论劳动者敏感个人信息保护

On the Protection of Sensitive Personal Information of Laborers

摘要: 敏感个人信息具备更强的算法识别性和风险损害性，立法保护也更为严格。基于劳资关系天然的对抗性、劳动者的从属性，劳动者敏感个人信息法律规制面临着告知同意原则适用失灵，法定处理前提范围过大等问题。首先明确告知同意原则和法定处理前提分别构成信息处理活动合法性评估的主客观标准，并以客观处理前提合规作为主要合法事由。结合从属性对劳动者同意的自愿性作出综合评估以弱化同意的法律效果。同时，应细化处理信息的目的，引入比例原则以有效限制法定处理前提，保证信息处理达到目的特定，手段充分必要的客观要求。

Abstract: Sensitive personal information has stronger algorithm identification and risk damage, and legislative protection is stricter. Based on the natural antagonism of labor-management relations and the subordinate nature of workers, the legal regulation of sensitive personal information of workers faces problems such as failure to apply the principle of notification and consent, and the scope of legal processing premise is too large. On the basis of drawing on the practical experience of European information protection legislation and labor disputes, it is first clarified that the principle of consent and the statutory processing premise constitute the subjective and objective criteria for assessing the legality of information processing activities, and the compliance of the objective processing premise should be taken as the main legal reason, and the voluntariness of the employee’s consent should be comprehensively assessed in combination with the subordinate nature to weaken the legal effect of consent. At the same time, the purpose of processing information should be refined, and the principle of proportionality should be introduced to effectively limit the premise of statutory processing, so as to ensure that the information processing achieves the objective requirements that the purpose is specific and the means are sufficient and necessary.