Normative Explanation and Systematic Construction of Rules of Processing of Sensitive Personal Information in China

Personal Information Protection Law of the People’s Republic of China establishes strict restrictive principles and the informed consent rules in order to provide special protection for sensitive personal information, which is a breakthrough from domestic and international legislations. However, there are still many shortcomings about its normative system and it needs to be adjusted. In terms of the specific way, we should apply the rank theory of civil-law rights and interests and the theory of reasonable expectation of privacy to construct the restrictive rules of “specific purpose” and “sufficient necessity” to reasonably limit their scopes of application. And we should impose “the aforementioned abligation of calling attention or giving explanations” on the information processors. Except for exceptiones, the processing of sensitive personal information shall be based on the principle of “written consent” of the information subjects. The concept of setting rules for handling sensitive personal information shifts from “informed consent” to “risk prevention” and a progressive response plan can be created so as to respond the concept. And the informed consent rules appears limited condtion and the informed consent rules should be reinforced by restrictive principles. The impact assessment model of sensitive personal information has changed from a single assessment model to a composite assessment model, and a standardized and coordinated system should be established to eliminate the series of problems arising from it.