人肉搜索之法律爭議分析——數位足跡時代下的資訊自主權觀點

科技技術蓬勃發展，且各式網路服務廣泛地被大眾使用，造成使用者於網路之行為所留下的數位足跡（digital footprints）遍布於網際網路之中，這些四散的數位足跡資訊暴露於隨時可能被第三人蒐集、利用之風險，並且同時為業者基於商業利益而進行蒐集、儲存與分析。數位足跡的聚集效應（aggregation effect）使得資料主體的背景與生活細節得以經由個人資料的蒐集與分析加以得出，而這樣的漏洞也誘發了「人肉搜索」行為的產生。人肉搜索指的是網路使用者協力搜尋特定個人身分資訊或事件真相的集體行動，在網際網路發達的時代已是常見的網路現象，人肉搜索的結果也經常成為媒體與社會大眾關注的焦點。然而，人肉搜索同時是公眾表意自由的展現，卻又對於個人的資訊隱私權帶來新的挑戰，資料主體的隱私權與大眾的表意自由，及其背後所涉及的公共利益之間的衝突應如何加以平衡，實為值得探究之議題。本文試圖逐一檢視人肉搜索事件中，所涉及之各方——被肉搜之主體、參與肉搜之行為人、原始資料提供者，以及網路平台業者之相關規範，並分析現有規範架構所面臨之困境。同時，本文透過外國立法例之借鏡，提出自落實被遺忘權，並藉由納入隱私保護設計，以及強化網路平台業者應負之義務的角度切入，嘗試以調整對於資料主體的資訊自主權保護之觀點，提出建構管制人肉搜索之適當架構。

關鍵字

數位足跡；人肉搜索；資訊隱私權；資訊自主權；被遺忘權；隱私保護設計

並列摘要

With a significant boost in technology, Internet services have been widely used. Users’ digital footprints are spread worldwide on the Internet. These online footprints are at the risk of being collected and processed by a third party, and being used in products improvement by tech companies as well. The aggregation effect shows that modern data analytics can deduce extensive information about a data subject. Worse still, it could even trigger a doxing attack. “Doxing” means the action of retrieving, and publishing a person’s personal information that can be used to identify or locate an individual based on the information on the internet. Doxing has become ubiquitous in the cyberspace today and many results of doxing attract social debates. However, doxing invokes the dilemma that it is a form of expression protected by the constitution, while it also brings new threats to the right to privacy. How to balance the protection of the right to privacy and the interests of freedom of expression is a question worth discussing. This article delves into the legal challenges of doxing firstly by pointing the weakness of the current regulations to deal with this rising issue, providing a review over the rights and obligations of relevant actors—the data subject, the doxer, the resource provider, and the service provider. This article also analyzes related foreign jurisprudence and proposes three possible regulatory solutions—affirming the right to be forgotten, advocating “privacy by design,” and reinforcing the obligation of service providers. All the solutions aim to enhance the right of information self-determination.