论为履行法定义务所必需的个人信息处理活动  

On Personal Information Processing Which Is Necessary for Compliance with Legal Obligations

作　　者：程啸[1] CHENG Xiao

机构地区：[1]清华大学法学院

出　　处：《当代法学》2024年第6期30-43,共14页Contemporary Law Review

基　　金：2023年度国家社科基金重大项目“数字经济治理体系法治化研究”(23&ZD155)的阶段性成果。

摘　　要：为履行法定义务所必需的个人信息处理活动是我国《个人信息保护法》第13条第1款第3项规定的处理个人信息无需取得个人同意的情形之一。该项的“法定义务”是直接来源于法律规定的义务,承担法定义务的主体是个人信息处理者。只有我国法律法规和规章规定的义务才构成法定义务。处理者履行外国法律或法院、行政机关的判决或命令施加给其的义务时,应当适用我国法律关于国际司法协助或行政执法协助的相关规定。法定义务仅限于其内容与个人信息处理活动直接相关的公法上的义务。为履行法定义务所必需是指,处理活动符合设定法定义务的法律规范所明确的处理目的,符合必要性且与该目的直接相关,并采取了对个人权益影响最小的方式。在为履行法定义务所必需的个人信息处理活动中,个人没有撤回同意的权利和个人信息可携带权。即便合同将法定义务约定为合同义务,也应当优先援引为履行法定义务所必需作为个人信息处理活动的合法性基础。国家机关履行法定职责并不当然就给相对人设定了法定义务,故此,为履行法定职责所必需的处理活动并不与为履行法定义务所必需的处理活动相对应。The processing of personal information necessary for fulflling legal obligations is one of the circumstances under Article 13,Paragraph 1,Item 3 of China's Personal Information Protection Law(PIPL)where personal information can be processed without obtaining the individual's consent.Accurately defining the nature,content,and subjects of the legal obligations,as well as the scope of legal norms establishing these obligations and the criteria for determining"necessity,"is essential for fully protecting personal information rights and ensuring the appropriate fulfllment of legal obligations and the reasonable utilization of personal information.The"legal obligations"referred to in Article 13,Paragraph 1,Item 3 of the PIPL are those directly derived from legal provisions and do not include legal obligations arising from contracts.Additionally,legal obligations are limited to public law duties directly related to the processing of personal information.Public law obligations are duties determined by legal norms that regulate the relationship between public authorities and private entities.The distinguishing feature of these obligations is that non-fulfillment by the obligated party results in administrative legal liability,which may include penalties or even criminal liability.In the context of public law obligations that serve as a legal basis for personal information processing,the content of these obligations must be directly related to a specific personal information processing activity.The subjects responsible for fulflling legal obligations are personal information processors.And in accordance with the legislative purpose and a systematic understanding of PIPL,as well as international accepted practices,the laws establishing these obligations are limited to Chinese laws,excluding any obligations set by foreign laws,foreign court's judgments,or orders from foreign administrative authorities.When personal information processors fulfill obligations imposed by foreign laws,judgments,or administrative orders,they shou

关 键 词：个人信息保护法 处理活动 法定义务 约定义务 法定职责 

分 类 号：D923[政治法律—民商法学] D922.16[政治法律—法学]