A Study On The Definition And Legal Protection Of Sensitive Personal Information

There is a category of personal information which is known as “sensitive personal information” because it is so sensitive in its nature,if improperly collected or handled,may cause serious harm to the interests of the data subject.As an important issue of the personal information protection law,many jurisdictions,such as the EU,Japan and Australia,have made explicit provisions on sensitive personal information.However,our country has not yet introduced the concept of “sensitive personal information” into the law.The first part of this paper explores the origin of the concept of “sensitive personal information”.The study found that back in 1980 s,the issues of sensitive personal information have already been discussed by the OECD Expert Group in its OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.Later,for the first time in history,the European Council introduced sensitive personal information into an international convention called the No.108 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data.The concept has since been accepted by European Contracting States.Besides,the concept of sensitive personal information is also reflected in the Guidelines for the Regulation of Computerized Personal Data Files,which is published by the UN in 1990.The second part studies the concept of “sensitive personal information”.In this part,the author makes a comparative study on the relevant legal provisions of the European Union,Japan,Australia,Switzerland,Taiwan and Macau.Comparing the definition of sensitive personal information in the extra-territorial legislation,it can be found that some personal information is generally considered to be sensitive,regardless of its socio-cultural traditions,such as “race”,“political opinion”,“religious belief” “qualification of labor union”,“sex life” and “health information”.Many jurisdictions have also classified “criminal information” as sensitive personal information.In addition,personal information such as “sexual orientation”,“genetic information” and “biometric information” are increasingly being identified as sensitive personal information,a trend that is reflected in the innovative concept of sensitive personal information in the EU and Australia.The third part studies the definition of “sensitive personal information”.It can be drawn from the analysis of the relevant provisions of foreign jurisdictions in the second part that the vast majority of jurisdictions that have introduced “sensitive personal information” or similar concepts use a method of “enumeration” to define sensitive personal information.In addition,there are some ways to define sensitive personal information,such as “context approach”,“purpose-based approach” and “privacy approach”.This paper argues that enumeration is not only a common practice in the definition of sensitive personal information,but also has the strongest legal certainty,which makes it the best choice for our country.The fourth part studies the difference protection mechanism of sensitive personal information and its civil law value.In order to prevent sensitive personal information from being improperly collected or used,foreign legislation generally prohibits the processing of it as a general principle.As an exception to this principle,jurisdictions generally provide for the exception of situations in which sensitive personal information can be dealt with,with “consent of the data subject” being particularly important because it is the embodiment of the principle of the autonomy of private law in the field of personal information protection.Enhancing the difference protection mechanism of sensitive personal information is not only beneficial to the protection of the rights to personal information,privacy and other personal rights,but is also important to promote the balance between informational autonomy and the freedom of information.In addition,the difference protection mechanism also helps to establish the obligations of the data controller and is particularly helpful in the identification of personal information infringement liability,which both have strong civil law value.In order to strengthen the protection of sensitive personal information and balance the conflict between the protection and utilization of personal information,China should introduce the concept of “sensitive personal information” in its personal information protection law.Specifically,China should define sensitive personal information by enumeration,taking also its socio-cultural traditions into consideration.As a principle,the processing of sensitive personal information should be prohibited,except in exceptional cases provided by law.