论信息主体同意权的绝对化困境与相对性重构——兼论《个人信息保护法(草案)》(二审稿)同意制度的完善

On the Absolute Dilemma and Relative Reconstruction of Information Subject’s Right of Consent:Also on the Improvement of the Consent System of “Act on the Protection of Personal Information(Draft)”(Second Review)

中国现行个人信息保护立法将同意视为个人信息处理的唯一合法性事由,《个人信息保护法(草案)》(二审稿)虽有所突破,但总体未逾同意权绝对化之藩篱。同意权的绝对化设置导致个人信息保护水平不足、制度成本高企、立法司法割裂等问题,进而制约个人信息保护法功能的实现。对个人信息的基本属性进行剖析发现,个人信息并非纯粹的"私人事务",而是多方利益和多元价值的集合体,绝对化的同意权不具有坚实的理论基础。因此,应当从完善其他个人信息处理合法性事由和通过场景风险理论差异化配置同意权使用范围两条途径入手,实现"绝对同意"向"相对同意"的转变,形成大数据时代个人信息保护的"中国方案"。

The legislation of China’s current personal information protection law takes consent as the sole legal right to deal with personal information.Although there is some breakthrough in“The Act on the Protection of Personal Information(Draft)”(Second Review),in general the fence of the absolute right of consent is not crossed.The absolutized setting of consent has led to such problems as insufficient protection of personal information,higher institutional costs,separation of legislation and judiciary,etc.,further restricting the realization of the function of the personal information protection law.By analyzing the basic attributes of personal information,it is found that personal information is not pure“private affairs”,but an aggregation of the interests and values of multiple parties;the absolutized right of consent possesses no solid theoretical foundation.Therefore,it is necessary to start from the two paths,i.e.,perfecting the legality of other person’s information treatment and differentiating the allocation of the range of application of the right of consent with the scenario risk theory,so as to achieve the transformation from“absolute consent”to“relative consent”and formulate a“Chinese Scheme”of personal information protection in the big data era.