论个人信息保护的行政规制路径

个人信息保护存在私法诉讼与行政规制两种主要路径,私法诉讼多以侵权之诉的形式展开。由于个人信息处理者与信息主体的地位失衡,信息主体举证困难,维权难度高;由于损害难以界定,诉讼存在成本与收益不均衡的激励困境;同时,个别性的诉讼也难以有效回应系统性的社会风险。行政规制路径以基本权利的国家保护义务作为法权基础,在专业性、信息充分程度、治理效率等方面具有比较优势。个人信息保护立法应当更妥善地处理两种路径的协调。未来个人信息保护的行政规制路径需要进一步明确规制体制,充分运用行政处罚、自我规制、内部管理型规制、第三方规制等多元化的规制机制。

On the Administrative Regulatory Approach of Personal Information Protection

There exists two main approaches of personal information protection:private lawsuits and administrative regulation.The private lawsuits mechanism are mostly carried out in the form of tort litigation.Due to the imbalance status between personal information processors and information subjects,the information subjects have difficulties in providing evidence,and they may bear a very high cost of litigation procedure;due to the difficulty of defining damages,the unbalanced cost-benefit ratio put the litigation mechanism in an incentive deficit dilemma;meanwhile,the individual litigation is also unable to respond to the systemic social risks effectively.Taking the state protection obligation of the fundamental rights as the basis of regulatory power,the administrative regulation approach has comparative advantages in terms of professionalism,adequacy of information,and governance efficiency.The legislation on personal information protection should coordinate the two approaches more appropriately.The administrative regulation approach needs to further clarify the regulatory system,and fully utilize diversified regulatory mechanisms such as administrative punishment,self-regulation,internal management-based regulation,and third-party regulation.