个人信息保护中“同意”规则的规范构造

Research on the Normative Construction of “Consent” Rules in Personal Information Protection

权利人同意是个人信息处理的正当性基础之一,同意既可能构成合同等交易行为的给付内容,也可以是单纯表达对他人商业利用不法性的排除。两者分别体现了权利人对其个人信息的积极和消极控制。同意在法律性质上属于意思表示,因此对同意规则的规范构造可以从意思表示的方法(包括明示、默示,原则上不包括沉默)和实质要求(包括意思自治、知情同意和弱者保护)加以展开。主张任何信息在收集、使用上都必须得到用户(明示)同意,或者相反,主张一般信息都可以通过默许同意的方式取得用户授权,都是不可取的。同意的例外规则需要再整合,特别是根据个人信息主体要求签订和履行合同所必需的信息无须适用同意规则。

The consent of the data subject is one of the legal justifications for the collection and use of personal information,which may not only be seen as fulfillment of contractual obligations,but also exclude the unlawfulness of the commercial use by others,reflecting the positive and negative control of the subject on his personal information.Since the consent has a legal nature as manifestation of will,the normative rules of consent may be based on the rules of manifestation of will,consisting of the form of the manifestation (either explicit or implicit,while silence generally may not be seen as an effective manifestation of will) and the substantive requirements of the will (private autonomy,informed consent and protection of the party in a weak position).A “one-size-fits-all” solution for the collection and use of information seems arguable,whether it requires a prior (explicit) consent of the data subject or an implicit consent suffices for the use of general information.The exceptions to the rules of informed consent need to be reconsidered as it goes beyond the reach of the consent rules when the personal information being collected and used is necessary for the conclusion and performance of the contract.