物聯網個人資料保護規範研究──以歐盟GDPR與ePrivacy規則草案為中心

Legal Study on Personal Data Protection Regulations—Centering on GDPR and Proposal of the ePrivacy Regulation

由於物聯網快速發展，人與萬物被網路緊密連結，時間與空間限制被打破，智慧化世界近在眼前。然而，隨著物聯網不斷產出大量有價值的數據，逐漸衍生出當事人同意品質不足、當事人對個人資料缺乏控制、個人資料再使用超出原始蒐用目的、過度依賴物聯網個人資料所為之資料剖析會減損個人權益、去識別化保護個資之效用降低與物聯網個人資料的資訊安全六大個資保護風險。在相關議題的熱潮下，現有的個人資料保護規範是否足以應對這些問題，值得深入研究。本文以臺灣《個人資料保護法》和《資通安全管理法》為基礎，比較歐盟《一般資料保護規則》、《隱私及電子通訊規則草案》等法規，探討歐盟與我國如何應對物聯網帶來的各種跳戰。本文發現現行我國法有多處缺失，筆者遂藉由外國經驗，建議我國未來可調整告知與同意規定；檢討個資法中的當事人權利內容；加入相容性使用；加入資料剖析；明確定義去識別化；訂立物聯網個人資料檔案安全維護計畫實施辦法，並從風險控管角度應對物聯網隱私問題，以強化我國在物聯網時代的個人資料保護法制。

With the rapid development of the Internet of Things (IoT), individuals and various entities are tightly interconnected, breaking down the barriers of time and space and bringing a smart world within reach. However, as the IoT generates a vast amount of valuable data, it has led to six major risks in data protection: low-quality of data subject consent, lack of control over personal data, further processing of personal data other than that for which the personal data have been collected, over-relying on profiling based on IoT personal data which may diminish individual rights, reduced effectiveness of de-identification in protecting personal data, and information security. In the fervor surrounding these issues, it is worth exploring whether existing regulations on personal data protection and security are sufficient to address these challenges. This paper, based on Taiwan’s Personal Data Protection Act and the Cyber Security Management Act, compares regulations such as the General Data Protection Regulation (GDPR) and Proposal of the ePrivacy Regulation. The aim is to explore how Taiwan and the EU respond challenges brought about by the IoT. The paper finds several shortcomings in the current Taiwan’s regulations. Based on foreign experiences, this thesis suggests that in the future, legislators could amend the provisions on notice and consent, review the rights of the data subject, add the provisions on compatible use and profiling to Personal Data Protection Act, define de-identification clearly, establish a security and maintenance plan for the protection of personal data files and address IoT privacy issues from a risk management perspective. All suggestions aim to strengthen Taiwan’s legal framework for personal data protection in the era of the IoT.