【作者】 刘珂；

【导师】 王蓓；

【作者基本信息】 四川大学 ， 法学， 2023， 博士

【摘要】 大数据时代,人们无时无刻不处于个人信息被收集利用甚至深度处理的环境中,智能算法、自动化决策、AI学习……这些新型工具在不断提高社会经济效益,为工作生活带来极大便利的同时也侵蚀着自然人的权利边界。劳动者作为深度参与社会生产的自然人,面对用人单位的个人信息处理需求,表现出较高的服从性和羸弱的维权观念与能力。我国《个人信息保护法》虽将用人单位处理劳动者个人信息行为纳入规制范围,但如何判定人力资源管理的必要,如何防止用人单位滥用规章制度或集体合同进而突破对其信息处理行为的限制还需进一步探讨。更进一步,基于私法基础的同意,事实上会淡化劳动者与用人单位之间的实质不平等,忽视对劳动者意思表示真实性的鉴别,形式意义的“同意”甚至会成为用人单位侵犯劳动者个人信息权益的“庇护伞”。因此,对劳动者个人信息保护进行特殊制度设计实属必要,但采用何种制度方式,是将其置于个人信息保护法律体系中,还是在劳动法律体系中进行规定,是对现有法律法规进行修改补充,抑或是另立新法,有待进一步比较研究。现有为数不多的研究多集中于劳动者个人信息保护的法理基础和保护原则,对于具体的侵权形式、保护措施、维权救济和责任承担方式等问题缺乏关注。文章以劳动者个人信息的法律保护为研究对象,通过对制度历史脉络的梳理、对关键概念的界分、对核心原则的辨析、对不同劳动用工阶段用人单位信息处理行为的归纳和劳动者权益损害风险的释明,以及对域外经验的辩证思考,提出利用劳动法模式构建完善劳动者个人信息保护制度体系的实践方案,以回应劳动用工和劳动者权益保护的切实需要。文章聚焦劳动者个人信息权益保护,以劳动用工不同阶段自然展现研究进路,将域外制度比较借鉴与我国各类劳动用工和制度规范场景深度结合,充分阐述不同用工阶段的信息处理场景和保护需求,探讨体系化的劳动者个人信息法律保护制度方案。文章的正文总共包括六章,每章主要内容如下:第一章探讨劳动者个人信息基本范畴。从劳动者个人信息的内涵外延、法律属性和特别保护理由三方面论述和归纳劳动者个人信息特别保护的必要性和紧迫性。劳动者个人信息权益是个人信息保护在劳动用工领域的表达,其既与个人信息保护制度一脉相承,又兼具劳动法特性。劳动者个人信息权益的主体和保护制度的适用对象不应只包括我国传统劳动法语境下与用人单位建立劳动关系的员工,还应适当扩大适用范围,将招聘阶段的求职者和离职后的“前雇员”,以及众多新业态从业者一并纳入其中。关于劳动者个人信息的内涵和外延,文章主张,劳动者个人信息是指劳动者为订立、履行、变更、解除或终止劳动合同,履行劳动给付义务而向用人单位提供的或由用人单位依法收集、存储、处理和使用的,包括纸质、电子等在内的各种形式记录的,与已识别或可识别的劳动者有关的各种信息。由于劳动者个人信息包含多重法益,无法作为单一的权利客体,也不满足权利之排他效力、归属效力和社会典型公开性,结合我国法律对个人信息立法实践的客观选择,将劳动者个人信息的法律性质认定为综合性权益更为适宜。用人单位基于知情和管理需求,有对劳动者个人信息进行处理的必要,但双方实力的不平等会使得劳动者的个人信息权益在用人单位面前变得脆弱而又缺乏保护和救济,个人信息权益与劳动者隐私权在功能价值、内容形式、损害责任类型等方面的差异,劳动法“倾斜保护”理论的积极意义等,都赋予了构建和完善劳动者个人信息制度的独立价值和时代意义。第二章聚焦劳动者个人信息保护的一般原则。提出在延续个人信息保护一般原则的前提下,面对用人单位对劳动者个人信息的处理,要从从公开透明、处理限制、知情同意和存储保障四个方面入手,有针对性的限制用人单位的信息处理行为,细化劳动者个人信息保护措施。实践中,受到劳动用工特殊性的影响,劳动者个人信息规则原则的适用会出现公开透明形式化、处理限制不可控、知情同意不自由、存储保障不明确等瑕疵和问题,因此需在制度构建时针对劳动者个人信息保护的特点,进行相应的完善优化。第三、四、五章分析劳动关系不同阶段的信息保护。关注在劳动关系的不同阶段用人单位信息处理行为给劳动者个人信息保护带来的影响,以及在实践中凸显的棘手问题,探索劳动者个人信息保护制度的完善方向。在建立劳动关系前,用人单位有必要对求职劳动者从多维度进行考察以判断其与工作岗位的契合度,现行法律规范也允许用人单位对与订立劳动合同直接相关的信息进行收集和处理。但以“劳动合同直接相关性”为唯一标准,既缺少事前的规则引导,又忽视了事后的类案示范,制度实践中存在灵活性强而监管不足,忽略求职劳动者信息安全保障等问题。劳动关系建立后,用人单位对劳动者个人信息处理的需求和依据都更加必要、充分。然现行法律规范对该阶段用人单位行为的约束严重缺位,存在着信息权益保障和救济措施不充分、用人单位自主权过大、规章制度效力层级较低、行政命令色彩明显等问题。劳动关系解除或终止后,用人单位则可能基于履行劳动合同的附随协助义务和保管责任继续对劳动者个人信息实施相应的处理行为,保证存储于用人单位的劳动者个人信息的准确、安全是该阶段处理行为最核心的要求。文章还就劳动用工中围绕劳动者简历资料、个人健康状况、犯罪记录、生物识别信息、地理位置信息、竞业信息等特别类型信息的收集使用,劳动职能监控、自动化决策、对第三方披露以及存储保管等信息处理行为进行了详细分析,以明确劳动者个人信息特别保护的紧迫性和独特价值。第六章从保护机制完善和模式选择两方面提出优化劳动者个人信息保护制度的建议。在分阶段保护方面,要做到对求职阶段劳动者个人信息的严格保护,对在职期间的平衡保护和对离职后的合理保护。明确用人单位在各阶段可获取的劳动者个人信息类型和范围;赋予劳动者“说谎权”的同时强调其在特定情形下负有主动诚实告知义务;建立信息处理“同意+”制度,运用“同意(告知)+法定责任”、“同意+法定例外”、“同意+正当必要性判断”、“同意+行政许可”等模式分类约束用人单位的处理行为;利用信息清除机制,及时删除合法处理基础已经消灭的劳动者个人信息。在跨阶段保护路径优化方面,通过在用人单位内部搭建信息处理审查与报告机制、强化劳动监管部门对信息处理行为的监督执法、将信息处理争议纳入劳动仲裁和诉讼受案范围、探索公益诉讼模式等方式拓宽劳动者个人信息权益保护和维权渠道。在法律保护制度方面,建议采用劳动法模式完善劳动者个人信息保护制度,确立个人信息保护的劳动基准地位,利用劳动基准法律制度的准据效用为用人单位信息处理行为设定底线标准,同时分层设立用人单位的信息处理权限和劳动者主动告知义务,建立相应的行为豁免制度;发挥比例原则的平衡作用,从用人单位信息处理行为的前提要求、处理范围、方式选择、劳动者信息权益受损风险、安全保障措施五个方面入手,在满足用人单位生产经营需要的同时,实现劳动者个人信息保护;认可“软法”规范对劳动者信息保护制度的有益补充。更多还原

【Abstract】 In the era of big data,people are always in the environment where personal information is collected,utilized,and even deeply processed.Intelligent algorithms,automated decision-making,AI learning...these new tools are constantly improving socio-economic benefits,bringing great convenience to working and life,and at the same time eroding the boundaries of the rights of natural persons.As natural persons deeply involved in social production,labors show high obedience and weak rights protection concepts or abilities in the face of employers’ personal information processing needs.Although the Information Protection Law of the People’s Republic of China(PIPL)includes the regulations on employers’handling of employees’ personal information,how to determine the necessity of human resource management and how to prevent employers from abusing enterprise rules or collective contracts to break through the restrictions on their information processing needs to be further explored.Furthermore,consent based on civil law will in fact dilute the substantive inequality between employees and employers,and neglect to identify the authenticity of employees’ intentions.The formal“consent”may even become a“protective umbrella" for employers to infringe on employees’rights and interests in personal information.Therefore,it is necessary to design a special system to protect labors’ personal information.But it needs to be further compared and studied which method could be adopted,whether to place it in the personal information protection legal system,or to stipulate it in the labor law system,whether to revise the laws and regulations,or to enact a new law.There are a few existing studies focus on the legal basis and protection principles of labors’ personal information protection,but lack attention to specific forms of infringement,protection measures,rights protection remedies and liability bearing methods.Taking the legal protection of workers’ personal information as the research object,this paper puts forward a practical plan for using the labor law model to build and improve the system of labors’ personal information protection system by sorting out the historical context of the system,the division of key concepts,the identification of core principles,the summary of the information processing behavior of employers at different stages of labor and the interpretation of the risk of damage to labors’rights and interests,and the dialectical thinking of extraterritorial experience,so as to respond to the practical needs of labor employment and the protection of labors’ rights and interests.This paper focuses on the protection of labors’ personal information rights and interests,naturally shows the research approach at different stages of employment,deeply combines the comparative reference of extraterritorial systems with various employment and system normative scenarios in China,fully expounds the information processing scenarios and protection needs of different employment stages,and discusses the systematic legal protection system scheme for workers’ personal information.The body of the article consists of a total of six chapters,each of which focuses on the following:Chapter I explores the basic scope of workers’ personal information.The necessity and urgency of special protection of labors’ personal information are discussed and summarized from three aspects:the connotation and extension of workers’ personal information,legal attributes and reasons for special protection.The rights and interests of labors’ personal information are the expression of personal information protection in the field of labor and employment,which is not only in line with the personal information protection system,but also has the characteristics of labor law.The subject and protection system of labors’ rights and interests in personal information should not only include employees who have established industrial relations with employers under the traditional labor law in China,but also appropriately expand the scope of application,including job seekers in the recruitment stage and "former employees" who has left the job,as well as many new format practitioners.Regarding the connotation and extension of labors’ personal information,the article advocates that labors’ personal information refers to all kinds of information related to identified or identifiable labors that is provided by employees to employers for the purpose of conclusion,performance,modification,dissolution or termination of labor contracts and performance of labor payment obligations,or collected by employers in accordance with law,stored,processed and used in various forms,including paper,electronic,etc.Since workers’ personal information contains multiple legal interests,it cannot be regarded as a single object of rights,nor does it meet the exclusive effect,attribution effect and typical openness of rights,combined with the objective choice of personal information legislative practice in Chinese law,it is more appropriate to be recognized as a comprehensive right and interests in the legal nature of workers’ personal information.Employers have the need to process employees’ personal information based on their needs for knowledge and management,but the unequal strength of the two parties will make employees’ personal information rights and interests vulnerable in front of employers and lack of protection and relief,the differences between personal information rights and interests and labors’ privacy rights in terms of functional value,content form,type of damage liability,etc.,and the positive significance of the“tilted protection”theory of labor law,etc.,all of which give independent value and epochal significance to the construction and improvement of the personal information system of employees.Chapter Ⅱ focuses on the basic principles of workers’ personal information protection.It is proposed that under the premise of continuing the basic principles of personal information protection,in the face of employers’ handling of employees’ personal information,it is necessary to refine protection measures from four aspects:openness and transparency,processing restrictions,informed consent and storage guarantees,restrict the behavior of employers,and introduce the principle of proportionality to give play to its unique role in balancing the relationship between the two parties.However,when the application of the principles is affected by the particularity of employment,there will be defects and problems such as openness and transparency formalization,uncontrollable processing restrictions,unfree informed consent,and unclear storage guarantees,and it is necessary to improve and optimize the system according to the characteristics of workers’ personal information protection.Chapters III,VandVI analyze information protection at different stages of industrial relations.These chapters Pays attention to the impact of employers’ information processing behavior on the protection of employees’ personal information at different stages of industrial relations,as well as the thorny issues highlighted in practice,and explore the direction of improving the personal information protection system of employees.Before establishing an employment relationship,it is necessary for employers to examine job seekers from multiple dimensions to determine their suitability with the job,and the current laws and regulations also allow employers to collect and process information directly related to the conclusion of labor contracts.However,taking“direct relevance of labor contracts”as the only criterion,it not only lacks prior rule guidance,but also ignores the demonstration of similar cases after the fact,and there are problems such as strong flexibility and insufficient supervision in system practice,and ignoring problems such as information security for jobseeking workers.After the establishment of industrial relations,the employer’s needs and basis for the processing of employees’ personal information are more necessary and sufficient.But the current legal norms are seriously lacking in the constraints on the behavior of employers at this stage,and there are problems such as insufficient protection of information rights and interests and relief measures,excessive autonomy of employers,low levels of effectiveness of rules and regulations,and obvious colors of administrative orders.After the termination of the employment,the employer may continue to carry out corresponding processing of the employee’s personal information based on the performance of the ancillary assistance obligation and custody responsibility of the labor contract,and ensuring the accuracy and security of the employee’s personal information stored in the employer is the core requirement of the processing behavior at this stage.This paper also analyzes in detail the collection and use of special types of information such as labors’ resume data,personal health status,criminal records,biometric information,geographic location information,non-compete information,monitoring,automated decision-making,third-party disclosure,and storage,etc.,so as to clarify the urgency and unique value of special protection of workers’ personal information.Chapter VI puts forward suggestions for optimizing the personal information protection system for workers from the aspects of improving the protection mechanism and selecting the model.In terms of phased protection,it is necessary to achieve strict protection of the personal information of workers in the job search stage,balanced protection during the period of employment and reasonable protection after resignation.Clarify the types and scope of employees’ personal information that employers can obtain at each stage;Giving workers the“right to lie" while emphasizing their obligation to take the initiative to inform honestly under specific circumstances;Establish a“consent+,”system for information processing,and use modes such as“consent(notification)+statutory responsibility","consent+statutory exception","consent+legitimate necessity judgment”,“consent+administrative permission”and other modes to classify and restrict the employer’s handling behavior;Use the information erasure mechanism to promptly delete the personal information of workers whose legal processing basis has been eliminated.In terms of optimizing the cross-stage protection path,the channels for protecting and protecting employees’ personal information rights and interests are broadened by establishing an information processing review and reporting mechanism within employers,strengthening the supervision and law enforcement of information processing by labor supervision departments,including information processing disputes in the scope of labor arbitration and litigation,and exploring public interest litigation models.In terms of the legal protection system model,the labor law model is adopted to improve the personal information protection system of employees,establish the labor standard status of personal information protection,use the applicable utility of the labor standard legal system to set the bottom line standard for the employer’s information processing behavior,and at the same time set up the employer’s information processing authority and the employee’s active notification obligation in layers,and establish a corresponding behavior exemption system;Give play to the balancing role of the principle of proportionality,starting from the five aspects of the premise requirements of the employer’s information processing behavior,the scope of processing,the choice of methods,the risk of damage to employees’ information rights and interests,and security measures,so as to meet the needs of the employer’s production and operation while realizing the protection of employees’ personal information;Recognize the useful complement of“soft law”norms to the workers’ information protection system.更多还原