數位人權保障研究──以歐盟個人資料保護規則為例

A Study on EU Digital Human Rights Protection─A Case Study of GDPR

為適應網路科技與大數據(big data)時代的來臨，加強對於歐盟民眾個人資料保護與數據傳輸之限制，歐盟於2018年5月25日正式實施《個人資料保護規則》(General Data Protection Regulation，簡稱GDPR)。相較於歐盟1995年提出的《資料保護指令》( Data Protection Directive)，GDPR對於民眾資料保護提出更加嚴格之規範，且增加高額違規罰款。依據該規範，凡在歐盟營運的所有公司與企業，無論其總部設於何處，皆須遵守此規範；此法規不僅對於跨境資料傳輸與數據蒐集設有嚴格規範，同時具有區域外影響力。儘管被視為史上最嚴格之隱私法規，歐盟亦說明該規範並不包含個人在家中進行處理之有關個人數據與資料，如果該行為與專業或商業活動無關。但若在個人範圍之外，使用民眾個資進行社會文化或金融活動時，則皆需遵守GDPR。因此，本文將以歐盟數位人權保障研究為題，以做為個案研究，探究歐盟隱私保障法規發展及此個資保護規則重要實施內容，及其實施後所面臨之困難與挑戰，最後綜整結論。

In order to adapt to the advent of cloud world, internet technology and big data era, and to strengthen restrictions on personal data transmission of European Union (EU) citizens, the EU has formally implemented the“General Data Protection Regulation”(GDPR) on May 25, 2018. Compared with the“Data Protection Directive”realised by the EU in 1995, the GDPR designed and enhanced more stringent regulations for the protection of people’s personal data. In addition, it also increased high fines for violations of the regulations. According to the GDPR, all companies and enterprises operating in the EU, no matter where their headquarters are located, must follow this regulation. The regulation not only sets strict regulations on cross-border data transmission and collection, but also has influence outside the region. Although it is regarded as the most stringent privacy regulation in history, the EU also explained and stated that the regulation does not include data and information processed at home by individuals for personal factors if the behavior is not related to professional or commercial activities. However, if one uses other people’s data for social, cultural or financial activities outside the scope of the individual, he must be abided by this personal data protection law. Therefore, this article will take the EU’s digital human rights protection as the research topic, and use the GDPR as a case study to explore the development of EU privacy protection regulations and the important implementation of this data protection rule. It will also discuss and examine the difficulties and challenges the regulation faced after the implementation, hence making the conclusion.