隐私权概念的再界定

隐私权在我国虽然已经得到广泛承认,但是关于其边界等问题仍然存在争议,需要继续研究。隐私权固然存在宪法上的基础,但是主要属于民事权利的范畴。它的具体属性应当是具体人格权而非一般人格权,而且应当在我国未来的《人格权法》中得到规定。隐私权主要包括生活安宁和私人秘密两个方面,未来隐私权的内容也应当以此为基础进行发展和扩张。个人信息资料权不宜纳入隐私权的范畴,它是相对独立于隐私权的一种权利。     

“In the public interest”: The privacy implications of international business-to-business sharing of cyber-threat intelligence

This article reports on preliminary findings and recommendations of a cross-discipline project to accelerate international business-to-business automated sharing of cyber-threat intelligence, particularly IP addresses. The article outlines the project and its objectives and the importance of determining whether IP addresses can be lawfully shared as cyber threat intelligence.The goal of the project is to enhance cyber-threat intelligence sharing throughout the cyber ecosystem. The findings and recommendations from this project enable businesses to navigate the international legal environment and develop their policy and procedures to enable timely, effective and legal sharing of cyber-threat information. The project is the first of its kind in the world. It is unique in both focus and scope. Unlike the cyber-threat information sharing reviews and initiatives being developed at country and regional levels, the focus of this project and this article is on business-to-business sharing. The scope of this project in terms of the 34 jurisdictions reviewed as to their data protection requirements is more comprehensive than any similar study to date.This article focuses on the sharing of IP addresses as cyber threat intelligence in the context of the new European Union (EU) data protection initiatives agreed in December 2015 and formally adopted by the European Council and Parliament in April 2016. The new EU General Data Protection Regulation (GDPR) applies to EU member countries, a major focus of the international cyber threat sharing project. The research also reveals that EU data protection requirements, particularly the currently applicable law of the Data Protection Directive 95/46/EC (1995 Directive) (the rules of which the GDPR will replace in practice in 2018), generally form the basis of current data protection requirements in countries outside Europe. It is expected that this influence will continue and that the GDPR will shape the development of data protection internationally.In this article, the authors examine whether static and dynamic IP addresses are “personal data” as defined in the GDPR and its predecessor the 1995 Directive that is currently the model for data protection in many jurisdictions outside Europe. The authors then consider whether sharing of that data by a business without the consent of the data subject, can be justified in the public interest so as to override individual rights under Articles 7 and 8(1) of the Charter of Fundamental Rights of the European Union, which underpin EU data protection. The analysis shows that the sharing of cyber threat intelligence is in the public interest so as to override the rights of a data subject, as long as it is carried out in ways that are strictly necessary in order to achieve security objectives. The article concludes by summarizing the project findings to date, and how they inform international sharing of cyber-threat intelligence within the private sector.     

Revoking consent: A ‘blind spot’ in data protection law?

The flow of personal data throughout the public and private sectors is central to the functioning of modern society. The processing of these data is, however, increasingly being viewed as a major concern, particularly in light of many recent high profile data losses. It is generally assumed that individuals have a right to withdraw, or revoke, their consent to the processing of their personal data by others; however this may not be straightforward in practice, or addressed adequately by the law. Examination of the creation of data protection legislation in Europe and the UK, and its relationship with human rights law, suggests that such a general right to withdraw consent was assumed to be inbuilt, despite the lack of express provisions in both the European Data Protection Directive and UK Data Protection Act. In this article we highlight potential shortcomings in the provisions that most closely relate to this right in the UK Act. These raise questions as to the extent of meaningful rights of revocation, and thus rights of informational privacy, afforded to individuals in a democratic society.     

Humans forget,machines remember: Artificial intelligence and the Right to Be Forgotten

This article examines the problem of AI memory and the Right to Be Forgotten. First, this article analyzes the legal background behind the Right to Be Forgotten, in order to understand its potential applicability to AI, including a discussion on the antagonism between the values of privacy and transparency under current E.U. privacy law. Next, the authors explore whether the Right to Be Forgotten is practicable or beneficial in an AI/machine learning context, in order to understand whether and how the law should address the Right to Be Forgotten in a post-AI world. The authors discuss the technical problems faced when adhering to strict interpretation of data deletion requirements under the Right to Be Forgotten, ultimately concluding that it may be impossible to fulfill the legal aims of the Right to Be Forgotten in artificial intelligence environments. Finally, this article addresses the core issue at the heart of the AI and Right to Be Forgotten problem: the unfortunate dearth of interdisciplinary scholarship supporting privacy law and regulation.     

Russian PNR system: Data protection issues and global prospects

The usage of Passenger Name Record (PNR) for security purposes is growing worldwide. At least six countries have PNR systems; over thirty are planning to introduce them. On 1 December 2013, a Russian PNR system will be implemented. But enhanced collection of personal data leads to increased surveillance and privacy concerns. Russian authorities state that passengers' rights will be respected, but a closer look at the Russian regime reveals a number of critical points. From a global perspective, the Russian regime is only one of many PNR systems, including new ones to come in the future. Apparently, for the majority of them, similar challenges and problems will apply. At the same time, for the EU, with its strict data protection requirements, PNR requests by third countries (i.e. non-EU countries) create conflicts of laws. In order to resolve them, the EU concludes bilateral PNR agreements. However, the current deals, especially the one between the EU and the USA, involve a number of weaknesses. Accepting the latter, and having a pending proposal on the EU PNR system, the EU has weakened its position in negotiations with third countries. How will the EU deal with the Russian as well as with all the future requests for PNR? This paper provides legal analysis of the Russian PNR regime, pointing out common problems and giving prognosis on the global situation.     

Battle in the name of privacy and security: A comment on Tencent vs. Qihoo (Supreme People's Court of China 2014)

One strategy for companies competing in Internet industries is to attack the privacy and security problems of products or services provided by a competitor and then to deliver remedial software to attract consumers. The recent ruling of the Supreme People's Court of China (SPC) establishes legal constraints on this strategy, recognising that a company owes a high duty of care when criticising the privacy and security policies of its competitors and identifying the line between legal technological innovation and unfair interference with the business of competitors. This article provides a summary of the background, facts and court conclusions as well as relevant comments on the impact of this judgement and identifies the issues that require further clarification.     

政府公共性的多维度分析

政府公共性具体体现在政府执掌的是社会公共权力、政府贯彻执行社会公共意志、政府谋求的是社会公共利益、政府管理社会公共事务、政府承担公共责任和政府的行为应公开透明这六方面。政府公共性的理念支点是公共精神,现实载体是公共政策,物质保障是公共财政。政府公共性从历史看经历了一个产生、丧失、膨胀和转移的复杂过程。现代社会伴随着市民社会的发展壮大,第三部门的崛起,出现了私域公共性的觉醒,政府公共性逐步向社会转移。政府公共性的丧失和政府公共性的转移虽然表面上都表现为政府公共性在量上的减少,但其实两者在本质上有着很大的差异。政府公共性的丧失是强政府弱社会的必然结果。而政府公共性的转移体现出社会在力量壮大之后,要求政府将一部分管理的公共事务交给社会,实现部分权力向权利的回归。