Abstract: With the iterative evolution of generative artificial intelligence, large-scale models represented by DeepSeek are expected to shake off the past path dependence of “algorithm stacking”. Nevertheless, attendant risks in personal information processing keep emerging and are deeply embedded in the risk chain covering data input, training and output. Driven by the profit-seeking attributes of capital, such risks are superimposed, giving rise to multiple hidden dangers: in the horizontal dimension, the “notice-and-consent” rules become a mere formality; in the vertical dimension, personal information is on the verge of leakage; and in the systemic dimension, the foundation of social trust gradually weakens. These phenomena suggest an urgent need to revisit compliance governance strategies. In view of the above, at the horizontal dimension, the substantivization of rules shall be promoted to consolidate the compliance foundation, and mechanisms such as technical empowerment, regulatory constraints, traceability, and accountability shall be relied on to break the vicious cycle of risks. At the vertical dimension, rationalized privacy-protection mechanisms shall be adopted to adapt to the characteristics of information flow, so as to safeguard personal privacy while taking public interests into account. At the systemic dimension, standardized risk-prevention mechanisms shall be established to fulfill the bottom-line requirements of enterprise compliance and respond to the interests of diverse stakeholders. Based on the above-mentioned rule-of-law approaches, feasible governance solutions can be offered to mitigate personal-information-processing risks arising from generative artificial intelligence.

Key words: generative artificial intelligence, personal information processing, data compliance, rule-of-law approaches

摘要： 伴随生成式人工智能的迭代演进，以DeepSeek为代表的大模型有望摆脱以往“算法堆砌”的路径依赖。然而，相伴而生的个人信息处理风险层出不穷，且已深度内嵌于数据输入、训练、输出三阶段风险链条之中。加之资本的逐利驱动，生成式人工智能个人信息处理风险呈现叠加态势，衍生出多重风险隐患：横向维度“告知—同意”规则流于形式，纵向维度个人隐私信息近乎泄露，系统维度社会信任基础逐步弱化，这表明亟须重新审视合规治理策略。有鉴于此，横向维度，通过推进规则实质化夯实合规基础，依托技术赋能、监管约束、溯源追责机制打破风险恶性循环。纵向维度，依托合理化隐私保护机制适配信息流动特征，在保障个人隐私的同时兼顾社会公共利益。系统维度，构建标准化风险预防机制，落实企业合规底线要求，回应多元主体的利益诉求。依托上述法治路径，以期为化解生成式人工智能个人信息处理风险提供可行治理方案。

关键词: 生成式人工智能, 个人信息处理, 数据合规, 法治路径