Balancing between protection and use
Wang Sixin, a professor of law at the Faculty of Literature and Law, Communication University of China
The most tricky issue legislators across the world, including China, face is to maintain a delicate balance between promoting the development of the internet industry and adequately protecting individuals' private information.
Given that internet companies need to utilize users' information to improve their services and products, their growth could be stalled if a law on personal information protection is overly strict and puts too many restrictions on their operation.
In this sense, the General Data Protection Regulation that the European Union implemented last year offers some food for thought. Aimed at giving individuals control over their personal data, the act has an iron grip effect on internet companies' development.
As an emerging internet giant, China cannot afford to stifle the internet sector, as it has created a significant number of jobs and spurred China's growth over the last few years.
Therefore, it is important that the legislators strike the right balance between protection and use of individuals' information.
Besides, it is also important to distinguish among different types and sizes of companies and to treat them differently. For instance, internet giants such as Tencent, JD and Alibaba may be more motivated to invest capital and resources to protect users' privacy because any failure to do so would impair their reputation and brand image, while medium-and micro-sized enterprises may be financially or technically strained to offer such protection to users.
The proposed law should take care of these subtleties, so as to prompt all entities to safeguard individuals' information.
Moreover, due attention should be paid to the disparity of power among regulators, enterprises and individuals. Since individuals cannot control the flow and use of their personal information, they cannot prevent them from being misused. The proposed law should address and correct this problem and give individuals more control over their personal information.
In addition, the regulators, who actually don't own the personal information data, will step in to settle any disputes only after a problem arises. This could lead to a mess, which could be prevented if the authorities are given the power to regulate at an early stage. As such, it is very important to establish a foolproof working relationship among regulators, enterprises and individuals.
