政府資料庫之個人資料保護法制──臺日經驗之初步考察

Personal Data Protection from Asian Perspective: A Probe into Database Litigation in Japan and Taiwan

近年各國均面臨由政府、公部門所設置之大規模資料庫是否牴觸人民資訊隱私權之法律爭訟。有鑑於巨型資料庫具有快速疊加個人的資料斷片，透過巨量資料之堆疊進而剖繪個人人格圖像之特徵，動輒導致資料外洩之數位治理的品質良窳等疑義。此等法制建構及具體實踐是否合乎法律保留及個人資料保護之意旨不惟獨於我國興起訴訟的波瀾，日本亦不例外。我國與日本之司法訴訟均指向「資訊隱私權」之意涵釐清與保護範疇，應如何透過憲法條款推導出具體明確的保障範疇，落實為下位規範之權利保障。
本文擇日本作為比較法制之個案研究，以日本個人資料保護法制架構為始，闡述該國「資訊隱私權」的概念緣起與建構歷程，續以日本最高裁2008年的住基法制度案判例，以及2015年起輾轉於大阪地方法院、仙台地方法院以團體訴訟提起之My Number訴訟案為主軸，考察比較大型資料庫訴訟於日本司法實務之發展脈絡及立論基礎，最後返歸我國憲法法庭111年憲判字第13號判決，試圖從比較判決的觀點，評釋兩國資料庫代表性訴訟對於未來個人資料加值應用的公部門資訊再利用研擬妥適之對應處理策略建議。

In recent years, countries have faced concerns regarding whether large-scale databases established by governments and public entities may infringe upon people’s right to privacy. Given that massive databases can quickly accumulate fragments of personal data and, through the stacking of vast amounts of information, potentially profile individuals’personality traits, there are concerns about the risk of data breaches associated with such databases. The construction of legal frameworks and their specific implementation not only sparks litigation in Taiwan but also extends to Japan. Both Taiwan and Japan’s judiciary aim to clarify the concept and scope of“information privacy rights”and how to derive specific protection measures from constitutional provisions to establish personal data protection.
This article selects Japan as a case study for comparative legal analysis, starting with an overview of Japan’s framework for personal data protection laws. It elaborates on the origin and development of the concept of“information privacy rights”in Japan. Subsequently, it focuses on pivotal cases in Japanese jurisprudence, such as the 2008 Supreme Court ruling on the Basic Resident Register System and class action filed in My Number litigations. These cases are examined to explore the development trajectory and legal foundation of large-scale database litigation in Japan. Next, the article analyzes Taiwan’s Constitutional Court 111-Hsien-Pan- 13 decision, evaluates the implications of these two countries’representative database litigations from a comparative judgment perspective. It aims to provide recommendations for appropriate strategies in addressing the second use of public sector for enhancing personal data protection.