《电子技术应用》
您所在的位置:首页 > 其他 > 设计应用 > 免于同意之合同所必需规则的原理探究与落地适用
免于同意之合同所必需规则的原理探究与落地适用
网络安全与数据治理
伍旋航
(厦门大学法学院,福建厦门361005)
摘要: 作为“同意例外”情形之一的合同所必需规则为个人信息保护与合理利用的动态利益平衡提供了规范依据。依据《个人信息保护法》第13条第1款第2项的规定,合同所必需规则包含两种情形:一是个人作为一方当事人与作为另一方当事人的处理者订立合同所必需;二是上述双方主体为履行合同所必需。《个人信息保护法》设立合同所必需规则并无“架空”告知同意规则之意,处理目的、处理范围以及处理场景可作为合同所必需规则的三层条件限定。据此,从常见的个人信息处理场景出发,对合同所必需规则的适用展开进行了列举。此外,还应从法律效果上准确把握合同所必需规则。首先,合同所必需规则并不排斥其他合法性基础的适用。其次,适用合同所必需规则可豁免同意征求,但不及于“重新取得同意”与“撤回同意”的情形。再而,合同所必需规则仅豁免处理者的同意征求义务,处理者仍需遵守个人信息处理规则。最后,应明晰合同所必需规则的适用多为个人信息被处理者收益。
中图分类号:D92 文献标识码:ADOI: 10.19358/j.issn.2097-1788.2024.02.012
引用格式:伍旋航.免于同意之合同所必需规则的原理探究与落地适用[J].网络安全与数据治理,2024,43(2):78-85.
Exploring the rationale and practical application of the rules necessary for a contract without consent
Wu Xuanhang
(School of Law, Xiamen University, Xiamen 361005, China)
Abstract: As one of the “Consent exceptions”, the rules necessary for a contract provide a normative basis for the dynamic balance between the protection of personal information and the rational use of personal information. Pursuant to Article 13 (1) (2) of the Personal Information Protection Law, the rules necessary for a contract consist of two situations: one is necessary for an individual to enter into a contract as a party to a contract with a processor as a party to the other party, and the other is necessary for the performance of the contract by the abovementioned parties. Personal Information Protection Law sets up the necessary rules of the contract is not “Overhead” informed consent rules meaning, the purpose, scope, and context of the processing can be defined as three levels of conditions for the required rules of the contract. Based on this, this paper enumerates the application of the rules necessary for a contract from the common personal information processing scenarios. In addition, we should grasp the necessary rules of the contract accurately from the legal effect. Firstly, the rules necessary for a contract do not exclude the application of other bases of legality. Secondly, the application of this rules may exempt consent from solicitation, but not in the case of “Re consent” and “Withdrawal of consent”. Moreover, the rules necessary for a contract only exempt the processor from the consent seeking obligation, and the processor is still required to comply with the personal information processing rules. Finally, it should be made clear that the application of the necessary rules of a contract is mostly for the benefit of the person whose personal information is processed.
Key words : personal information processing;basis of legality;rules necessary for a contract;consent to exemptions

引言

《个人信息保护法》确立了以“告知—同意”为核心的个人信息处理规则,强调了个人信息处理中对个人信息主体的权利保障。同意并非个人信息处理的唯一合法性基础。《个人信息保护法》第13条第1款第2项规定“为订立、履行个人作为一方当事人的合同所必需”(以下简称“合同所必需规则”)同属个人信息处理的合法性基础之一。合同所必需规则借鉴了GDPR第61(b)条的规定,但国内对该规则的原理内涵与具体适用仍不明晰。为更好推动合同所必需规则的落地适用,本文结合GDPR第61(b)及相关规定,对合同所必需规则的内涵与实践适用进行了分析。1合同所必需规则的基本内涵 欧盟数据保护委员会曾通过了一项《关于在向个人信息主体提供在线服务时根据GDPR第61(b)条处理个人数据的准则》(2.0版)(以下简称《准则》),上述指南对GDPR第61(b)条对合同所必需规则的基本内涵和适用标准作了详细规定,对理解合同所必需规则的原理具有重要意义。11设立合同所必需规则的考虑个人信息处理的合法性基础主要有两大类:一是同意,二是法定许可(又称“同意例外”)。基于同意的个人信息处理体现了对个人同意授权的严格遵循,是在大数据时代赋予个人信息主体的一项自主决定权利。我国《个人信息保护法》允许个人信息处理者基于法定许可处理个人信息主要有三个层面的考虑。第一,个人信息来源于个人,但个人信息并非绝对独占的。个人信息还承载着除了个人利益之外的社会利益甚至国家利益。因此,特定情形下,个人信息主体需要让渡其享有的同意授权的权利,以实现不同利益之间的平衡[1]。这一利益平衡理念同样体现在GDPR,其序言指出“保护个人数据的权利不是一项绝对权利,必须考虑其在社会上的作用并应当根据比例性原则与其他基本权利保持平衡。”


作者信息:

伍旋航

(厦门大学法学院,福建厦门361005)


文章下载地址:https://www.chinaaet.com/resource/share/2000005906


weidian.jpg

此内容为AET网站原创,未经授权禁止转载。