大數據與隱私－以資料合理使用為中心

大數據技術以及各式科技的蓬勃發展下，本文嘗試探討大數據技術挹注下所誘發的新型態隱私問題；聚焦於數據資料的合理使用範圍，試圖點出科技創新下的隱私疑慮，並試圖探求隱私保護與數據使用間的平衡點，以避免一方之偏廢。大數據作為相對新穎的技術，仍處於高度發展階段，充滿多樣的發展可能，而對於動態對象，監管制度的設計將更顯困難；當新技術所誘發的爭議與過往相異，法律應否介入，以及該如何介入將成為挑戰。進入大數據與隱私的關聯性討論之前，本文將先行爬梳「隱私」的法律意涵。本文認為時代背景轉換下，對隱私應有不同的詮釋以符合實際需要，尤其不應將保護客體禁錮於物理性的絕對保密事項。本文並著重於資訊隱私權的討論，強調個人的資訊自主控制權能，除了特定資訊的是否公開之外，公開的程度、對象與範圍均應由資訊主體所確實掌控。而與資訊隱私緊密攸關的資料本身，亦面臨形態上的大幅轉換；電子化與數位化使資料突破時空的物理限制，賦予資料快速出產並傳播的可能性，而傳播效率將影響隱私保護客體範圍的界定，以及資訊自主權的實踐。大數據技術，使資料型態、規模與利用方式均和傳統資料處理模式產生了相當差異，而大數據技術大量蒐集、長期儲存資料等特性，以及大數據分析所追求的意料外關聯性發現，均與「最小化原則」、「目的限制原則」與「告知後同意原則」等現行資料保護原則相扞格，進而引致資料保護上的疑慮。除了資料的隱私風險，大數據技術與其應用亦引發對個人的過度揭露、選擇權限縮以及歧視等爭議，此為應儘速處理之問題。本文以劍橋分析案與Covid-19防治中的大數據技術應用為例，試圖具體建構出大數據技術應用的廣泛可能性，強調資料處理技術於今日社會中對於個人，以及對於社會群體的影響性。數據應用的影響性隨相關技術發展，具備隨時變動、更新之可能，因此有著難以預期、預防的特性；監管面與科技發展間的競逐，將影響數據技術應用適法性的界定，應謹慎應對之。考量資料處理技術的日新月異，與大數據所具備的快速性、大量性與多樣性特質，相關規制應如何設計，以應對現在以及將來對資料保護的挑戰，是需要正視的問題。作為數據主體的個人，於享受大數據技術應用在內的新興科技所賦予的生活便利性的同時，應對自身資料與隱私投注更多的關注，以維自身權益；尤其資訊自主的落實，更是以個人對自己資訊的存在、蒐集、處理與利用行為的認知為必要前提。希冀能夠藉由本文所探討的現象與爭議，對身處資訊、數位社會下的個體，提出關於自身數據以及隱私權利間關聯性的提醒與警示。

關鍵字

大數據；隱私；資訊自主權；個人資料保護法；歐盟一般資料保護規則

並列摘要

The modern era has brought about the burgeoning of Big Data and other technologies, which along with its staggering advances has presented humankind with dilemmas anew. This thesis shall endeavor to tackle the new pattern of privacy issues that stem from the aforementioned novel technologies. Focusing on the fair use of data, this thesis aims to dissect and analyze the balance between privacy protection and usage efficiency. Big data, as a relatively new domain, is still in a highly developmental stage and is charged with diverse possibilities. As a rather dynamic regulatory object, Big Data brings forth challenges to the infrastructure of the regulatory system. A particularly notable issue is whether legal regulations should intervene when new technologies invoke novel disputes, and if so, what form this legal intervention should take. Before initiating the discussion about Big Data and privacy, this thesis will first examine multiple facets of the legal meaning of “privacy”. Taking into consideration the change in times, the definition of privacy should be amended to be volatile enough to fulfill specifically designated purposes, and should not merely be constricted to strictly confidential ones. This thesis focuses on information privacy, and emphasizes the importance of information self-determination. The information itself, which has a definite and intense correlation with the concept of information privacy, has also been thrust into constant metamorphosis in the digital era. When digitalization helps break down the barriers caused by limitations on time and space for information dissemination, it poses new predicaments upon the definition of protected objects and the practice of information self-determination. Big Data and relevant technologies make significant alterations to the usage pattern and scale when compared to traditional information processing. Broad collection and long-term storage of data being the essence of Big Data, and the unpredictable interrelationships it seeks, violate the information protection principles such as data minimization, purpose limitation, informed consent and so forth. Beyond privacy concerns, Big Data also triggers controversies about the overexposure of data subjects, limiting freedom of choice and discrimination, which should be settled as soon as the situation permits. Utilizing Big Data technology appliances in Cambridge Analytica and the containment efforts of COVID-19 pandemic as examples, this thesis intends to draft in detail the blueprint of the enormous potential from usage of Big Data, and emphasize the influence it stands to bring to individuals or social communities. The impact of Big Data heavily depends on the development of relevant technologies, which have the tendency to update or transform at any time, therefore it is difficult to anticipate or prevent relevant risks. The outcome of the steeplechase between regulatory and technological development will influence the determination on legality, which should consequently be handled with utmost care. Considering the ascendency of information processing technologies, and the core attributes “velocity, volume and variety” of Big Data, another detrimental issue is how the relevant regulations should be calibrated to handle the challenges to data protection for the present and future. As data subjects, individuals should pay more attention to their information and privacy when taking advantage of the conveniences brought about by those novel technologies. Especially the practice of information self-determination, is based on one's cognition about the existence, collection, processing and usage of personal data. By discussing the previously mentioned phenomena and controversies this thesis shall strive to serve as a reminder for people that live in the digital society and information era the importance of the relation between personal data and the right to privacy.