“個人信息侵權”方案的反思及其重塑

Reshaping the Tort liability for Infringement of the Personal Information Right

以個人信息自決權為理論基礎、抽象風險損害化為構建策略的“個人信息侵權”方案，在司法實踐中暴露出衝擊侵權責任制度、不當限制行為自由、誘發訴訟泛濫等缺陷，正當性存疑。個人信息權益並非個人信息自決權，而是以控制處理風險為目的的工具性權利，其與私法人格權構成屏障結構而非並列關係。侵害個人信息權益僅造成抽象風險的，個人信息權益本身即可為個人提供控制手段，將抽象風險視為損害的侵權責任方案擴張失度且無必要。侵害個人信息權益的損害賠償責任，仍應以損害發生為前提。當非法處理活動被主行為吸收時，不成立“個人信息侵權”的競合形態與替代形態，侵權責任依主行為認定。單獨的非法處理活動符合侵權責任的違法性要件，歸責原則為過錯推定原則。

Creating a separate type of tort liability called ''personal information infringement'' is gaining popularity among tort law programs for protecting personal information right. ''Personal information infringement'' is based on the theory which asserts the personal information right as the self-determination right and the strategy viewing abstract risk as actual damage. Unfortunately, many prolems will arise once a separate personal information infringement program is established. From the perspective of the relation with the specific personality right, ''personal information infringement'' in judicial practice presents competing pattern, alternative pattern and independent pattern. Competing pattern is that the judge ruled that both personal information infringment and other personality were esrablished. Alternative pattern is that the judge ruled that personal information infringement was established, even though it established other infringements (such as infringement of the right to the name). Independent pattern is that the judge ruled that the personal information infringement was established, even though the activity doesn't establish any king of other infringement. However, form the perspective of judical practice, creating an independent tort ability for the personal information right infringement is nont a wise choice. Its legitimacy is doubtful for exposing flaws that undermine the existing system of tort liability, unduly restrict freedom of action, and induce a proliferation of litigation. As for the theoretical basis, the personal information right is a scenario-based and relative right, not a self-determining right. The fundamental characteristic of the personal information right lies in its risk control function, which is an instrumental right given to individuals to control the risk of processing personal information. It builds a protective barrier for a wide range of rights and interests, including private rights, and constitutes a barrier structure with the right of personality. There is no juxtaposed relation between the personal information right and personality right. In terms of construction strategy, where infringement of the personal information right only creates an abstract risk, the personal information right itself provides individuals with a more efficient means of controlling the risk, and the expansion of the tort liability, which treats the abstract risk as damage, is disproportionate and unnecessary. Tort liability for infringement of the personal information right needs to be based on that the damage has actually occurred, and the three judicial patterns can be connected to the existing tort liability system through the following arrangements. Firstly, if illegal use of personal information and other infringements are involved between subjects who have equal the capacity to controll information, since there is no relation of processing personal information, the victim does not own the personal information right. Thus, there is no infringement of the personal information right, neither competing pattern nor substitute pattern of ''personal information infringement''. Secondly, in the relation of processing personal information, when the illegal processing activity is absorbed by the main behavior, constituting a component or necessary means of the main infringement, it is unnecessary to apply the competing pattern or alternative pattern of ''personal information infringement'', and infringement liability should be determined in accordance with the main behavior. Principle of attribution of tort fallibility should be determined by the main behavior. Thirdly, if the damage is caused by separate illegal processing activities, it shall be recognized as a violation of safety and security obligations or protective laws, satisfying the illegality element of tort liability, and the principle of attribution shall apply to the presumption of fault.