行動應用軟體隱私保護標準研究

Abstract

行動應用軟體具備適地性、即時性、主動性，可以提供個人化的便利服務。智慧手機普及率上升，亦將帶動行動電子商務風潮，但是消費者對於隱私安全方面的顧慮，卻是推動之阻力。行動應用軟體暗藏隱私隱憂，可能輕易截取隱私資料，包括行動裝置代碼、帳號密碼、文字訊息、照片、影音、連絡資料、行事曆資料、歷史接聽紀錄、網路使用習慣、地理定位資料等。這些隱私資料是屬於我國個資法第二條「其他得以直接或間接方式識別該個人之資料」，為個資法保護之範圍。\n\n手機用戶隱私資訊外洩問題層出不窮，歐盟和美國之爭議案例頻仍，遂於近年陸續提出相關法案和隱私保護措施。歐盟為全方位式立法，著重政府主導功能；美國是部門式規範模式，尊重產業自律。為解決各國或國際組織之個資隱私保護規範不一致問題，透過信賴標章的產業自律規範，發展成為具有效力之民間保護標準，甚至是國家標準，進而與國際標準接軌，至少可為企業降低遵守法規所投入之成本。\n\n標準是可以用來捍衛國內產業競爭力，在國際市場競爭具有相當之重要性。國際標準組織的運作通常採共識決，強調嚴謹和透明化；需要在產業和政府支持下，累積國際標準制定經驗，長期堅持投入，始得取得領先主導標準之先機。最受到矚目的行動軟體隱私標準「不被追蹤」，因與廣告商利益衝突，W3C遲遲不能通過標準定案。在各國行動應用軟體隱私保護規範尚未完備之際，透過國際標準組織、區域組織和產業組織等自律發展，形成隱私保護標準，可彌補相關法令規範未及之處。\n\n建議自法規、隱私標準和隱私標章認證方面推動個資與隱私保護，朝向政府管制和產業自律併進之模式發展。國際行動應用軟體標準發展雖尚在萌芽階段，相關產業仍須密切關注。在科技推陳出新的時代中，個資和隱私保護法制總是趕不上科技變遷，為避免問題反覆發生，標準制定推動者、立法者和執法者皆需與時俱進。

Mobile applications featured with localization, instant responsiveness and proactivenss can provide convenient and personalized services. The widespread adoption of smart phones may drive the next wave of m-commerce（mobile e-commerce）, and however, consumer privacy fears limit the growth of m-commerce.\n\nThere are concerns over privacy leaks that mobile applications can easily access to privacy-sensitive data, such as UDID, ID/password, text messages, photos, videos, address book, calendar, historical phone records, on-line behavior, geolocation, etc. The privacy information mentioned above should have been covered under Article 2 of Taiwan Personal Information Protection Act “other information which may be used to identify a natural person, both directly and indirectly”.\n\nIn response to the increasing privacy leaks in mobile devices and law disputes, privacy protection measures and regulations have been proposed or enforced these years in European Union countries and the United States. European Union establishes a comprehensive legislation focused on government-centric functions, while the United States uses a sectoral approach that relies on industry self-regulation. In order to solve the inconsistent privacy regulations within countries and international organizations, one effective way is to promote privacy seals certified through industry self-regulation, and furthermore, develop to be industry standards, and national standards in line with international standards, and that can at least help enterprises reduce costs for responses to the mandatory regulations.\n\nStandards can be a means to safeguard industrial competitiveness, and are considered to be critically important to outcompete international trade markets. International standard bodies normally use consensus-building process, highlighted with impartiality and transparency. With supports from industry and government on accumulating experiences in international standard setting, and long-term inputs in participation, aim at competing for market dominance. The catching debate over digital advertisers interests to nail down the long overdue Do Not Track standard continues at W3C. While awaiting privacy regulations for mobile applications, self-regulation can be developed within international standard bodies, regional organizations, industry consortia, and privacy protection standards can help patch up the inadequacy of existing regulations.\n\nIt is recommended to promote protection of personal data and privacy from aspects of regulations, privacy standards, and privacy seal certification, toward a model combined with government regulation and industry self-regulation. Mobile apps standards are still at the initiative stage, and therefore, the related industries should watch closely. Following by the advancement of technology with each passing day, personal data regulations and privacy laws are in danger of lagging behind technological change. In order to prevent recurring problems, standard setters, regulators, and executors should keep pace with the times.