網路平台個人資料之保護—以資訊透明化及控制權為中心

網路資訊之新時代，不僅改變了人們使用網路之頻率及習慣，也改變了大型網路平台業者（如 Facebook、Google 等）商業行銷之營利模式。該營利模式為了提供更有效率且個人化的廣告或行銷，需要大量使用者之個人資料及個人使用網路活動等資訊，然業者在使用各種技術蒐集、處理或利用這些個人資料或資訊時，往往未提供足夠或使個人得正確預料風險之資訊，而有「資訊透明化」不足之問題；在網路平台業者取得個人資料後，則將產生如個人得否撤回同意、行使各種介入手段之控制權(如被遺忘權)等問題，此皆導致個人在進入網路平台並面對這些網路業者時，處於資訊及地位極不對等之情況，而有重新檢討法制上隱私保護架構如何因應之必要。對此，歐盟最新之個人資料保護法制，相較於我國個人資料保護規範，除了對網站使用 cookies及類似技術之蒐集方式設有獨立法規加以細緻化應對，且對於業者資訊提供之方式、內容皆有更完整且嚴格之要求,並同時兼顧使用者閱讀疲勞之問題；對於資料自主控制權之部分，歐盟法規亦明文規定若干資訊上之權利，如刪除權、資料可攜權、反對權、撤回同意等權利，並明確其使用時機、操作方式及要件，頗值得我國參考。本文於比較我國與歐盟對上開問題之應對及法規建置，並審酌我國立法背景及脈絡後，對我國現行個人資料保護法制提出幾點大方向上之修法建議，例如將 cookies 及類似技術列入管制、加強資訊告知之要求、強化同意權及關係退出之主導性、當事人資訊取得與介入權利之建置，及更嚴格的罰則與配套措施等，希冀我國在資訊流動快速之時代亦能建立足夠且完善的隱私保護制度。

關鍵字

個人資料保護法；資訊隱私；歐盟個人資料保護基礎規則；歐盟電子通訊個資保護指令；網站； cookies ；目標式廣告；個人剖析

並列摘要

The new era of internet has not only changed the frequency and the habit of using internet, but also transformed the marketing model of the large-scale companies which provide internet-related services, such as Facebook and Google. In order to offer more efficient targeted advertising service, it is indispensable for the companies to collect personal data and tracking online behavior of users. However, when the companies use different techniques to collect, process or make use of the personal data, the information they provide for the users are not suffient to let users know the risk of providing personal data. It is the problem of “transparency”. After obtaining personal data, it will face the problems such as “Can users withdraw their consent?” or “Do users have rights or means to take control of their own personal data?. The problems bring about the phenomenon of information asymmetries and unequal status between network company and their users. Therefore, it is necessary to reassess the regulatory framework of data protection law in order to keep pace with the development of technology. In this regard, the European Union enact a new regulation on data protection, and also has other directives to protect information privacy. Unlike the data protection law in Taiwan, the European Union has a customized directive to regulate elaborately about cookies and similar technologies which collect personal information from users. In addition, EU data protection law not only sets a high standard for the modalities and the contents of providing information of processing, but also notices the problem of consent fatigue. Additionally, in the field of “data control”, EU data protection law stipulates a chapter about the rights of data subject, such as right to erasure, right to data portability, right to object and right to withdraw one’s consent，all with correspondent conditions in detail. The way European Union deal with the transparency and data control is worthy of emulation for Taiwan. This thesis compares data protection law in European Union with Taiwan when confronting e-commerce issues on the network platform, and has several suggestions on the data protection law in Taiwan. First of all, make sure cookies and similar technologies be included in the scope of data protection law. Secondly, reinforce the requirements of providing processing information from data controller. Thirdly, strengthen the right to withdraw consent and other rights for data subject to take back their control of personal data. Lastly, harsh punishments and other complementary measures like EU may also be necessary. This thesis hopes that the suggestions mentioned above can provide some directions for the amendments of Taiwan’s data protection law in the future and build up an adequate privacy protection system.