个人信息处理中履行合同必需规则的限制适用

Restricted Application of Necessary Rules for the Performance of Contracts in the Processing of Personal Information

我国《个人信息保护法》第13条第1款第2项前段确立的履行合同必需规则为个人信息保护与合同法的规范互动提供了重要接口。以履行合同必需作为个人信息处理的合法性基础源于私人自治,但仅限于处理行为无涉或者较少干预人之尊严的例外情形,以避免架空信息主体同意制度。考察比较法上的限制路径可知,不论是欧盟数据保护委员会倡导的客观必要性标准,还是学者提出的主观必要性标准及其修正方案,均不能妥当协调合同自由与人之尊严的紧张关系。如欲彻底消除这种顾此失彼的困境,就必须严格区分个人信息保护与合同法两个不同层次,由此确立履行合同必需规则的双层构造。在合同成立且有效的前提下,只有为履行合同义务的处理行为纯粹服务于信息主体的合同利益,并符合目的关联性和对个人权益影响最小等标准,才能适用履行合同必需规则。依此对《个人信息保护法》第13条第1款第2项前段作目的论限缩,便将个人信息商业化利用的各种场景排除在外,但其依然能满足数字经济中商业模式发展与创新的基本要求,所谓“必要个人信息”的概念也因此被重新构造。

The first half sentence of Item 2,Paragraph 1,Article 13 of China's Personal Information Protection Law establishes the rule of necessity for contract performance,which provides an important interface for the interaction between the protection of personal information and the contract law.The reason why this rule can provide a legal basis for personal information processing comes from private autonomy,but it is limited to the exceptional cases where the processing activities do not involve or less interfere with human dignity.Only in this way can we maintain the central position of informed consent in the system of legal basis.By examining the restrictive approaches of comparative law,we can see that neither the objective necessity standard advocated by EU Data Protection Commission nor the subjective necessity standard proposed by scholars and its amendment can properly coordinate the tense relationship between freedom of contract and human dignity.In order to completely eliminate this dilemma,we must strictly separate the protection of personal information and the contract law into two different levels,so as to establish a two-tier structure of the rule of necessity for the performance of contracts.Under the premise that the contract is concluded and effective,only when the processing activities to the performance of the contractual obligations purely serve the contractual interests of the information subject and conform to the standards such as purpose relevance and minimal impact on information subject,can the rule of necessity for contract performance be applied.Therefore,the first half sentence of Item 2,Paragraph 1,Article 13 of China's Personal Information Protection Law should be teleologically reduced.Thus,various scenarios of commercial use of personal information are excluded,but it can still meet the basic requirements for development and innovation of business model in the digital economy.The concept of"necessary personal information"shouldbereformulated.