal Information Security Specification: Use of Automatic Decision-making Mechanism of Information System) If the information system used by the personal information controller in business operation has an automatic decision-making mechanism and can have a significant impact on the rights and interests of personal information subjects (for example, automatically determining personal credit and loan lines, or automatically screening interviewers, etc.). ), it should: a) carry out personal information security impact assessment at the planning and design stage or before the first use, and take effective measures to protect personal information subjects according to the assessment results; B) Conduct regular (at least once a year) personal information security impact assessment during use, and improve measures to protect personal information subjects according to the assessment results; C) Provide complaint channels for automatic decision-making results to personal information subjects, and support manual review of automatic decision-making results. )
For more information, please contact Sister Sa's team.
zhengchi.wang@dentons.cn
Office mailbox:
zhengchi.wang@dentons.cn
guangtong.gao@dentons.cn