Tuesday marked the first anniversary of the Personal Information Protection Law coming into force. Although people pinned great hopes on the law when it came into effect expecting that it would help set things right particularly in the internet sector, where people's complaints about the vulnerability of their personal information have been heard for a long time, the law has apparently not yet performed that function as anticipated.

For instance, the problem of personal information leaks and misuses remains serious and the abuse of facial recognition technology hasn't been addressed. It can be said that the law has yet to grow teeth, and some of its provisions need to be made more enforceable and more pertinent to specific problems.

Therefore, the judicial departments need to revise and refine the law. It is also necessary to formulate administrative regulations and department rules according to the law in the fields related to personal information protection so as to make the law more enforceable and effective in practice.

It is difficult to make the same rules for different scenarios in a short period of time. Therefore, judicial institutions such as courts should be encouraged to creatively enforce the law in individual cases, and representative personal information protection cases in specific scenarios should be used for reference as soon as possible.

This law enforcement model is more effective and efficient under current conditions, and it is also conducive to raising the public awareness of personal information protection, as the cases are more comprehensible to the general public.

An acute issue the law needs to address is about internet platform enterprises. The law should make it unequivocally clear that they must bear the main responsibility and fulfill their obligations to regulate the processing and protection of personal information. Something they have not done well, as some of them are still prone to using their advantages in data, algorithms, technology and platform rules to steer clear of the law to make profits in the grey zone.

To that end, the law should further clarify the specific responsibilities and obligations of the platform companies. That will be conducive to prompting the enterprises to behave themselves and take the initiative to protect personal information.

With the advancement of information technology and the development of the digital economy, new legislative and judicial requirements are being constantly put forward for the security of personal information. The country should keep up with this demand for the rule of law, and continually amend its legal systems in the field to guarantee sustainable development of the digital economy.