告知同意在政府履职行为中的适用与限制

Application and Limitation of Informed Consent in the Performance of Government Duties

《个人信息保护法》确立了“公私并立”的保护体例,将国家机关和私主体意义上的个人信息处理者处理个人信息的行为共同纳入规范范畴。公法和私法对个人信息的保护在具体展开上存在很多差异,告知同意原则的适用就属于典型。在公法中,国家公权机关不仅在履行法定职责和法定义务时要受到同意的豁免,作为同意前提的告知也被限缩为“有限度的告知”。但上述适用限制本身也要受到限制。对“履行法定职责和法定义务”的判定应从职权而非主体入手,同时须以“履行法定职责或法定义务所必需”作为限定。而政府在履职行为中的同意豁免并不绝对,《个人信息保护法》中仍旧规定了需要同意的情形,尤其涉及对敏感个人信息的处理。又因为在无需征得个人同意的情形下,个人的控制力和支配权被很大程度上剥夺,就更需要对个人信息权和数据公益进行审慎权衡,也更需要合法正当、必要性、目的明确与目的限制等原则来防御公权机关对个人信息的无限度收集和使用。

The Chinese Personal Information Protection Law establishes the protection model of "public-private coexistence",which also brings the behavior of state organs in dealing with personal information into the scope of regulation by legal norms.Although public data law and private data law share the value goal of protecting personal information and promoting information circulation and data utilization,they differ from each other in many ways in specific development.The application of the principle of notification and consent is a typical example of this difference.The ethical basis of informed consent is the right to personal information self-de・termination.As a basic right,the right to personal information self-determination directly refers to the two core aspects of human dignity:"human subjectivity,,and ufree development of per-sonality".Its purpose is to prevent individuals from becoming a pure object of data processing in the era of big data.Recognizing the right of self-determination of personal information as a basic right not only has no contradiction with this right being a private right at the same time,but also helps to shape the panoramic protection of the right of information in public and private domains.Different from private data law,in which informed consent occupy a dominant position,in public law,not only public authorities should be exempted from consent when performing their statutory duties and obligations,but also the notification as the premise of consent is reduced to "limited notification"・The reasons for the reduction of informed consent from a principle to an exception in public data law include the concession of individual rights to data public welfare,and the possible weakening of public law enforcement ability caused by the application of this principle to the field of public law.However,informed consent is also rooted in the right to personal information self-determination as a basic right.Its essence is to uphold and emphasize the subjectivity and self-determination of will of the individual in the data age.Therefore,the above application restrictions do not mean complete exclusion.The limitation on exemption from informed consent lies not only in the interpretation frame of"performance of legal duties and obligations",but also in the correction of the lack of informed consent by other principles.The judgment of "performance of legal duties and obligations" should start from the authority rather than the subject,but this will lead to the problem of scope overflow,which must be corrected by the condition of "being necessary for the performance of legal duties or obligations".The government' s consent exemption in the performance of duties is not absolute.The Personal Information Protection Law still stipulates the circumstances under which consent is required,especially with respect to the processing of sensitive personal information.And because the individual's control and domination of his or her personal information are deprived to a large extent without his or her consent,it is more necessary to strike a careful balance between the right to personal information and the public interest of data,and to prevent the unlimited collection and use of personal information by public authorities through the principles of legitimacy,necessity,clarity of purpose and restriction of purpose.