【摘要】 泄露事件具有负外部性、不可避免性、技术动态性、隐蔽性和难以追溯性等特征。我国《个人信息保护法》确立了个人信息发生泄露时处理者的通知义务,旨在为个人信息主体提供救济并威慑处理者,但该制度设计背后存在“自首”悖论。通知义务有助于避免损害和降低执法成本,但具有类似自首性质的通知行为会给处理者带来通知成本、声誉损失和法律责任等不利后果,从而削弱其主动履行义务的动机。对此,法律意图通过威慑路径来落实通知义务,但威慑路径的实施存在主动发现困难和过度处罚困境等局限性。为化解“自首”悖论,通知制度应淡化威慑目标并突出救济和信息获取目标;监管机构的定位应从命令-监督者转变为综合性的治理者;在具体的制度规则方面,应明确通知义务与安全保护义务的关系、建立正向激励机制、降低履行义务的成本并提高监管机构的发现能力。更多还原

【Abstract】 Personal information breach incidents are characterized by such features as negative externalities, inevitability, technological dynamism, concealment, and poor traceability. The Personal Information Protection Law of the People’s Republic of China establishes the obligation of processors to notify when personal information is breached, which is intended to provide remedies for information subjects and deter processors. However, there exists a “self-reporting” paradox behind this system design. The notification obligation helps to avoid harm and reduce law enforcement costs; however, the act of notification itself has the nature of self-reporting, which brings about adverse consequences on the processors such as notification costs, reputational damage, and legal liabilities, thereby diminishing their motivation to fulfill the obligation voluntarily. In view of this, the law intends to implement the notification obligation through a deterrent approach, but such an approach faces limitations such as difficulties in proactive detection and the dilemma of excessive punishment. To resolve the “self-reporting” paradox, the notification system should downplay the deterrent goals and emphasize instead the objectives of providing remedies and obtaining information. The role of regulatory agencies should shift from a command-supervisor to a comprehensive governance entity. Specifically, the institutional rules should clarify the relationship between the notification obligation and security protection obligations, establish positive incentive mechanisms, reduce the costs of fulfilling the obligation, and enhance the detection capabilities of regulatory agencies.更多还原