问责原则与安全原则下的个人信息泄露侵权认定

Infringement Determination of Personal Information Leakage Under the Accountability Principle and Security Principle

当发生个人信息泄露时,个人信息主体多因泄露源头不清而难以有效证明侵权责任的成立。对此司法机关或利用表见证据规则,或利用因果关系倒置,平衡两造在诉讼中的力量关系,但也存在合法性欠缺、混淆行为与损害等问题。破题之策在于借助《个人信息保护法》第9条规定的问责原则与安全原则,柔化《民法典》一般侵权规范的适用。根据问责原则,个人信息处理者应自证个人信息处理行为的合规性,证明已经履行必要的作为义务。与之配合,安全原则要求个人信息处理者承担特殊的安全管理义务,义务内容包括但不限于《个人信息保护法》第51条的相关规定。就因果关系证明而言,问责原则要求个人信息处理者对民事损害负责,当存在不法个人信息处理行为时,可以依据法规目的说判定因果关系的成立;鉴于个人信息处理者承担特殊的安全管理义务,即便个人信息是从第三人处泄露或存在第三人故意介入的因素,因果关系也并非当然中断。

In the case of personal information leakage,it is difficult for the subject of personal information to effectively prove the establishment of tort liability because the source of the leak is unclear.Judicial authorities either use the rule of apparent evidence or the inversion of causation to strike a better balance between the two parties,but there are also problems such as lack of legitimacy,mixing behavior and damage.The principles of accountability and security,which are regulated in Article 9 of the Personal Information Protection Law,can soften the application of torts rules from the Civil Code and help to solve such problems.According to the principle of accountability,personal information processors should prove the compliance of personal information processing and prove that they have fulfilled their reasonable obligations.Correspondingly,the security principle imposes a special security management obligation on personal information processors,and that obligation is not limited to rules specified in Article 51 of the Personal Information Protection Law.Since the principle of accountability requires personal information processors to be responsible for civil damages,when there is illegal personal information processing,causality in the sense of legal purposes should be considered as established.Given that personal information processors have special security management obligations,even if personal information is leaked from a third party or there is a third party's intentional intervention,the causality may not be interrupted.