資料流向與管控環節──個資保護ABC

Data Flows and Protection Sectors－The ABCs of Data Protection

人類進入數位化時代，個人資料受到的無形威脅，無時無之，無所不在，法律如何保護個人資料，為巨量資訊時代的巨型法律課題。本文嘗試歸零思考，梳理個人資料保護的核心概念與關鍵環節，用以檢視法律制定的合憲性與法律適用的合法性。「個人資料」概念為個人資料保護的核心概念，必須正確認識與界定，此其一。個人資料的流向通常經過蒐集、處理與利用三個階段，形成三個管控環節，此其二。除經當事人同意外，各該階段皆須有法律依據及正當目的；若有目的外之蒐集、處理或利用，除經當事人同意或另有法律依據外，均非法之所許。各該階段的合法要件未必相同，掌握個人資料的流向與管控環節，為個人資料保護的基本要領。

The right to control personal information is in a high endangerment situation more than ever in the digital age. With regard to the big legal issue in the age of big data this paper deals with the questions as to how the informational self-determination can be protected from state restrictions, in particularly in so far with the key importance concepts and notions of personal data protection law. It argues that the distinction between the collection, proceeding und use of the personal data is essential to the personal data protection, because there are different legal requirements for these three data flows.