论已公开个人信息的“合理”处理

On the “Reasonable” Handling of Disclosed Personal Information

公开的个人信息是合法公开能够为不特定第三人所访问的信息,包括意定公开信息和法定公开信息两类。信息处理者不经信息主体同意即可对已公开的个人信息进一步处理,但信息处理者对信息的后续利用并非不受限制,必须控制在“合理范围内”。我国《民法典》第1036条和《个人信息保护法》第27条规定的“合理”处理公开个人信息存在模糊,内在原由是传统人格权救济所蕴含的间接保护模式,已无法满足今日已公开个人信息保护的现实需要。《民法典》和《个人信息保护法》所代表的是个人信息的直接保护模式。针对第27条“合理要件”模糊的标准,在处理意定公开个人信息时候,应不超出合理预期;处理法定公开个人信息,适用“合理利用推定”的标准。

Publicly available personal information is information that can be legally disclosed and accessed by unspecified third parties, and includes both intended public information and legally available information. Information processors may further process disclosed personal information without the consent of the subject of the information, but the subsequent utilization of the information by the information processor is not unrestricted and must be controlled within a “reasonable range”. Article 1036 of the “Civil Code” and Article 27 of the “Personal Information Protection Act” provide for the ambiguity of “reasonable” processing of disclosed personal information, which is inherent in the fact that the indirect mode of protection embedded in the traditional remedy of personality rights can no longer satisfy today’s realistic needs for the protection of disclosed personal information. The “Civil Code” and the “Personal Information Protection Act” represent a direct protection model for personal information. In response to the vague standard of “reasonable elements” in Article 27, when dealing with intentionally disclosed personal information, it should not exceed reasonable expectations;when dealing with legally disclosed personal information, the standard of “presumption of reasonable utilization” applies.