未成年學生資訊隱私權之分析—以學生教育資料庫為例

Abstract

當數位資料庫進入教育事務中，為行政機關與教育機構提供低成本、快速且便利的資料儲存使用技術的同時，可能將涉及學生資訊隱私權。國家基於教育目的與法律所賦予之教育權限，向未成年學生以強制性手段蒐集與儲存各式相關教育資料。在蒐集過程中行政機關與教育機構之教育權限行使，雖係為保障未成年學生受教育權之「教育目的」，但亦可能與學生之資訊隱私產生衝突。本論文試圖透過探討我國未成年學生之受教育權的核心價值，參考我國與美國對於教育資料保護之法律架構，分析我國現行對教育資料的大規模蒐集是否足以確保學生的資訊隱私權。 本論文第二章以未成年學生之受教育權之內涵，探討其核心價值在於自我實現人格自由開展。本論文第三章則探討學生資訊隱私權的重要性，以及在法律上作為基本權利的地位，並且認為國家與教育機構落實教育權力，對學生進行大規模教育資料蒐集時仍應注意「比例原則」與「正當法律程序原則」，以避免過度干擾學生之資訊隱私權。本論文於第四章從學生資訊隱私權與受教育權的權利並立談起，提出資訊隱私權是作為落實受教育權必要手段，並提出我國對於未成年學生資訊隱私權保障之隱憂。本論文從我國現行的個人資料保護法與教育資料庫所涉及的資料保護規定，探討於我國在教育事務中使用數位資料庫與分析技術後可能產生的學生資料保護機制的缺失。 本論文認為當未成年學生於教育過程中，在與校方之間具有「特殊信任關係」的在學關係下，若國家與教育機構對於學生資訊隱私所進行的蒐集與管理程序，已逾越比例原則與正當法律程序原則之限制，將可能導致學生因感受到來自教育機構與國家的監視刻意迎合其偏好，導致失去自我人格自由開展的教育基本權核心目的。因此本論文認為對資料蒐集需具有明確法律授權基礎與明確且特定之使用目的，須經由立法機關透過法律方式建構完善且明確的資料蒐集與管理程序。學生之教育資料原則上應採取禁止資料共享，即便資料以經過匿名化之處理。以及我國個人資料保護機制採取分散式管理，由中央目的事業主管機關作為監督機關。但監督機關本身可能即為資料蒐集者、管理者或使用者，無法避免遭受「球員兼裁判」之質疑。因此本論文認為應可設置獨立的資料保護監督機關，由專職人員與獨立機關進行資料保護監督以避免監督漏洞。

When the digital database enters the education affairs to provide administrative agencies and educational institutions with low-cost, fast and convenient data storage and using technology, it may involve student data privacy. Based on the educational purpose and the educational authority granted by the law, the government uses compulsory means to collect and store all kinds of relevant educational materials from minor students in school. During the collection process, the exercise of the educational authority of administrative agencies and educational institutions is to protect the 'educational purpose' of minor students' right to education, but it may also conflict with the student data privacy. This article attempts to explore the core value of the right to education of K-12 students in our country, refer to the legal framework of education data protection in our country and the United States, and analyze whether the current large-scale collection of education data in our country is sufficient to ensure students' data privacy. Chapter 2 of this article discusses the core value of minor students’ right to education, which lies in the free development of self-realization and personality. Chapter 3 of this article discusses the importance of student data privacy and its status as a fundamental right in law. It also believes that the state and educational institutions should exercise their educational authority and should still pay attention to the 'principle of proportionality' and 'due process of law' when collecting large-scale educational data for students to avoid excessive interference with students’ right to privacy of information. In Chapter 4, this article starts with the student data privacy and the right to education. It considers the student data privacy as a necessary means to implement the right to education, and discusses the hidden concerns of our country regarding the protection of minor student data privacy. This article discusses the lack of student data protection mechanisms that may arise from the use of digital databases and analysis techniques in educational affairs in our country from the current personal data protection law and the data protection regulations involved in the education database. This article believes that when students have a 'special trust relationship' with the school in the education process, if the state and educational institutions collect students’ information without the 'principle of proportionality' and 'due process of law', it may cause students to feel that the surveillance from educational institutions and the state deliberately cater to their preferences, leading to the loss of the core purpose of the basic right of education of self-personality. Therefore, this article believes that the data collection must have a clear legal authorization basis and a clear and specific purpose of use, and the legislature must establish a complete and clear data collection and management process through legal means. In principle, students’ educational materials should be prohibited from being shared, even if the materials are anonymized. And our country's personal data protection mechanism adopts decentralized management, with the central competent authority of purpose undertaking as the supervisory authority. However, the supervisory authority itself may be the data collector, manager or user, and cannot avoid being questioned by the 'player and referee'. Therefore, this article believes that it should be possible to set up an independent data protection supervision agency, with specialized personnel and independent agencies to conduct data protection supervision to avoid supervision loopholes.