个人数据保护中同意规则的“扬”与“抑”——卡-梅框架视域下的规则配置研究

知情同意规则是个人数据保护法领域中的核心规则,但知情同意高度依赖于同意主体对数据收集、处理过程的充分了解。而现实中,普遍存在于当事人间的信息分布不均妨害同意的认识基础,多环节的数据流通则进一步削弱了同意的有效性,在此基础上的同意决策容易陷入非理性。通过引入卡-梅框架进行分析和假设,可以明确财产规则与责任规则各自的效率优缺点、分配偏好与价值考量。从保护与利用平衡的角度出发,倡导构建以知情同意规则为核心、管制规则与自治性责任规则为辅助的互补性规则进路,并继续在立法上完善知情同意规则,简化事前谈判,强化事后风险防范,辅之以多种类的技术监督机制以消弭权利配置进路的负外部性。

"Promotion"and"Suppression"of Consent Rules in Personal Data Protection:A Study on Rule Disposition from Perspective of C&M Framework

Informed Consent rule is the core of personal data protection law(DPL), however, informed consent is highly dependent on the data subject’s full understanding of the data collection and processing process, but in reality, information asymmetry prevailing existing between data subjects and data controllers may damage the basis of consent, and multi-link data transaction further weakens the validity of consent, as a result, data subjects’ decision of consent tends to be irrational. By introducing the C&M framework for analysis and hypothesis, we can make clear the efficiency advantages and disadvantages, distribution preferences and value considerations between property rules and liability rules. Starting from the balance of protection and utilization, and taking the rule complementarity into account, this paper proposes to build a hybrid regulatory path approach with informed consent rules as the core, along with regulatory rules and private liability rules as the supplement, meantime the principle of informed consent needs to be further improved, with negotiations ex ante simplified, and risk prevention ex post strengthened, trying to eliminate the externality of right disposition by administrative supervision.