个人数据保护“同意规则”的检视及修正

THE REVIEW AND AMENDMENT OF THE RULE OF CONSENT IN THE FIELD OF PERSONAL DATA PROTECTION

作为个人数据保护重要机制的"同意规则"是指数据控制者或数据处理者收集、使用个人数据应当获得数据主体的同意。数据主体对于上述行为的"同意"是进行个人数据处理的合法性基础。同意规则是目前国际立法和实践中的通行做法,随着大数据时代的到来,各国纷纷开始重新审视同意规则在个人数据保护中的实际效用。同意规则在我国个人数据保护立法及司法实践中也占据着重要地位。同意效用的局限性、绝对同意的不可能性、数据利用对于同意规则的冲击性使得同意规则的设计和适用问题需要被重新检视。新语境下,我国应当通过明确同意并非个人数据处理的唯一合法性基础,同意的可撤回性以及同意规则的区分适用等多种途径对现行的同意规则进行修正,以突破其局限性,实现个人数据保护和利用的有效平衡。

As an important mechanism for personal data protection, the rule of consent means that data controllers or data processors should obtain the consent of the data subject when collecting and using personal data. The consent of the data subject to the above behaviors is the legal basis for personal data processing. The rule of consent is the prevailing practice in current international legislation and practice. With the advent of the era of big data, many countries have begun to review its actual utility in the field of personal data protection. The rule of consent also plays an important role in the legislation and judicial practice of personal data protection in China. The limitations of the rule of consent, the impossibility of absolute consent, and the impact of data utilization on the consent rule x^quix^s us to x^examine the design and application of the consent rule. In response to the new situation, we should amend the existing consent rules in various ways in which explicit consent was not the only legitimacy basis for the individual data processing, consent was able to withdraw, and the rule of consent could be applied by distinction. Then we could bleak through the limitations and achieve the effective balance of the protection and utilization of personal data.