Government data has become an important part of the data market. However, regarding the privacy protection of citizens' personal information in the process of opening government data, there is still a lack of rigorous institutional logic and norms. The openness of government data faces the dual problems of data security and privacy protection. It is necessary to replace the traditional normative model of privacy rights with the system of personal information use and protection, and to construct the two aspects of "data controller's information security obligation" and "data identification subject's information rights". Metasystem. On this basis, it is necessary to build a mechanism for the information subject to express consent and exercise the right to object; at the same time, a comprehensive information security assurance system including technical means specification, management mechanism and institutional design should be built to implement data security responsibilities.