摘要：

大数据时代个人信息的收集与处理造成了自然人与信息控制者之间明显的信息不对称，从而使得在侵害个人信息的民事纠纷中，自然人无法证明泄露其个人信息的信息控制者是谁，以至于受害人难以获得救济。为此，司法实践多采取转换证明责任、降低证明标准等方法。然而，这些方法均无法为上述问题提供妥善合理的解决方案。一个合理的解决路径是，重新阐释《民法典》第1170条所规定的共同危险行为的理论基础，不再强调多个被告实施行为的危险性，而是侧重于这些行为客观上造成的证据损害现象。唯此，方能在受害人无法准确证明哪个信息控制者泄露了个人信息的案件中，通过类推适用共同危险行为制度，为受害人提供充分救济。未来我国的个人信息保护法应当对此作出相应规定。

关键词: 个人信息泄露, 因果关系, 共同危险行为, 事实不确定性, 庞理鹏案

Abstract:

The collection and processing of personal data in the era of big data has caused obvious information asymmetry between individuals and information controllers，so that individuals in civil actions could not obtain compensations due to the uncertainty of causation and other elements.To this end，some courts adopt methods such as conversion of responsibility of proof or reduction of proof standards.However，none of these methods can provide a reasonable solution to the above problems.A reasonable solution path is to reinterpret the theoretical basis of alternative liabilities，to focus on the evidence damage caused by these behaviors.In this way could cases of data breaches，in which the fact of leakages，causation and fault is uncertain，be resolved by analogy applying the alternative liabilities.In the future，China's personal information protection law should make corresponding provisions.

Key words: Data Breach, Causation, Alternative Liabilities, Factual Uncertainty, the Case of Panglipeng