論刑事審判卷證中個人資料之使用與保護－－以法院權限為中心

The Use and Protection of Personal Data in Criminal Trial Dossiers: Focusing on the Authority of Court

已確定刑事案件卷證資料，包含訴訟關係人之特徵，甚或醫療、基因、性生活及犯罪前科等個人資料，經由司法系統之偵查、審理程序之系統性處理，具有易於與其他案件卷證中資料連結的特性，屬於個人資料檔案。其本身足以識別特定自然人，與其他資料結合後，甚至可能勾勒出資料當事人的生活圖像，對個人資訊自決權造成干預。本文以刑事法院為觀察重點，發現現行刑事訴訟法就法院的使用行為欠缺適當的授權規範，而普通法位階之個人資料保護法等一般性規範則較寬泛，留下過多解釋空間。本文進而比較歐盟一般性資料保護規範（GDPR）、EU Directive 2016/680及德國刑事訴訟法等相關條文後提出解決方案：在現行法下，司法機關得在其使用個資之決定中加入資料保護影響評估（DPIA）之架構，以符合個資保護之透明性原則，亦有助於事後司法審查；在立法構想上，則以德國刑事訴訟法第八編為借鏡，考慮於我國刑事訴訟法增訂第十編，並加入配套保護措施，使刑事個資保護法律體系更加完備。

The dossier files of confirmed criminal cases include personal data, for example, characteristics of litigants, or even sensitive ones, like medical records, genetic information, sex life, and criminal records. Through systematic processing in the investigation and trial procedures of judicial authorities, these data may link with other dossiers, and thus constitute personal data files, which are sufficient to identify specific individuals, possible to outline the life images of the data subjects, thereby intervene their rights to information self-determination. This paper focuses on the authorization regulations regarding the activities of criminal courts and argues that current Code of Criminal Procedure lacks appropriate ones, while general regulations, such as the Personal Data Protection Act, are relatively too broad to rely on interpretation. After comparing the EU General Data Protection Regulation (GDPR), EU Directive 2016/680, and relevant provisions of the German Code of Criminal Procedure, this paper proposes solutions: under current regime, judicial authorities can incorporate the Data Protection Impact Assessments (DPIA) framework into their decisions on personal data processing to achieve transparency and facilitate post hoc judicial review. In terms of legislation, this paper suggests that the Eighth Book of the German Code of Criminal Procedure can serve as a reference, with the possibility of adding a Tenth Book to our country's Code of Criminal Procedure and implement safeguards to enhance the the protection of personal data in criminal dossiers.