风险管理模式下的数据保护影响评估制度

伴随大数据时代个人信息保护领域风险管理理论的广泛应用，数据保护影响评估已经成为推动个人数据保护的重要制度。运用文献研究、实证分析的方法，以2016年欧盟《一般数据保护条例》（GDPR）对数据保护影响评估的规定为样本，深入分析数据保护影响评估的理论背景、兴起与演变、含义、适用范围等内容，以期搭建规范、明确的影响评估制度，加强个人信息保护。数据保护影响评估内容不限于隐私风险评估，还包括数据安全、数据质量、非歧视等内容；对于容易带来高风险的数据处理行为，应设定数据保护影响评估为强制性义务；评估过程应听取利益相关者的意见，反映其利益需求；加强外部监督并适度公开评估报告。

Data protection impact assessment system in the mode of risk management

In the era of big data,the risk management approach has been broadly applied in the field of personal information protection.Data protection impact assessment has become an important system to promote data protection.It takes the provisions of the data protection impact assessment of the European General Data Protection Regulation (GDPR) 2016 as the sample.By using the literature research and empirical analysis method,it analyzes in depth the theoretical background,rise and evolution,meaning and scope of data protection impact assessment to establish a standardized and specific impact assessment system as well as promote personal information protection.Assessment content includes not only privacy risk assessment,but also data security,data quality and non-discrimination.Data protection impact assessment should be set as a mandatory obligation for data processing activities that are likely to result in high risks.The evaluation process shall take the advices from stakeholders to reflect their benefits.The external supervision should be strengthened and the assessment report shall be published properly.