個人資訊權益的三層構造及保護機制

The Three-level Frame and Protection Mechanism of Personal Information Rights and Interests

個人資訊保護之目的並非保護個人對其個人資訊的控制性權益，而是為了規制個人資訊處理風險，防範與救濟個人資料處理與利用活動可能產生的侵害後果。個人資訊權益是工具性權利與目的性法益的集合。在內容構成上，個人資訊權益體現為三層構造：第一，在憲法維度，基於侵害風險的不同類型，個人資訊權益包含了以尊嚴為核心的基本權利所對應的個人自治、生活安寧、公正對待、資訊安全四類法益；第二，在民法維度，個人資訊權益包含民法上的隱私、名譽等個人資訊關聯權益，主要對應的是個人資訊處理導致的現實損害；第三，在行政法維度，個人在個人資訊處理活動中的權利是國家主導構建的“法秩序”的構成要素，作為國家規制的產物由公共監管積極型塑與保障。相應地，在個人資訊保護的手段匹配方面，對個人資訊處理風險的規制及對尊嚴法益的維護，應主要以公共監管與執行機制為中心展開，並在民事實體權益損害現實發生時啟動民事責任機制；以此為基礎，形成防範各類風險、輻射資訊處理全流程、公法和私法多元手段協同的個人資訊保護機制。

"The purpose of personal information protection is not to protect the information subject’s control over personal information. Instead, it is to manage the risk of personal information processing and prevent and remedy the potential adverse consequences of personal information processing. Rights and interests related to personal information are a collection of instrumental rights and end-in-itself legal interests. In terms of content, personal information-related rights is manifested in a three-layer structure: First, from the constitutional perspective, based on different types of risks, personal information rights entail four types of legal interests: personal autonomy, peace of life, equal treatment and information security, which are based on the fundamental rights of dignity. Second, from the perspective of civil law, personal information rights include privacy, reputation and other related rights in civil law, which mainly correspond to the actual damage caused by personal information processing. Third, from the perspective of administrative law, the rights of individuals in the process of personal information processing activities are the constituent elements of the ''legal order'' constructed by the state, and are proactively shaped and protected by public supervision as a way of state regulation. Correspondingly, in terms of selecting the proper means of personal information protection, the regulation of personal information processing risks and the maintenance of dignity and legal interests should be mainly carried out through public supervision and enforcement mechanisms, and civil liability should be activated when private rights and interests are actually damaged. On this basis, the personal information protection mechanism can be formed to prevent various risks throughout the whole process of personal information processing with the coordination of multiple methods from both public law and private law."