資訊委員的時代角色──以GDPR及英國2018年資料保護法為中心

The Role of the Information Commissioner in the Era of the GDPR and the DPA 2018 (UK)

本文所討論之主題為英國資訊委員在個人資料加值應用數位經濟時代下，所面對的實際挑戰以及相對應的法規工具和職權之實踐，並以劍橋分析案，分析資訊委員所實際踐行之職權及臺灣可能出現之挑戰與對應處理策略建議。英國2018年資料保護法（DPA 2018）明示該法大多數個資處理與保護方式均遵循歐盟之一般個資保護規則（GDPR），更將GDPR明定為個資保護規範主要來源。關於資訊委員之設置、任務及職權，於該新法中依然持續，並揭示資訊委員之一般職權與保障機關功能等係依循DPR。DPA 2018要求資訊委員就數個關於不同領域特殊個資處理面向，有提供行為準則（codes of practice）之義務外，亦新增數個資訊與通訊技術應用時代法規業務，例如公部門資訊再利用規則、資料留存規則、電子交易驗證與信任服務規則與網路架構與資訊系統規則等受資訊委員業管，於統整各項新興資訊法規的狀態下，資訊委員更能有效整合資源，並對於各項個人權利保護義務加以衡平。本文以劍橋分析案為例，分別就線上平台服務條款關於第三人利用個資之設計問題、人格特徵剖析與精準投放假新聞之面向，以及產學合作與特定目的外利用個資等問題提出資訊委員實際作為之觀察與分析。由於英國幾乎將該國所有與個人資料以及各類政府資訊以及線上資訊所可能牽涉之面向集中於個資委員，因此面對前述資訊與通訊技術對於個資加值應用議題以及該議題之網路跨國界性格，勢必需有更大的資源投入，也相對應地希望爭取更強之職權效果與執行能力。相對地，臺灣目前連一個獨立專責個資保護之機關亦尚未建立，或許未來得因此於面對該等挑戰時，付出更大之成本。

This essay aims to discuss the challenges and actions taken by the U.K. Information Commissioner’s Office (ICO) in the age of digital economy with value-added applications on ICT to tackle data protection challenges mentioned above. This will be supported by taking the Cambridge Analytica case as an example.The discussed aspects include increased globalism, evolving technology, the General Data Protection Regulation (GDPR), and Brexit. Targeting its significant powers on repeated, failures to take proper steps to protect personal data and deliver information rights, the ICO’s formal regulatory action will serve as an important deterrent where it needs to. The ICO’s areas of missioncoversthe Data Protection Act, the Freedom of Information Act, the Privacy and Electronic Communications Regulations, the Environmental Information Regulations, the INSPIRE Regulations, the eIDASRegulation, the Re-use of Public Sector Information Regulations, the NIS Regulations 2018, the Investigatory Powers Act 2016, and unsurprisingly, the GDPR. As to the case of the Cambridge Analytica, the investigationdone by the ICO includes a disturbing disregard for voters’ personal data. With concerns over social media platforms, political parties, data brokers and credit reference,agencies must have started to question their own processes-sending ripplesthrough the big data eco-system. The author believes that such a lesson would have enough reference experiences enforcing the belief that an independent regulatory institution is essential.