个人信息权益的三层构造及保护机制

The Three-level Frame and Protection Mechanism of Personal Information Rights and Interests

个人信息保护之目的并非保护个人对其个人信息的控制性权益,而是为了规制个人信息处理风险,防范与救济个人数据处理与利用活动可能产生的侵害后果。个人信息权益是工具性权利与目的性法益的集合。在内容构成上,个人信息权益体现为三层构造:第一,在宪法维度,基于侵害风险的不同类型,个人信息权益包含了以尊严为核心的基本权利所对应的个人自治、生活安宁、公正对待、信息安全四类法益;第二,在民法维度,个人信息权益包含民法上的隐私、名誉等个人信息关联权益,主要对应的是个人信息处理导致的现实损害;第三,在行政法维度,个人在个人信息处理活动中的权利是国家主导构建的“法秩序”的构成要素,作为国家规制的产物由公共监管积极型塑与保障。相应地,在个人信息保护的手段匹配方面,对个人信息处理风险的规制及对尊严法益的维护,应主要以公共监管与执行机制为中心展开,并在民事实体权益损害现实发生时激活民事责任机制;以此为基础,形成防范各类风险、辐射信息处理全流程、公法和私法多元手段协同的个人信息保护机制。

The purpose of personal information protection is not to protect the information subject’s control over personal information.Instead,it is to manage the risk of personal information processing and prevent and remedy the potential adverse consequences of personal information processing.Rights and interests related to personal information are a collection of instrumental rights and end-in-itself legal interests.In terms of content,personal information-related rights is manifested in a three-layer structure:First,from the constitutional perspective,based on different types of risks,personal information rights entail four types of legal interests:personal autonomy,peace of life,equal treatment and information security,which are based on the fundamental rights of dignity.Second,from the perspective of civil law,personal information rights include privacy,reputation and other related rights in civil law,which mainly correspond to the actual damage caused by personal information processing.Third,from the perspective of administrative law,the rights of individuals in the process of personal information processing activities are the constituent elements of the"legal order"constructed by the state,and are proactively shaped and protected by public supervision as a way of state regulation.Correspondingly,in terms of selecting the proper means of personal information protection,the regulation of personal information processing risks and the maintenance of dignity and legal interests should be mainly carried out through public supervision and enforcement mechanisms,and civil liability should be activated when private rights and interests are actually damaged.On this basis,the personal information protection mechanism can be formed to prevent various risks throughout the whole process of personal information processing with the coordination of multiple methods from both public law and private law.