个人数据损害的类型及其确定

The Types of Personal Data Damage and Its Determination

依告知同意原则构建的个人数据保护制度面临着过度收集、擅自披露与滥用等问题的严重挑战。公权保护路径存在监管力度、范围及效力的局限性,而传统侵权法上的损害观念架空了数据主体的私法救济权利。因此,为保障数字经济的健康发展,必须扩张侵权法上损害的含义。法律上可予赔偿的个人数据损害应延及两类新型损害:数据主体遭受次生损害的风险,以及社会分选歧视、数据监控、自动化决策等造成的人格利益减损。在确定具体赔偿数额时,为解决风险与人格利益减损所产生的经济量化与举证责任之困境,《个人信息保护法》应采用知识产权法中广泛适用的法定赔偿制度。

The personal data protection system constructed according to the principle of informed consent is faced with serious challenges such as excessive collection, unauthorized disclosure and abuse.The path of public rights protection has the limitations of supervision strength, scope and effectiveness, while the concept of damage in the traditional tort law sets up the private law relief rights of the data subject.Therefore, in order to ensure the healthy development of digital economy, we must expand the meaning of damage in tort law.Legally compensable damage to personal data should extend to two new types of damage: the risk of secondary damage to data subjects, and the impairment of personality interests caused by social sorting discrimination, data monitoring, and automatic decision-making and so on.When determining the specific amount of compensation, in order to solve the dilemma of economic quantification and burden of proof caused by the impairment of risk and personality interests, the personal Information Protection Law should adopt the legal compensation system which is widely used in the intellectual property law.