Author Information

Zhang Xinbao, Professor, Law School, Renmin University of China

Abstract

The personal information protection of generative AI training language material should uphold the basic stance of encouraging and supporting innovation. To ensure that the personal information utilization needs of service providers can be met, the Personal Information Protection Law can be interpreted or made exceptions at the training end. For personal information that has already been disclosed, it can be included in the scope of processing by loosely interpreting the 'purpose of disclosure'. For undisclosed personal information, it is still necessary to use the individual’s consent as the legitimacy source of the processing. However, the difficulties faced by service providers can be alleviated by broadly interpreting the principle of purpose limitation and adjusting the relevant rules of 'notification-consent'. Increased technical barriers has exacerbated the disadvantageous position of information subjects, and it is necessary to ensure the exercise of the right to request personal information protection to protect the legitimate rights and interests of individuals, but its exercise is inevitably limited by technical realities. Service providers should strictly perform their obligations to protect personal information security, including technical measures, to minimize risks to personal information. The protection mechanism as a whole should be dominated by administrative supervision, and if the infringement of personal information rights and interests causes harm, the service provider should be allowed to use 'compliance with administrative supervision requirements' as a defense of non-fault.