Abstract: The black box state of the algorithm conceals and solidifies unequal social power structure, resulting in runaway problems such as algorithm discrimination. The private law approach to algorithm regulation is to clarify the rights and obligations between the algorithm controller and the data subjects, so as to protect individuals from the discipline of the algorithm. The premise of private law regulation is that the algorithm should be recognized as a tool, and the controller (developer) behind it should be responsible for the consequences of the algorithm getting out of control. Algorithm decision-making is inseparable from data. The root of the algorithm’s runaway problem lies in the data collected by the algorithm controller. As data subjects, individuals have the right of personality for personal information (data), while the algorithm controller provides services to obtain the right to use. The legal relationship between the two should be interpreted as a fiduciary relationship. Under the framework of fiduciary duty, the algorithm controller has the duty of diligence, loyalty and information disclosure. After clarifying the obligations of the algorithm controller, we should look for the tools to regulate the algorithm in the spectrum of rights in private law, including establishing personal information rights of data subjects and consolidating privacy rights.

Key words: private law regulation, fiduciary duty, personal information right, privacy right