《個人信息保護法》下國家機關之功能角色

2021年8月20日通過的《中華人民共和國個人信息保護法》作為第一部完整規範公民信息處理使用限制之法規，相對《民法典》人格權編之規定，大規模參考了《歐盟通用數據保護條例》。就國家機關各類個人信息處理行為，相對一般私主體設定獨立合法性基礎。相對於傳統民法私權保障模式，在草案通過前夕，有必要建立憲法上個人信息自決權作為該草案之基礎，俾確立國家機關在個人信息保護法下作為信息處理者之功能角色。觀察德國《聯邦個人信息保護法》及我國台灣地區個人資料保護有關規定，皆是在該信息自決權框架下的具體化展現，借以同時兼顧行政機關任務履行及個人信息權益之保障。特別是關於公務機關個人信息的收集及傳遞行為，區分是否為敏感性信息，以及是否為目的外利用，為多層次的細膩化規定，規範邏輯相對清晰一致，對於《個保法》有積極的借鑒意義。

Personal Data Protection Act of PRC was passed on 20.Aug. 2021. As the fundamental legal framework of personal data protection, it demonstrates great ambition at regulating all kinds of behavior forms of state agencies by dealing with the personal data compared to civil code. While there is already lots of discussions concerning the foundation of data protection in the field of civil law, less attention is attributed to its constitutional foundation. This article asserts the positive meaning of widely accepted concept of“informative right of self-determination”under German and Chinese Taiwan's jurisdiction. Only with the constitutional foundation the[～199] conflicting interests between state agencies and citizens could appropriately be balanced in statute. Under these circumstances the legal requirements related to allocation and transmission of personal data will be thoroughly investigated.