【作者】 姚岳绒；

【导师】 童之伟；

【作者基本信息】 华东政法大学 ， 宪法与行政法学， 2011， 博士

【摘要】 个人信息则被誉为21世纪最有价值的资源,但是,个人信息价值在被认识的开始,也是其被侵害与掠夺的开端。计算机技术与互联网之间的联动发展引发了一场新的革命,大量的个人信息在一个国家甚至世界范围内可以不受空间与时间地进行收集、存储、利用乃至破坏,它改变了我们对待个人信息的方式。在我国,个人信息的保护不是新话题,但从宪法视野中来审视个人信息的价值与意义以及如何从宪法层面保护公民个人信息,这是一个相对较新的论题。依循个人信息与宪法、个人信息保护的权利基础、我国个人信息保护现状以及宪法如何保护个人信息这一逻辑,逐个梳理,并提出宪法视野中我国公民个人信息保护的途径选择以及基础性设想。一、个人信息保护的宪法权利为信息自决权。美国或偏向于学习美国法律文化的国家与学者习惯于从隐私权角度来论述个人信息的保护,将隐私权中有关个人信息的部分称为信息隐私权,并将信息隐私的理解侧重于信息的控制权与自主性。美国联邦最高法院通过判例的形式确立了隐私权的宪法地位,并以此为保护个人信息的宪法基础。德国联邦宪法法院采取不同于美国隐私权保护的法律传统,据于基本法上人性尊严与一般人格权,以人口普查案为契机确立了信息自决权,并以此为个人信息保护的宪法基础。美国式的信息隐私与德国式的信息自决,如果熟悉研究者背景又能联系上、下文语境,对这两个概念比较容易理解也不易混淆,但如果脱离具体语境,则极容易造成概念引用或理解上的混乱甚至出现严重的误解与失实。笔者倾向于采纳信息自决权这一概念,理由如下:第一,概念语义上,信息自决外延比信息隐私要广泛;第二,权利属性上,信息自决更能体现权利本质;第三,现实意义上,信息自决更符合现实所需。在我国,信息自决权是我国公民个人信息保护的宪法权利,其作为一项宪法未列举基本权利的证成路径为:(1)形式上的证明:现行宪法第38条的“人格尊严”条款提供了包括信息自决权在内的与人格所涉的新型基本权利的解释空间。现行宪法第33条的“国家尊重和保障人权”条款为我国宪法上的概括性权利条款,是信息自决权作为一项未列举基本权利得以存在的主要依据。这两条宪法条款在信息自决权的证成中缺一不可,同时还可参考宪法第37条的人身自由不受侵犯、第39条的住宅不受侵犯、第40条的通信自由与通信秘密受法律保护以及第41条的批评、建议、申诉、控告以及检举的权利等。这些具体的基本权利条款与信息自决权有着直接或间接的联系;这些具体基本权利的实现是信息自决权得以实现的有力保障。(2)实质上的证明:一项权利之所以为基本权利,是因为这项权利的价值上具有足够的宪法意义,具备基本权利之品质。信息自决权体现着基本权利的核心内容,即人性尊严与人格独立。信息自决是社会民主的必要;信息自决是公民自治的前提;信息自决是民主社会中个体自由实现的有力保障。信息自决权也是基本权利体系适应信息社会发展的必然结果。(3)经验上的佐证:综观国外及地区宪政实践以及国外宪法文本,虽然不同国家的宪法实践与宪法文本中,个人信息的保护会以不同的法律术语表示,但诸多国家中,特别是经济发达,法治完善的国家都将个人信息保护的权利基础确立为一项基本权利。二、综观我国个人信息保护的立法与实践现状,整体特征表现为:一是量少,无论法律法规数量还是法院受理的案例;二是力弱,保护性条款抽象性突出,缺乏可操作的程序性保障;三是不均,民事保护有一定的传统优势,刑事保护异军突起,2009年刑法修正案(七)对于刑事领域内的个人信息保护起着奠基性的作用,但行政领域内的个人信息保护明显落后于民事与刑事领域,而个人信息真正最大的威胁恰恰来自于公权力的侵权行为。电子政务在我国方兴未艾,而政府型数据库数量在不断增加,又加上数据库之间的联结与共享,这意味着我国政府数据库将在规模上会越来越庞大。如此可预测发展面前,提前思考,如何保护个人信息免受来自政府公权力的侵犯是当务之急,我们不能等到个人信息被侵犯现象在病入膏肓之际才来治疗。三、个人信息保护的域外经验有诸多值得学习与借鉴的内容。首先是国际组织层面所确立的个人信息保护立法理念与框架为世界各国个人信息的保护提供了范本,其中最为重要的是经济合作与发展组织(OECD)的《关于隐私保护和个人数据跨疆界流动的指导原则》(1980)、欧盟(EU)的《个人数据保护指南》(1995)以及亚太经合组织(APEC)的《隐私保护纲领》(2004)。域外各国与地区早期大多通过宪法解释的途径确立个人信息的保护,近来则有不少国家在修宪过程中将个人信息保护明确列入宪法,而立法保护已成为各国与地区个人信息保护中不可或缺的重要途径。据于各自不同的立法理念与立法习惯,个人信息保护的模式呈现多样化特点。有统一立法,将公权力主体与私权利主体同时纳入调整范围,但将两者适用进行区别对待的,如德国、我国台湾地区;有统一立法,将公权力主体与私权利主体一并纳入调整范围,并且对两者适用不作区别的,如英国;有分散立法,并侧重于规制行政领域内个人信息保护的,如美国;有分散立法,一并重视行政领域内个人信息保护与私权领域内个人信息保护的,如日本。四、在我国,个人信息保护途径应如何选择?首先,个人信息保护是一种行为,选择哪一种行为须有一定的行为逻辑及相应的结构。具体言:(1)国家保护公民个人信息行为逻辑的前提是国家有保护公民基本权利的义务,而依现代宪法理论,国家履行保护公民基本权利的途径为立法、执法以及司法;(2)国家保护公民个人信息行为逻辑的基准为权力与权利的平衡,运用法权分析方法,将法权衡量确定为立法、执法和司法保护行为的最基本原则;(3)国家保护公民个人信息行为的逻辑结构包含四个层次的内容,一是,国家保护公民个人信息的前提是不背离宪法的终极价值;二是,国家保护公民个人信息的最佳状态是权利与权力的平衡;三是,国家保护公民个人信息有两个基准,即公民权利有足以制约国家权力的能力以及国家权力足以防止公民权利的滥用;四是,国家保护公民个人信息的立足点则是增加法权总量。其次,信息自决权作为一项基本权利,是我国个人信息保护的宪法基础,如何保护个人信息是一个宪法问题,是基本权利得以落实的宪法实施问题。宪法实施,即将宪法所确定的权利与义务在实际生活中得以贯彻落实。基于我国实际,我国个人信息宪法保护的途径有两条可供选择:一是,宪法审查的途径,必须但难行的选择;二是,立法保护的途径,必要又可行的选择。最后,我国个人信息立法保护的基础性设想:(1)以信息自决权为个人信息保护立法的权利基础。(2)建议采用分散立法模式,并优先制定行政权力领域内的个人信息保护法。(3)个人信息保护立法设计的两个基准,即公民有足以制约国家权力的能力与国家权力有防止公民权利滥用的措施。第一,为确保公民有足以制约国家权力的能力,政府收集、储存、使用、传输等行为首要的是合法性。合法性要求的设置是实现公民有足以制约国家权力的能力的首要基准,以法律优先与法律保留为两个基本准则。而合理性要求的满足是公民制约国家权力更高层次能力的体现,对于国家权力的行使提出了更高的要求。政府收集、储存、使用、传输等行为至少须符合妥当性原则、必要性原则与合比例性原则。除原则性内容外,为确保公民有足以制约国家权力的能力,还需要设置一套适合不同基本权利范围的具体权利体系。个人信息保护立法包括但不限于信息查阅与获取权、信息更正、补充、删除的请求权、信息封存的请求权、信息处理的反对权以及请求赔偿的权利。另外,为确保个人信息保护法律的顺利执行,设置独立的个人信息保护机构很有必要。第二,权利与权力应处于相对平衡的状态,在公民有足以制约国家权力的前提下,还须有防止公民权利滥用的强制措施,因此,个人信息保护立法还需设置相应的豁免内容以及设定必要的自由裁量权。(4)衔接个人信息保护与政府信息公开。建议我国个人信息保护与政府信息公开之间以独立适用为准则,即由当事人自己选择相应的法律提出自己相应的诉求,而执法与司法适用过程各守相应的法律,在同一部或同一领域内的法律范围内来决定或判决是保护还是公开,以避免不同法律之间的串戏式适用与解释。如果二者在法律上发生竞合时,建议优先适用政府信息公开规则。更多还原

【Abstract】 Personal information has been regarded as the most valuable resource in 21st century. However, when this has just been realized, it has been violated. Developments of computer technology and internet has brought about a revolution, in which by large quantity of personal information can be collected, stored, utilized, and even destroyed within a country or worldwide, unlimited by time and space. Whereas protection of personal information is not a new topic, it is a comparatively new issue to examine the value and significance of personal information and study how to protect it from the perspective of constitutional law. This article will discuss reason to protect personal information constitutionally, right basis for constitutional protection of personal information and how the constitution can protect personal information, and put forward solutions and basic suggestions for our country to provide constitutional protection for personal information.The basic right for protection of personal information is the right of self-determination on information. In the United States and other countries learning from the Americans, personal information protection has been discussed from the perspective of right to privacy, in which those concerning personal information has been named as the right to information privacy and focused on the control and autonomy of information. Federal Supreme Court of the United States has established the constitutional status of right to privacy in its cases and made it the basis for personal information protection. Following different legal tradition and based on right to human dignity and personality, the federal constitutional court of Germany has adopted the right of self-determination on information by taking advantage of those census cases, thus forming the constitutional basis for personal information protection. It would be easy to understand the American’s information privacy and German’s self-determination on information if knowing their background and context, otherwise, misunderstanding or even mistakes would be unavoidable. I prefer the concept of self-determination on information based on the following reasons. Firstly, it is much broad than information privacy; Secondly, it can better demonstrate the nature of right; and Thirdly, it can also better meet the demand of reality.In our country, self-determination on information is a basic right for constitutional protection of personal information, which can be proved as an unlisted basic right in the constitution by the following ways. Firstly, formal evidence. Clause of personal dignity in the 38th of the constitution provides space of explanation for new basic right relating to personality including self determination on information. As a general right of our constitution, the 33rd clause providing the state respects and protects human right is the main basis for the self -determination on information as an unlisted basic right. These two clauses are indispensable. On the other hand, other specific basic rights can be referred to, including personal freedom in 37th clause, freedom of house in 39th clause, freedom of communication and secrecy in 40th clause and right to criticize, suggest, complain, accuse and report in 41st clause. They have direct or indirect influence on the right of self-determination on information and their realization guarantees that of the latter. Secondly, substantial proof. To be a basic right, it should be valuable with sufficient constitutional significance and has the quality of basic right. Right of self-determination on information manifests the core of basic right, i.e., human dignity and personal independence. Self -determination on information is not only necessary for social democracy, but also for citizen’s autonomy. It not only safeguards the realization of personal freedom in a democratic society, but also is the inevitable result of basic rights system adapting to the development of information society. Thirdly, experience proof. It has been regarded as a basic right in many countries, especially those with developed economy and rule of law, despite that it has different terms in their different constitutional practices and texts.Current legislation and practices regarding personal information protection in our country has been characterized as following: firstly, it has small amount in terms of the quantity of laws and cases accepted by courts; secondly, protection has been weak due to the abstract stipulations and inadequacy of practical procedural protection; thirdly, it has been unevenly developed in that civil protection has certain traditional advantage, criminal law protection has gained new momentum de to the founding role played by the seventh amendment to the criminal law in 2009 in protecting personal information, whereas protections in administration has been far behind. The most threat to personal information has been from the state power. Electronic administration has been in fast development, and government data bases have been increasing. As a result, they will become more and more sizable, multiplying by the connection and sharing among bases. Taking such a trend into consideration, it is crucial for us to think how to protect personal information from the government violation. We can not take action until it has become worse.We can learn a lot from foreign experience about protection of personal information. First of all, legislative ideology and framework of international organizations relating to personal information protection has provided basis for various countries in this regard, among which the most important are guideline on the protection of privacy and transborder flows of personal data of OECD in 1980, directives for protecting personal data of EU in 1995, framework for privacy protection of APEC in 2004. In their early stage, most foreign countries have protected personal information by ways of constitutional interpretation. Recently, some have achieved this in their constitutional amendments. Legislations have also become an important way of constitutional safeguard of personal information. Due to different legislative ideologies and customs, their legislative modes have been diversifying. Some have been put both public and private entity in one law, but treated them differently, such as Germany, and Taiwan, and some have put them in one legislation and treated them equally, such as England, whereas others have treated them in different legislations, some of which has focused on personal information protection in administrative regulations, like the United States, and the other of which has paid attention to those both in administrative regulations and private areas, such as Japan.How to choose the ways of protection for personal information in our country?Firstly, as protection of personal information is a behavior, there should a certain logic and mode of action when making a certain choice. More specifically,(1)The prerequisite for the state to protect personal information is that the state has such an obligation. According to modern constitutional theory, ways for the state to protect citizen’s basic rights are legislation, administration and judicial enforcement.(2)The standard for the state to protect personal information is the balance between power and right. By the method of legal right analysis, balance of legal rights can be regarded as the most basic principal for legislative, administrative and judicial protection. (3) Four levels are included in the logic structure of protecting personal information by the state, i.e., the prerequisite is the conformity with the constitution’s ultimate values; the best result is the balance of power and rights; it has two standards, which require that citizens have sufficient right to restrict state power, while the state power is strong enough to stop any abuse of rights by the citizen; the standing points is to increase the amount of legal rights.Secondly, as a fundamental right, self-determination on information is the constitutional basis for protecting personal information. How to protect personal information is a constitutional question and a question of constitutional enforcement in terms of realizing fundamental rights. Constitutional enforcement is to put rights and obligations set by the constitution into practices. Based on reality in our country, we have two ways to protect constitutionally personal information. One is constitutional review, a necessary but difficulty choice, while the other is legislative protection, which is necessary and plausible.Lastly, a basic legislative suggestion for protection of personal information: (1) Self-determination on information should be adopted as the basis of legislation; (2) Different legislations should be made, among which the priority should be given to personal information protection in administration; (3) The two standards mentioned in the above should be followed. Firstly, legality should be required for the government when collecting, storing, using and transferring personal information, which is the first basis to ensure the citizen has sufficient capacity to resist state power and have contains principals of legal priority and reservation. As a higher demonstration of the citizen’s capacity to resist state power, rationality demand much more for the exercise of state power. The government should conform to the properness, necessity and proportionality when collecting, storing, using and transferring personal data. Except core content, a set of specific rights should also be devised satisfying different fundamental rights. Legislation on personal information protection should include, but not limit on, rights to review and obtain information; rights to request to correct; supplement and delete information; right to request to seal information; right to object information handling as well as right for compensation. Apart from these, an independent agency is necessary to ensure the enforcement of those legislations. Secondly, rights should be balanced by power to stop right abuse by the citizen. Therefore, exemptions and certain discretions should also be provided in the legislation. (4) Personal information protection should be coordinated with the disclosure of government information. It is recommended that those two should be applied independently so that the citizen can choose relevant legislations for his specific litigations, while enforcement and jurisdiction have their own rules to decide to protect or disclose within the same field or by the same legislation, thus avoiding conflicts in application and interpretation of different laws. For any convergence of two laws, rules regarding government information disclosure should take priority.更多还原