新版「個人資料保護法」在民國99年5月公布，並正式實施於民國101年10月；隨著新法的實施，不管是公部門或民間組織，都投入大量資源以期改善並確保自己的組織對於個人資料之蒐集、處理與利用，能夠符合「個人資料保護法」的要求。 由於業務特性，個人資料的蒐集、處理與利用，乃是銀行業者日常必須面對的課題。雖然舊版個資相關法令「電腦處理個人資料保護法」與「銀行法」對於個人資料的處理都已有相關規定，但由於稽核與舉證困難、罰則過輕等原因，業者並未真正重視個資保護課題，善盡個資保護的責任，所以銀行發生個資外洩的案例時有所聞。新版「個人資料保護法」正式實施後，舉證責任歸屬由當事人變成企業，在疑似個資外洩事件發生時，企業須舉證其組織之系統或機制已對個人資料之控管機制已滿足「個人資料保護法」的要求，盡到完善管理之責任。因此業者不得不投入大量資源來周全組織內對於個人資料的保護與稽核機制，把新版法規的各項規定要求納入系統功能範疇。 伴隨「個人資料保護法」的實施，法務部頒布了「個人資料保護法之特定目的及個人資料之類別」細則來明確規範個人資料的類別範疇、以及存取個人資料之目的。本研究即針對此項要求，歸納分析銀行業的業務現況，並納入未來業務發展之可能需求，設計一具備彈性之個資存取框架以管理個資分類與存取目的，進而滿足「個人資料保護法」的要求。 / As the latest version of the "Personal Data Protection Act (PDPA)" published on May, 2010, and formally implemented since October, 2012, all public and private sector organizations need to put in significant resources to meet the strengthened legal requirements of personal data collection, processing and utilization. Yet banks are among the first to be affected by them, as personal data collection, usage and handling are essential to their daily operations. Therefore, this thesis investigates the compliance of PDPA from a banking perspective. A distinguished feature of the new "Personal Data Protection Act" is the inclusion of "purposes" in regulating access to personal data, namelyan organization must get the informed consent from its customer regarding how her personal data will be used, namely privacy preferences. Currently, employing a proper access control mechanism to protect customer's data is a well-accepted discipline in bank information system (BIS) development. However, the design of such mechanisms hardly includes the requirement of supporting customers’ preferences regarding the use of their personal data. It is therefore highly desirable to extend a BIS's access control to handle customers' privacy preferences. This thesis investigates the common practices of bank operations and presents a purpose-based access control framework for future BIS development. Specifically, we derive a classification of bank customers' personal data and purpose categories for bank operations so that the proposedaccees control framework can ensure all accesses to customers' personal data match their granted access purposes. As a result, the framework will lay a foundation to the compliance of PDPA for a bank.

在網路世界中，人們以匿名表達意見遠比現實生活中更為容易，這件事已劇烈地改變了匿名言論的量與質。從好的面向看，匿名帶來自主，讓異議者可以透過網路匿名，表達可能永遠都不敢在眾人面前說出來的真正想法，讓觀念市場變得多元豐富；另一方面，匿名提高了追究責任的困難。相較於現實世界的言論，損害他人或構成犯罪的惡質網路匿名言論，將造成影響更深遠且永久的傷害。 　　目前，關於網路匿名言論的管制方式，世界各國政府都是仰賴「事後追懲模式」和「實名認證模式」的其中一種。前者是網路使用者原則上可以匿名地發表言論，但如果發表不當言論並造成傷害，受害者或國家可以揭露其身份以對其展開司法追訴；後者是網路使用者在張貼言論前，必須先向國家機關指定的網路業者交出個人真實身份資料以進行驗證後，才能匿名發言，或甚至完全禁止以匿名方式發言，讓網路使用者感受到被眾人監督的壓力，不敢發表不當內容。 　　本文主張，網路匿名言論是受到憲法所保障的權利，而「事後追懲模式」相較於「實名認證模式」，較能調和不同權利間的衝突。不過，儘管我國政府採取此模式，卻在設計民刑事訴訟制度時，漏未導入匿名言論權利的思考，導致網路匿名表意者一經策略性訴訟攻擊，真實身份就會立即暴露，使得匿名表意自由不過徒有虛幻表象。因此，本文建議，為落實對匿名言論自由的保護，立法者宜參考美國法，修改部分訴訟法來處理此問題。 / On the internet, people can express themselves anonymously far easier than in the physical world. This fact has dramatically changed both the quantities and qualities of anonymous speech. On the bright side, anonymity brings more autonomy. Dissenters can express their real opinions, which they might never have the courage to speak out in public. It, in turn will promote the diversity and integrity of the marketplace of ideas. Yet, anonymity also makes it more difficult to hold the speakers accountable. In addition, compared to speech in the real physical world, malicious online anonymous speech will cause more serious permanent harms. 　　Today, governments around the world are either relying on the “Ex Post Compensation and Punishment” approach or the “Real-Name Verification System” to regulate online anonymous speech. Under the former approach, internet users can express their opinions anonymously, but if the content of their speech is malicious and causes damages to other people, the victim can seek disclosure of the speaker’s identity in order to take legal actions against the speaker. In contrast, under the latter system, internet users have to provide their personal information (real identities) to the ISPs or ICPs appointed by governments and complete the verification process before they can post their words. Some real name systems go even further by banning anonymous speech completely. By making users feel like they are being supervised by the public, the real name system wishes to deter indecent contents 　　This thesis argues that online anonymous speech is protected by the Constitution, and the ‘Ex Post Compensation and Punishment’ is a preferred approach because it can better balance the conflicting rights. In Taiwan, although the government has chosen the ‘Ex Post Compensation and Punishment’ approach, current civil/criminal procedural laws and practices afford little protection to online anonymous speakers. The plaintiff, who is allegedly harmed by the anonymous speech, can easily bring a “Strategic Lawsuit,” with the sole purpose of obtaining the identity of the online anonymous speaker. Consequently, this thesis suggests that, in order to better protect the freedom of anonymous speech, the legislators of Taiwan should refer to U.S. laws and practices and revise several provisions of Taiwan’s Code of Civil Procedure and Code of Criminal Procedure.