三重授权原则在个人信息处理中的限制适用  

Restricted Application of the Triple Authorization Principle in Personal Information Processing

作　　者：向秦 Xiang Qin

机构地区：[1]上海交通大学凯原法学院数据法律研究中心

出　　处：《法商研究》2022年第5期133-145,共13页Studies in Law and Business

基　　金：国家社会科学基金重大项目(18ZDA145)。

摘　　要：三重授权原则实为“用户同意+平台授权+用户同意”,是对《中华人民共和国个人信息保护法》第23条个人信息提供的典型描述,是在具体个案中第三方数据获取行为是否构成不正当竞争这一特定法律后果的裁判规则,其适用应受到合理限制。在主体上,第23条的“提供方”为非国家机关处理者或国家机关处理者;三重授权的“平台方”限于非国家机关处理者。在客体上,第23条适用于“处理的个人信息”;三重授权限于平台方生产并享有财产性权益的个人数据集合与个人数据报告。在场景上,第23条适用于“向其他个人信息处理者提供(共享和转让)”;三重授权限于开放平台模式的数据共享。在法律后果上,“同意”不等于“授权”,未经三重授权不一定侵权,经三重授权也不绝对免责,用户同意与平台授权有条件地相互替代。The triple authorization principle is“user’s consent+platform’s authorization+user’s consent”,which is a typical description of Article 23 of the Personal Information Protection Law of the People’s Republic of China.It is a judicial rule on whether the third-party data acquisition behavior constitutes unfair competition in specific cases,and its application should be reasonably limited.On the subject,the“provider”in Article 23 can be a state organ or a non-state organ,while the“platform”in the triple authorization mode is limited to a non-state organ processor.On the object,Article 23 applies to“processed personal information”,while the triple authorization principle is limited to personal data sets and reports that the platform produces.In the scenarios,Article 23 applies to“providing personal information to other processors”,while the triple authorization principle is limited to data sharing through Open API.“Consent”and“authorization”have different legal effects.Without triple authorization does not necessarily constitute infringement,nor is it an absolute exemption by triple authorization.Each level of authorization is not indispensable.

关 键 词：个人信息 三重授权原则 不正当竞争 

分 类 号：D922.16[政治法律—宪法学与行政法学]