隐私政策的过去、现在和未来:从合同、基准到信任背书

Privacy Policy's Past,Present,and Future:From Contract to Standard to Trust Endorsement

告知同意原则下的隐私政策长期伴随对于其合同性质的争议。赞成意见认为告知同意结构符合合同订立要素,且企业自律行为能够发挥市场机制作用。反对意见针对“同意困境”,并指出基于隐私政策的违约救济存在局限性。个人信息公法保护的加强促使隐私政策从以意思自治为核心的合同法模式向以法定义务为内容的隐私基准转变。隐私基准是以国家强制力保障实施的个人信息主体应享有的最低程度的个人信息保护。受基准法的影响,隐私政策转而演变为对隐私基准的解释说明。作为合规象征的隐私政策面临“符号化”质疑,体现为书面合规形式化和隐私基准调整范围的有限性。隐私政策的未来图景是个人信息处理行为的信任背书,为此应统筹法律基准与平台自治,即不断推动隐私政策与数据实践融合,鼓励以隐私承诺与信义义务充实个人信息保护,并增强针对隐私问题的社群沟通对话。

The contractual nature of privacy policies based on the principle of notice and consent has long been contested.The positive view asserts that the notice and consent structure matches the elements of a valid contract and that business self-regulation could perform the role of market mechanism.The objection considers the“consent dilemma”and draws attention to the limitations of remedies for contract breach based on privacy policies.The improvement of public law protection for personal information encourages an evolution of the privacy policy from an approach based on contract law with autonomy of will as the core to one based on privacy standards requiring legal obligations.Privacy standards require a minimum level of personal information protection that people should enjoy under the guarantee of national compulsory force.As a result of the Standards Law,privacy policies have developed into interpretations of privacy standards.Privacy policies have faced the challenge of“symbolization”as a symbol of compliance,which is shown in the formalization of written compliance and the limitation of privacy standards.The future of privacy policies will be a trust endorsement of personal information processing.To achieve this goal,legal standards and platform autonomy must be coordinated.Efforts should be made to incorporate privacy policies with data practices.It is encouraged to strengthen the protection of personal information with privacy promises and fiduciary duties and enhance community communication on privacy matters.