網路時代個人資料保護之強化──被遺忘權利之主張

The Enforcement of Protection of Personal Data in Internet Era: The Claim of the Right to Be Forgotten

近年來因資訊科技及雲端運算之發展，政府或民間業者透過各種電子掃描裝置或電腦終端設施，大量、快速蒐集、儲存個人資料，再透過網路連線進行組合、比對後形成特定人之圖像，利用於當事人未知之目的上；又因網際網路乃無國界、無時間限制，上傳於網路之資料即半永久留存，無限制擴散，個人對自己資料之自主權因而無法落實，乃至於權利受損。而面對上開狀況，現有個資保護法規明顯有不足之處，受到極大挑戰。因此二○一二年有關保護個資之國際公約均進行法規之修正，一方面強化對個資當事人之權利保護，承認資訊當事人之「被遺忘權利、「拒絕人物側寫」等權利；另一方面加重蒐集、處理個資者之義務，以建構符合時代需求之個資保護法制。修正之法規中，以「被遺忘權利」最受爭議，加諸歐盟司法法院於二○一四年五月作出先決判決後，更在歐洲與美國間掀起論戰。本文先介紹自二○一二年以來世界有關保護個資法修正之方向及其重點，再說明被遺忘權利之意義及要件，分析歐盟司法法院判決之事實概要、爭點及法律見解，並討論歐盟與美國間不同之觀點，及判決後歐盟及Google所公布應對指針。最後依我國個資法相關規定分析檢討被遺忘權利在我國實現之要件，並檢討最近我國法院判決之實務見解。

The new claim of personal data protection in the internet era. In recent years, because the rapid development of communication’s technology and ocloud computing, Govement or private industry through varied electoric scanner or computer terminal can rapidly coolect and store a large quantity of personal data, and all kinds of the specific personal data are easily matched and formed a personal files. On account of internet is without border, no time limits, once the personal data is uploaded on internet, that is simi-permanent preserved and unlimitedly proliferated. The subject of data can’t control his personal data completely, even the right of the subject will be hurted. In face to such condition, the personal data protection Act is obviously inadequate. Thus in 2012 the international covention for personal data protection regulation are going to be amended, on one hand to strengthen protection the right of individuals, therefor recognize the right to be forgotten, refuse personal data profiling be made. On the other hand, increase the obiligation of data controller to construct a complete system for personal data protection. After the judgment of the European Court of Justice in the case “Google Spain SL, Google Inc. v. Agoncia Española de Protección de Datos (AEPD), Mario Costeja Conzález” was announced in May 2014, it set off a debate between European and the United States. This article the first describe the important amendments of General Data Protection Regulation of the European, then explain the significance and requirements of the right to be forgotten. Analysis the merits of judgment about Google Spain SL, Google Inc., analysis the legal opinions of the judgment. And also introduce Article 29 data protection working party guideline and the criteria for assessing delisting request suggested by the Advisory Council to Google. Finally in accordance with the relevant provisions of personal data protection Act in our country, discuss the legal requirements of the right to be forgotten, deliberate the court decisuon in recent.