自行公开个人信息利用规则的合理范围研究

A Study on the Reasonable Scope of Rules onUsing Voluntarily Disclosed Personal Information

《个人信息保护法》第27条规定了自行公开个人信息豁免同意的使用规则,但该规定的合法性基础、“自行公开”的判断标准与“合理范围”的边界需要进一步厘清。现行规定忽略了公开场景的复杂客观规律,对已自行公开个人信息的主体权益限制过于绝对化。个人信息具有人格属性和算法识别性,公开行为并未阻断这一特性。对“合理范围”的解读应从处理者规制视角回归到信息主体权益视角,在“推定同意”的合法性基础之上,“合理范围”应以公开时的“合理预期”为标准,合理预期的判断需综合主观标准和客观标准。在合理预期范围之内,自行公开信息主体自决权益受到限制,具体程度需经过利益衡量确定。

Article 27 of China’s Personal Information Protection Law sets forth the rules on using voluntarily disclosed personal information without consent.Nonetheless,there is a need to further clarify the legal basis of the stipulations,the criterion of"voluntary disclosure"and the boundary of"reasonable scope".The current stipulations ignore the complicated objectivity of disclosing scenarios and impose absolute restrictions on the interests of individuals voluntarily disclosing personal information.Personal information has personality attributes and algorithm recognition,which are not blocked by voluntary behavior."Reasonable scope"should be interpreted fundamentally from the perspective of information disclosing individuals’rights and interests,instead of the perspective of processor regulation.On the legal basis of"constructive consent","reasonable expectations"at the time of disclosure should be considered to be the criterion of"reasonable scope",and the judgment of"reasonable expectations"should be a combination of subjective and objective criteria.Within the scope of reasonable expectations,the self-determination rights and interests of individuals voluntarily disclosing information are restricted,and the specific degree of restriction needs to be determined by interest measurement.