商業言論自由與個人資料保護之衝突：以美國電信業與我國金控業個人資料流通之管制為中心

A Conflict between Commercial Speech and Personal Information Protection: Focusing on the Restrictions on the Free Flow of Personal Information of the U.S. Telecommunications Carriers and the Taiwan Financial Holding Companies

由於科技進步，產業界乃能運用大量個人資料，卻形成隱私保護的威脅。美國電信法乃規定，除依法律規定或經客戶同意外，電信業者不得為了與因而衍生「客戶專屬線路資訊」（Customer Proprietary Network Information, CPNI）之服務無關之目的而使用、揭露或允許接觸該CPNI。
惟該法未明定，應以何種方式（「選擇加入」或「選擇退出」）取得客戶同意。對此，FCC數度公布CPNI相關命令及施行細則。然而，在U.S.West, Inc. v. FCC案，法院認為，FCC所制定之1998年CPNI施行細則要求CPNI之使用、揭露或允許接觸應取得客戶「選擇加入」之同意方式，乃違反美國聯邦憲法增修條文第1條所保護之商業言論自由，該施行細則遂被法院認定違憲。其後，對於取得客戶同意之方式，FCC遂放寬規定而部分改採「選擇退出」。
至於我國金融業，因法令屢經修改，交互運用客戶資料之規範時寬時緊，得交互運用客戶個人資料之主體及客體範圍時大時小，應取得客戶同意方式游移於「選擇加入」與「選擇退出」之間，不利於金控業跨業營運，亦不利於個人資料運用新模式之開展。因此，得借鏡美國電信業經驗，以「商業言論自由」而檢討管制措施之合憲性。

Currently, industries can easily use personal information at a large scale due to technological progress. However, it leads to a threat to privacy of consumers. As a consequence, according to Article 222 of the U.S. Telecommunications Act of 1996, except as required by law or with the approval of the customer, a telecommunications carrier shall not use, disclose, or permit access to individually identifiable customer proprietary network information (CPNI) for purposes not relevant or necessary to its provision of the telecommunications service from which such information is derived.
As the Telecommunications Act does not clearly enact how to obtain the approval of the customer, the Federal Communications Commission (FCC) issued the CPNI order to require the opt-in consent of the customer before using, disclosing, or permitting access to CPNI. However, in U.S. WEST, Inc. v. FCC, the court ruled the requirement of the opt-in consent violated the commercial speech protected by the First Amendment and, thus, was unconstitutional.
As for the financial industry in Taiwan, with whom and to what extent customer personal information may be shared among the affiliates of the financial holding company alter due to the frequent amendments to the Financial Holding Company Act. Therefore, the method to obtain the consent of a fluctuates between the “opt-in” and “opt-out” requirements before some categories of personal information, i.e. basic information of customer, may be shared. As the legal requirement is not consistently valid and reliable for a long term, its negative impact is tremendous for the cross-selling by the sharing of personal information and for the new potential uses of personal information in the age of big data. As a result, following the U.S. telecommunciations industry, the Taiwanese financial industry may also use the commercial speech doctrine as a weapon to challenge the constitutionality of the Financial Holding Company Act.