“个人信息已公开”作为合法处理事由的法理基础和规则适用

“Personal Information Publicly Disclosed”as a Legitimate Cause for Processing--Jurisprudential Basis and Application of Rules

《个人信息保护法》第13条将“个人信息已公开”列为可豁免于同意规则的合法处理事由,须阐明该事由的法理基础和规则适用,以解决其与个人信息保护体系掣肘、豁免弹性过大等问题。基于自愿公开或合法强制公开的处理分别以推定同意、与强制公开具有一致目的为正当性基础,符合立法者设置合法处理事由的一贯价值理念和规范逻辑。可作为合法处理事由的“公开”须具备信息处于公开状态与信息公开合法两个要件。“公开”为非场景性概念,指信息处于不特定第三人均可获取的开放状态。自愿公开要求个人明示公开或实施了独立的公开行为;强制公开须符合法律、行政法规的规定。“处理”须具有合理性,处理的客体仅及于信息,不包括数据等信息载体;处理目的须与公开目的客观一致,不完全排除个人信息处理者为获益进行的处理。个人明确拒绝处理的,发生合法性阻断的效力,但强制公开情形下,拒绝将导致公开目的不能实现的除外;处理存在较高权益侵害风险的,自始不能豁免于同意规则。

“Personal information publicly disclosed” is listed in Article 13 of the Personal Information Protection Law as a legitimate cause for personal information processing. Compared with other legitimate causes, the application of this cause is not limited to the protection of a specific interest. As a result, it may have such problems as possible limitation by the whole personal information protection system and excessive flexibility in application. Thus, it is necessary to clarify the legitimate jurisprudential basis, essential elements for establishment and application limits of this cause. “Personal information publicly disclosed” can be divided into two types: information disclosed voluntarily and information disclosed by legal compulsion. As far as jurisprudential basis is concerned, the processing of voluntarily disclosed information is justified on the presumption that the subject consents to the processing activities, whereas the processing of mandatorily disclosed information is justified on the basis that its purpose is consistent with that of mandatory disclosure. As far as its essential elements are concerned, the disclosure of information that can be treated as a legitimate cause must meet two conditions: the information is objectively in the state of being disclosed and the information is lawfully disclosed. Disclosure is a non-situational concept used to describe the accessibility of information, meaning that the information is in a state of being disclosed and accessible to any third party. The specific judgment of the state of openness is based on whether the information is disclosed through the open channel of information communication, taking into account the functional attributes of the channel and the scope of the persons who can have access to it. Voluntary disclosure requires the subject to show a clear willingness to disclose the information, including express willingness in written or oral form and implied willingness expressed by independent and definite behavior. Compulsory disclosure should conform to the relevant laws and administrative regulations. As far as limits of application are concerned, firstly, the processing must be reasonable. The purpose of processing must be objectively consistent with the purpose of disclosure. However, the objective consistency of purposes does not exclude the processing for the economic benefit or other subjective purposes of the processor. Secondly, legality blocking effect of the processing may occur if the subject expressly refuses the processing. If the subject expressly refuses the processing by another person of the information he or she voluntarily discloses, the other person may not continue the processing of the information. If the subject expressly refuses the processing by another person of his or her information that has been disclosed by legal compulsion, the continued processing can still be legitimate only if the processing is necessary for the purpose of compulsory disclosure and the adverse effects caused by the processing on the subject are proportional. Finally, the processing which may cause a high risk of infringement, such as processing of disclosed but sensitive personal information, is not exempt from the consent rule from the beginning.