Exploring Personal Information Protection Issues in the Context of Generative Artificial Intelligence

Abstract

The full-chain mechanism of generative artificial intelligence—comprising the stages of “preparation–computation–generation”—has fundamentally transformed conventional modes of data processing. This transformation directly and substantively challenges traditional personal information protection frameworks. At the same time, it introduces a range of embedded risks, including data misuse and the opacity of the algorithmic black box As a result, existing regulatory mechanisms such as informed consent are increasingly ineffective in large-scale and highly automated application scenarios. In response, this paper proposes a regulatory framework oriented toward personal information risk prevention and control. Specifically, the framework emphasizes strengthening regulation to constrain key actors, employing privacy-preserving computation technologies to define AI-adapted legal rights and compliance standards, and enhancing users’ ability to exercise their rights effectively. Through these measures, a governance structure can be established in which technology, institutions, and responsible actors operate in coordination, thereby achieving a genuine balance between technological innovation and personal information protection.