生成式人工智能应用中个人信息保护的法律困境与规范路径

Legal Dilemmas and Normative Pathways for Personal Information Protection in the Application of Generative Artificial Intelligence

摘要: 随着生成式人工智能的广泛普及，个人信息处理的模式发生了根本性的转变，并对现行的个人信息保护法规体系提出了新的挑战。《个人信息保护法》中现行的相关规定，虽旨在保护个人信息安全，但其主要针对的是传统互联网环境，在应对生成式人工智能领域时，暴露出诸多适用难题。本文针对生成式人工智能在个人信息处理方面的特性，对现行法律在告知同意规则、目的限制与最小必要原则以及已公开个人信息处理等方面存在的适用困境进行分析。在此基础上，围绕告知同意规则、个人信息处理合法性基础以及服务提供者合规义务三个方面提出完善建议，以回应生成式人工智能应用中的个人信息保护困境，为相关制度的完善提供参考。

Abstract: The widespread application of generative artificial intelligence has transformed traditional modes of personal information processing and posed new challenges to the existing personal information protection regime. The current information protection rules under the Personal Information Protection Law of the People’s Republic of China, which were primarily designed for traditional internet scenarios, face considerable difficulties when applied in the context of generative artificial intelligence. This article examines the characteristics of personal information processing in generative artificial intelligence and analyzes the practical dilemmas arising from the application of existing rules, particularly with respect to the informed consent rule, the principles of purpose limitation and data minimization, and the handling of publicly available personal information. On this basis, it proposes improvements in three key areas: the informed consent rule, the legal bases for personal information processing, and the compliance obligations of service providers, in order to provide a normative response to the challenges identified.