網路上隱私權政策之效力：以美國法為中心

The Enforceability of Online Privacy Policies: Focusing on the U.S. Laws

隱私權政策，係網站將如何對待網路使用者個人資料之書面聲明。倘網路使用者同意或信賴隱私權政策之聲明，是否即具有契約效力，應視隱私權政策是否符合網路定型化契約之成立要件而定。
除隱私權政策內容欠缺明確性或顯失公平之否定見解外，隱私權政策倘以顯著方式通知或公告而使網路使用者能確實或積極知悉相關條款，則網路使用者藉由繼續使用網頁而表示對於隱私權政策相關聲明條款之要約加以接受或承諾之意思，即足以在網站與網路使用者間成立關於隱私權政策之瀏覽拘束契約，實不以網路使用者明示同意為必要。
惟美國實務上，除少數案件認為隱私權政策具契約效力外，以違反隱私權政策而求償之多數案件，卻被法院駁回，因隱私權政策不被視為契約或未能證明損害。因此，倘屬不公平或欺罔之隱私權政策，主要由美國聯邦貿易委員會加以解決。
在我國，按消保法，定型化契約條款倘以顯著方式明示或公告而有合理機會審閱，並經網路使用者明示或默示同意後，即成為契約之內容。因此，隱私權政策倘符合上開要件，亦得成立瀏覽拘束契約。惟按2010年4月27日修正之個人資料保護法，對於個人資料之蒐集、處理或利用應經當事人書面同意，故得否僅以網路使用者繼續使用網頁之行為即認定構成瀏覽拘束契約，不無疑義。而2015年12月15日最新修正之個資法，則不再全面要求以「書面同意」方式為限。

A privacy policy is a written statement of a website about how to treat personal information of its website visitors. In case the website visitors consent to or rely on the privacy policy, its enforceability shall depend on whether it meets the requirements of online standard-form contracts.
Unless the content of a privacy policy is ambiguous or unconscionable, it shall constitute a browsewrap contract between a website and its respective visitors in case the privacy policy is conspicuously noticed or posted to enable website visitors to have reasonable opportunity to read and understand its terms and conditions and, then, they accept the offer of such a privacy policy by the website through continuing the use of webpage even without express consent.
In the United States, only a court admitted that a privacy policy constituted a contract. However, most claims for breach of privacy policies were rejected by courts because privacy policies were not deemed as contracts or damages were not validly evidenced. Consequently, an unfair or deceptive privacy policy will be normally enforced by the Federal Trade Commission.
In Taiwan, pursuant to the Consumer Protection Law, in case the terms of a standard-form contract are expressly illustrated or posted in a conspicuous manner to enable website visitors to have reasonable opportunity to read and, then, expressly or impliedly consent to them, such terms shall constitute part of the contract. Therefore, a privacy policy meeting the aforementioned requirements shall constitute a browsewrap contract. However, pursuant to the Personal Information Protection Act of 2010, a written consent of the data subject shall be obtained for collecting, processing or using his/her personal informaton. It is doubtful whether to deem the simply continuing use of webpage by a visitor as consent to constitute a browsewrap contract. Consequently, a consent of the data subject may not obtained in written form according to the newly-revised Personal Information Protection Act in 2015.