論數位時代兒童個人資料保護法制建構課題——以我國相關法律之適用與發展建議為核心

Legal Study Children’s Data Protection Legislation via Digital Era in Taiwan

隨著兒童習於上網並頻繁透過網路獲取資訊，如何對應網路發展與應用趨勢強化兒童個人資料的保障，成為近期主要國家共通關注之重要課題。兒童權利公約揭櫫兒童個人資料保護理念，我國現行立法與此關聯最為密切者，為「兒童及少年福利與權益保障法」與「個人資料保護法」兩者，惟前者僅針對特定處理或利用行為進行規範，並未觸及核心之兒童個人資料「蒐集行為」，不足之處仍須回歸定位為普通法的個資法加以討論。然而個資法對應此一議題除存在兒童能否為有效同意之爭辯，數位時代下所須思考的另一課題，則是父母所扮演之角色，國際立法例如採取特別法模式的美國「兒童線上隱私保護法」（COPPA），抑或逕於普通法中納入兒童保護規定的歐盟「一般資料保護規則」（GDPR），均明文要求兒童個人資料的蒐集必須取得其父母之同意並確保同意之有效性。若我國擬強化兒童個人資料保護，本文認為應優先梳理個資法未能涵蓋及妥適處理之事項，經比較COPPA立法背景與核心規範，本文認為現階段尚無立即制定兒童網路個人資料保護專法之必要，而以參考GDPR模式於個資法中新增納入保護條款之作法為宜，並試擬個資法建議增、修訂條文。如何讓「兒童是國家未來的主人翁」此一問世於類比時代並為許多人朗朗上口的話語，於數位時代亦等同獲得落實，實值重視。

The expansive engagement of children in cyber space triggered privacy threats, but children often lack the awareness and the capacity to foresee possible consequences. The Convention on the Rights of Children reveals the importance of children’s privacy protection and the most relevant domestic legislation is “Protection of Children and Youths Welfare and Rights Act” and “Personal Data Protection Act (PDPA)”. Since the Protection of Children and Youths Welfare and Rights Act only regulates specific processing or using behaviors, the core collecting behaviors of children’s personal data shall still be subject to the PDPA. It is controversial whether children can give valid consent to the application of the PDPA, on the other hand, it is also necessary to consider the role of parents toward the collecting of children’s data. The US Federal Children’s Online Privacy Protection Act and EU General Data Protection Regulation both require acquiring parental consent when collecting children’ s data and ensu ring the validity of the consent. Taiwan’s Personal Data Protection Act was first introduced in 1996 and was significantly amended in 2010, with the amendments becoming effective in 2012. Being the basic law of data protection affairs, the PDPA did not specifically consider the protection needs of children. Considering the increasing demand for children’s privacy protection, possible approaches include formulate a section law such as COPPA, or imitating GDPR to include relevant protection provisions in PDPA. By comparing the legislative background and key provisions of COPPA, the author suggests to adjust the PDPA and proposes related amendments.