個人資料保護的刑法問題──以數位足跡為例

Personal Data Protection and Criminal Liability:A Discussion of Digital Footprint

隨著數位經濟的興起，使用者在網路上所留下的數位足跡成為各大品牌與廣告商的重要素材，利用網路瀏覽紀錄（Cookie）將可以達到精確投放廣告的目的，進而獲得最大的商業效益。然而個人的網頁瀏覽紀錄應當具有其私密性，瀏覽各式網頁也應屬於個人的隱私活動，而具有合理的隱私期待，故而筆者認為，在刑事實體法的研究層面，網頁瀏覽紀錄除了屬於一種隱私利益外，亦應當透過個人資料保護法保障其隱私法益不受侵害。而2015年修正的個人資料保護法第41條規定，雖有學者探究立法意旨，認為並不是所有營利活動都要納入刑事規制的範圍，故應揚棄舊法使用營利的概念，而另將營利活動區分為合法型態與不法型態，僅有利用個人資料獲取不法利益時方有前條規定的適用，故而可以排除合法商業活動作為本罪的適用客體；惟筆者認為，前述觀點可能忽略了數位足跡的重要性，以及當前商業銷售模式的迅速轉換。一如本文所關切的網路瀏覽紀錄，目前採取第三方Cookie追蹤使用者跨網域活動的各大網站，其實都欠缺明確的說明內容，在此情況下，即便當事人勾選同意，亦難認為有合法的同意存在；此外，我國個人資料保護法第7條第3項推定同意的規定，並不符合當代的隱私保護趨勢，實有修法刪除之必要性，或者是採取嚴格的解釋途徑，賦予資料蒐集者具體、完整且清晰的說明義務，方能有推定同意的適用空間。故整體而言，在我國個人資料保護法的設計下，若網站業者、廣告商使用第三方Cookie技術追蹤使用者瀏覽紀錄時，應有詳實的告知義務，並取得當事人正面積極的同意，否則應已構成個資法第41條損害他人利益之不法要件。

The emergence of digital economy has made the digital footprints left by users on the Internet essential materials to be collected for brands and advertisers. The use of web browsing history (Cookie) is able to fulfill the needs for advertising to reach precise targets so that these brands and advertisers can gain their best business benefits. However, personal web browsing history involves privacy. Surfing web pages should be considered as a type of private activity. The author asserts that web browsing history characterizes privacy interest. Therefore, the legal interest of privacy in this regard should be protected by Personal Data Protection Act. Scholars have conducted research on the legislative purposes of Article 41 of Personal Data Protection Act recently amended in 2015. They suggested that not all of the profit-making activities should be included in the realm of the criminal system. Thus, the concept of profit-making defined in the previous regulations should be abandoned while it was necessary to break profit-making activities into legal and illegal categories. In this case, legal commercial activities were not regarded as the applicable object of the said crime. Despite of what the scholars have pointed out, the author argues that the aforesaid contention may have neglected the importance of digital footprints and rapid shifts of the business models we have today. One concern about web browsing history raised in this paper is that the third-party Cookie is currently used to track users’footprints from one domain to another, but there is a lack of explicit descriptions in Cookie policies. Under such circumstance, even users’agreement to the use of Cookie may not constitute legal consent. In addition, constructive assent stipulated in Article 7, Item 3 of the Personal Data Protection Act is not in line with the trend of privacy protection in this modern world. This has given rise to the need for an amendment and deletion of the Act, or strict legal requirements for providing clear explanations in Cookie policies so that data collectors are imposed obligations to make concrete, complete and clear descriptions on the use of Cookie. By doing so, the regulations may apply to determine whether there is constructive assent or not. In general, the existing Personal Data Protection Act should be able to impose obligations on web operators and advertisers to clearly inform users of the use of the third-party Cookie which tracks their web browsing history in order to obtain users’positive consent. Otherwise, the use of third-party Cookie by web operators and advertisers will constitute illegal elements that violate the interests of other people specified in Article 41 of Personal Data Protection Act.