个人信息的利用与保护间的平衡一直是学界与业界的热点，当前的国际立法趋势已经从单纯的个人信息权益的保护转向用更精细化的规则以实现个人信息保护与利用的双赢。科学研究领域在我国一直是对数据需求量最大的领域之一，但是受限于严格的个人信息保护规则，该场景下的个人信息处理仍然需要信息主体的知情同意，并且信息处理者需要履行包括告知在内的一系列义务，而科学研究中数据利用目的的多变、授权同意的不稳定以及获取同意的高额成本都会让科学研究因为数据的问题面临一定的干扰。反观国外，不论是欧洲的GDPR、英国的DPA还是韩国巴西等国家的数据保护法令，都规定了基于科学研究目的的个人信息合法处理规则，信息处理者得以更加便利地收集数据以开展科学研究。事实上，我国的国家标准中以及《民法典》内，都暗含了增加科学研究目的作为个人信息处理合法性基础的可能性，并且在一些具体的科学研究领域比如说生物和医疗健康研究领域已经有了类似的相关规定。此外，从法经济学和法律的可约束性来看，增加科学研究场景后不仅仅可以更好促进整个数据利用的效率，还能很好地维护法律的可约束性。通过赋予以科学研究为目的的信息处理者知情同意的豁免，可以便利其获得新的数据来源。而为了维护好该豁免场景下个人信息权益和公共发展利益的平衡，可以对个人信息数据的利用形式进行如下分类：（1）区分一手数据和二手数据，二手数据可以直接豁免知情同意的要求。（2）区分状态类数据和事件类数据，除了二手数据，一手数据中的事件类数据也可以直接豁免知情同意的要求。（3）区分一般数据和敏感数据，前述两种豁免场景都只适用于一般数据，任何敏感数据的收集和利用仍然不能脱离知情同意的约束。并且在具体的收集和利用过程中，所有的信息处理者都需要及时告知相应的信息主体收集和利用的相关状况，如果信息主体的个人权益遭到侵害并找不到确定的侵权主体，应该由所有的在该豁免场景下收集和利用个人信息的信息处理者共同承担补偿责任，除非其能够证明该权益的侵害与其无关，并且可以引入科学研究信息安全责任险以更好地保护信息主体的权益。在具体的责任分配上，一手数据的信息处理者应该较其他处理者承担更高的补偿责任，总体的补偿比例也可以由法院酌情调整。
The balance between the use and protection of personal information has always been a hot topic in academia and industry, and the current trend of international legislation has shifted from the protection of the rights and interests of personal information to the use of more refined rules to achieve a win-win situation for both the protection and use of personal information. The scientific research field has always been one of the fields with the largest demand for data in China, but due to the strict personal information protection rules, the processing of personal information in scientific research scenarios still requires the informed consent of the information subject, and the information processor needs to fulfill a series of obligations such as notification. The variability of the purposes of data use in scientific research, the instability of the information subject‘s authorized consent, and the high cost of obtaining consent all make scientific research face certain interference due to data problems. On the contrary, foreign countries, whether it is the GDPR in Europe, the DPA in the UK or the data protection decrees in countries such as Korea and Brazil, all provide for the legal processing scenarios of personal information based on scientific research purposes, and information processors are able to collect data for scientific experiments more conveniently.In fact, the possibility of adding scientific research purposes as a basis for the legality of personal information processing is implicit in our national standards and in the Civil Code, and there are already similar regulations in some specific scientific research fields such as medical and health research. In addition, from the viewpoint of legal economics and legal bindingness, the addition of this research scenario will not only better promote the overall efficiency of data utilization, but also make the existing law more legally binding.By granting an exemption from informed consent to information processors for scientific research purposes, access to new data sources can be well facilitated. And in order to maintain a good balance between the rights and interests of personal information and the interests of public development in this exemption scenario, the following classification of the forms of utilization of personal information data can be made: (1) Distinguish between primary data and secondary data, and secondary data can be directly exempted from the requirement of informed consent. (2) Distinguish between state-based data and event-based data. In addition to secondary data, event-based data in primary data can also be directly exempted from the requirement of informed consent. (3) Distinguish between general data and sensitive data. Both of the aforementioned exemption scenarios only apply to general data, and the collection and use of any sensitive data still cannot be exempted from the requirement of informed consent. If the personal rights and interests of the data subject are infringed and the infringing party cannot be identified, all the information processors who collect and use personal information under the exemption scenario should be jointly liable for compensation, unless they can prove that the infringement of their rights and interests is unrelated to them. And it is possible to introduce scientific research safety liability insurance to better protect the rights and interests of information subjects. In terms of specific allocation of liability, information processors of primary data should bear a higher liability for compensation than other processors, and the overall percentage of compensation may also be adjusted at the discretion of the court.
