商业自动化决策规制的私法困境及其完善路径

The Predicament of Private Law of Commercial Automatic Decision Regulation and Its Consummation Path

商业自动化决策中被决策主体不享有算法解释权。商业自动化决策的私法规制框架是以告知同意规则-事前告知义务、个人信息处理知情权-事后说明义务和自动化决策结果拒绝权为核心进行的规范体系构建。但这种规范以保障被决策主体知情为逻辑起点,不能有效解决自动化决策中普遍存在的算法黑箱问题。商业自动化决策需公私法协同规制。首先,私法层面应着眼于自动化决策的一般逻辑(框架层面),细化数据主体事前告知义务和事后说明义务的范围,明确自动化决策结果拒绝权的适用情形。在自动化决策前,商业决策主体不仅应向被决策主体主动告知自动化决策的一般逻辑,还应主动告知该自动化决策可能引发的风险。在自动化决策后,商业决策主体应对影响被决策主体权益的相关信息进行具体说明。此外,自动化决策结果拒绝权的行使需受“对个人权益有重大影响”与“仅通过自动化决策的方式作出”的双重限制。其中,是否“对个人权益有重大影响”的判断标准为是否严重改变了被决策主体的利益状态;而是否“仅通过自动化决策的方式作出”则需纳入商业决策主体的事前告知义务范围。其次,公法层面应着眼于自动化决策的具体逻辑(算法层面)并进行穿透式监管,即通过算法备案-实质审查和算法备案-动态监管的方式解决算法黑箱可能带来的侵害问题。

The subject of an automated commercial decision does not have a “right to algorithmic interpretation”. The private law framework for automated commercial decision-making is the construction of the normative framework taking the “rule of informed consent-the obligation to inform beforehand”,the “right to know about the processing of personal information-the obligation to explain afterwards” and the “the right to reject the results of automated decision-making” as the core of. However,this kind of normative presupposition,which is based on the logical starting point of guaranteeing the “knowledge” of the subject of the decision,cannot effectively solve the problem of the algorithmic black box that commonly exists in automated decision-making. Automated commercial decision-making needs to be regulated by both public and private law. First,private law should focus on the general logic of automated decision-making(framework level),refine the scope of the “obligation to inform beforehand” and “obligation to explain afterwards” of data subjects,and clarify the application of the "right to reject the results of automated decision-making. Before the automated decision is made,the subject of the commercial decision should not only inform the subject of the decision of the general logic of the automated decision,but also of the risks that may arise from the automated decision. After the automated decision,the subject of the commercial decision should specify the relevant information affecting the rights and interests of the subject of the decision. Furthermore,the exercise of the “right to reject the results of automated decision-making” is subject to the double restriction of “personal significant interest” and“only through automated decision-making”. The criterion for “the significant impact on personal interest” is whether the decision significantly alters the interests of the subject of the decision,while whether “only through automatic decision-making” should be included in the prior “duty to inform” of the subject of the business decision. And second,public law should focus on the specific logic of automated decision-making(at the algorithm level) for penetrating regulation,i.e. through “algorithm filing-substantive review” and “algorithm filing-dynamic regulation” to solve the problem of possible infringement brought by algorithm black box.