論合法公開個人信息處理規則的適用

Constitutional Thinking on Common Prosperity

我國合法公開個人信息處理規則應定性爲認定信息處理者過錯（違法性）的行爲規範，而非個人信息合理使用的抗辯事由。處理公開個人信息的“合法性”基礎有二，即信息主體的“默示同意”和基於公共利益等法定事由。對公開個人信息的處理會因該個人信息事後不再公開而喪失合法性，但該效力不溯及既往，且以信息處理者知道或應當知道爲限。對半公開個人信息的處理若未超出其公開範圍這一特定場景，可類推適用公開個人信息的處理規則。“個人明確拒絕的除外”是法律賦予信息主體“選擇退出”的權利，其僅應適用於個人自行公開個人信息的場合，無法適用於基於法定原因公開個人信息的場合。“合理的範圍”和“對個人權益有重大影響”並非並列關係，而是包含關係，後者是判斷前者的一個反面因素，且後者側重於對處理結果的考量。“合理的範圍”的考量，可結合信息的特點與屬性、信息的處理目的和信息的處理方式等因素。

The processing rule of legitimately disclosed personal information of China should be characterized as a code of conduct that identifies the fault ( illegality ) of the information processor, rather than a defense as the fair use. There are two bases for the “legitimacy” of processing legitimately published personal information, which is the presumed consent of the information subject and the legal reasons based on the public interests. The “legitimacy” of processing would lose if the personal information is no longer disclosed afterwards, but the effectiveness is not retroactive and is limited to when the information processor knows or should know. If the processing of semi-disclosed personal information does not exceed the scope of its disclosure, the processing rule of disclosed personal information can be applied by analogy. “Unless expressly rejected by the individual” is the right of the information subject to “opt out” granted by law. It should only be applied to the occasion where the individual discloses personal information on his own, but cannot be applied when is disclosed for legal reasons. “Reasonable scope” and “having a significant impact on individual rights and interests” are not juxtaposed, but inclusive. The latter is a negative factor in judging the former, and focuses on the consideration of the processing results. The “reasonable scope” can be considered in combination with the characteristics and attributes of information, the purpose of information processing and the way of information processing, etc.