合法公开个人信息衍生利用的有限告知同意制度研究

对于合法公开个人信息衍生利用是否需要告知信息主体并征得其同意这一命题，法律规范呈现三种态度，司法实践亦呈各异形态。完全告知同意论未能正视合法公开个人信息的“非典型个人信息”特性，不具有逻辑自洽性与现实可行性，有违信息主体的意思自治。告知同意豁免论未能关注合法公开个人信息的“非典型公共物品”特性，忽视了对人格尊严和自由的尊重，并会加剧对信息主体的侵害。有限告知同意论能准确契合双重特性，协调交易成本与安全保护的利益冲突，兼顾合法公开个人信息的社会公共面向和个人识别面向。有限告知同意论的具体展开应对合法公开个人信息衍生利用情形进行类型化构造，分别适用择入式和择出式同意，同时通过安全影响评估制度进行全周期风险调控。

On the System of Restrictive Informed Consent with Derivative Use of Legitimately Published Personal Information

For the proposition of whether the derivative utilization of legally disclosed personal information needs the informed consent of the information agent, we find three attitudes in the legal norms, and different forms in judicial practice. The theory of fully informed consent fails to face up to the “atypical personal information” characteristic of legally disclosed personal information. Besides, it has no logical self-consistency and realistic feasibility, and violates the will autonomy of the information agent. The theory of informed consent exemption fails to pay attention to the “atypical public goods” characteristic of legally disclosed personal information. It ignores the respect for personal dignity and freedom, and will aggravate the infringement on the information agent. The theory of limited informed consent is capable of accurately fitting the dual characteristics, coordinating the conflict of interest between transaction costs and security protection, and taking into account the social public aspect and personal identification aspect of legally disclosed personal information. To concretely develop the theory of limited informed consent, typed construction should be carried out on the derivative use of legally disclosed personal information, select-in consent and select-out consent should be applied respectively, and the whole cycle risk should be regulated through the safety impact assessment system.