Abstract: The informed consent rule is an important principle for legal processing of personal information in the Personal Information Protection Law. Its essence is that the personal information processor obtains the transfer of rights to process personal information through a contract signed with the information subject. However, informed consent presents a formalized dilemma in the practical scenario of personal information processing. In other words, the information subject is actually not aware of the legal consequences of the transfer of rights. The essence of this dilemma is that the informed consent rule is inherently unrealizable. The academic circles have proposed many solutions to the formalized dilemma of informed consent. Most of these solutions tend to repair informed consent rather than abandon it, and this direction has some defects. Whether to repair or abandon the informed consent rule is not the best approach. The best approach is to introduce the risk regulation theory to control the risk of personal information processing to a threshold while retaining the informed consent rule. The focus of this approach is that the existence of the informed consent rule is conducive to “potential claimants of rights” to claim personal information-related rights through private law, and the rights cannot be completely denied. Based on the risk theory, personal information protection should focus on the governance approach of de-risking. Based on the removal of social risks in personal information and considering its public nature, public law can strengthen the informed consent rule by providing a bottom-line protection. First, public law should ensure that personal information processors do not harm the information subject’s personal dignity, which is an important legal interest in personal information protection. Second, public law should supervise personal information processors and regulate the risks of personal information use to ensure that the risks of personal information processing are not too high.

Key words: personal information, informed consent, risk theory, public law complement, informed consent rule