論金融控股公司共同行銷之個人資料保護法制

Abstract

有鑑於近年來實務界不斷呼籲主管機關放寬金融機構交互運用客戶個人資料之管制，本文以我國金融控股公司法與個人資料保護法之相關規定為觀察重點，提出現行規範架構可能具有無法達成充分傳遞資訊予客戶以及促進金融資訊市場效率之問題。基此，本文先分別以新古典經濟學與行為經濟學之角度檢視客戶於金融資訊市場中可能面臨之市場失靈與行為偏誤問題，並提出以「輕推」與「非對稱性的家父長主義」作為衡平客戶個人資料保護與促進資訊市場效率之方法。本文再參考美國Gramm-Leach-Bliley、Regulation P與加州金融資訊隱私權法案作為比較法之研究依據，最後提出我國相關規範應採取預設的選擇退出制之結論，以放寬金融機構交互使用客戶個人資料時所受限制，並應同時採取「清楚與具顯著性」之通知原則、提供行使選擇退出權之合理機制，與採用標準化隱私權通知規範格式等相關配套措施，如此方能確保客戶對其個人資訊擁有完整之自主控制權並同時維持資訊市場之效率。

The financial industries have called for loosening the limitation on exchanging customers' personal information for co-selling in recent years. In light of that, this thesis focuses on the relevant regulations under the Financial Holding Company Act and Personal Data Protection Act in Taiwan, advocating that the current legal system is inadequate to push financial institutions for informing their customers and to promote the efficiency of the financial information market. It firstly adopts the views from neo-classical economics and behavioral economics, identifying the plausible problems regarding market failures and behavioral biases in the financial information market. Besides, it proposes feasible resolutions by utilizing the concepts of 'Nudge' and 'Libertarian Paternalism'. It then employs comparative studies that review the Gramm-Leach-Bliley, Regulation P, and California Financial Privacy Act of 2011 in the United States. Based on the above, this thesis proposes that Taiwan's legal system should adopt similar opt-out default rules, accompanying with the 'clear and salient' principle when financial institutions inform their customers, providing them reasonable chances for opting-out, and imposing model privacy form to financial institutions. In conclusion, only with the measures mentioned above could we strike the balance between the privacy protection of customers and the efficiency of the financial information market.