Abstract：In the era of digital economy, the balance between the protection, development and utilization of personal information is related to the legitimate rights and interests of individuals, and also determines whether the national digital economy can be stable and far-reaching. As an adjuster of the two kinds of interest relations, consent rule will play an increasingly important role. Therefore, the relevant legislation of personal information protection in various countries has clearly taken the consent rule as the legitimacy basis of personal information processing. However, in theory, scholars have been questioning the consent rule. Under the background that the Civil Code and the Personal Information Protection Law have been implemented, the normative effect of the consent rule itself is clear, and what is doubtful is the social effect measured according to the average compliance of the rule. Among practices, the effective implementation of the consent rule faces many obstacles, which has become an important issue that the theoretical and practical circles have to face. Compared with the traditional legal methods, game theory provides intellectual inspiration for people to understand how legal rules will affect people’s behavior through more objective and scientific quantitative analysis. What’s more, this theory is value free and shows the maximization of benefits, which has guiding significance for realizing the balance of interests of all parties. On this basis, we can contribute a new thinking path to the effective realization of the consent rule by analyzing the game process between the information subject and the data enterprise involved in the consent rule.From the perspective of game theory, the behaviors of the parties under the legal rules is consistent with the countermeasure behaviors in the game, which is a strategic interaction based on the interdependent interests of the actors. Among practices of personal information processing, the “consent” of the information subject and “collection and utilization” of the data enterprise are a typical mutual influence and interaction between the both sides of the game, and the relevant systems based on Article 1035 of the Civil Code and Article 13 of the Personal Information Protection Law as the core delineate the behavior framework of both sides. These behaviors will produce different results under the influence of different systems. In the process of the game between the information subject and the data enterprise, the information subject chooses the consent strategy and the data enterprise chooses to use personal information, which can promote the balance of the game between the two sides, and is also the ideal and effective operation state of the consent rule, while the cost is the key factor affecting the choice of the bilateral strategies. The effectiveness of the consent rule depends on the realization of the game equilibrium between the shareholders involved in the rule. Combined with the game analysis, it can be concluded that although the consent rule is still effective, it still needs some incentive measures to ensure its effective realization.In the future, the corresponding incentive mechanism should be built from both internal and external aspects. In terms of internal incentives, data enterprises should properly share the property interests of information processing to realize the privacy policy of “from scratch-from existence to excellence-from excellence to refinement”, and improve the level of personal information protection from the technical level. In terms of external incentives, the method of “specific enumeration + comprehensive investigation” should be adopted to clearly define the rational use of personal information, implement the limited right of consent withdrawal of information subjects, increase the cost of data enterprises violating laws, promote the application of public interest litigation and class action system for personal information protection, and establish a public-oriented personal information security assessment system for data enterprises. Therefore, building a personal data governance system that is both internal and external as well as “incentive-compatible” can promote the game equilibrium and ultimately benefit the effective realization of the consent rule.
冉克平, 刘冰洋. 博弈论视角下个人信息同意规则的有效实现[J]. 浙江大学学报(人文社会科学版), 2023, 53(3): 111-130.
Ran Keping, Liu Bingyang. Effective Realization of Personal Information Consent Rule from the Perspective of Game Theory. JOURNAL OF ZHEJIANG UNIVERSITY, 2023, 53(3): 111-130.
2023, Vol. 53 
