处理者的合法利益不是个人信息处理的法律根据  

Legitimate Interest of Processor is not Legal Basis for Personal Information Processing

作　　者：程啸[1] CHENG Xiao

机构地区：[1]清华大学法学院

出　　处：《暨南学报（哲学社会科学版）》2024年第9期52-64,共13页Jinan Journal(Philosophy and Social Sciences)

基　　金：国家社会科学基金重大项目“数字经济治理体系法治化研究”(23&ZD155);清华大学自主科研计划项目“个人信息权益研究”(2021THZWYY02)。

摘　　要：我国《个人信息保护法》《民法典》等法律未如欧盟《通用数据保护条例》那样将个人信息处理者(或第三方)的合法利益作为一类独立的个人信息处理的法律根据。这种规定是科学合理的。一方面,合法利益的范围过于宽泛,并且适用前需要考虑个案情形及各种因素进行利益平衡测试,所以在解释上和适用上具有较大的不可预期性和难度,也不符合我国法律严格规范个人信息处理活动及充分保护个人信息权益的要求。另一方面,我国现行法律制度足以保护个人信息处理者(或第三方)的合法利益,司法实践中处理者(或第三方)的合法利益抗辩都可以通过有关规定逐一解决。此外,我国法也对处理者(或第三方)的合法利益与个人的权益间位阶有相应的规定。故此,合法利益不应当作为我国法上个人信息处理的法律根据。The China Personal Information Protection Law(PIPL),China Civil Code(CCC)and other laws do not regard the legitimate interests of personal information processors(or third parties)as an independent legal basis for the processing of personal information as the EU General Data Protection Regulation(GDPR)does.This has led to some criticism and doubts:does this constitute a legislative loophole?How can the balance of interests between personal information processors(or third parties)and individuals be achieved under current Chinese law?This article,by reviewing relevant EU legislation and incorporating the authoritative opinions of EU specialized working groups and foreign legal theories,examines the specific content and application methods of legitimate interests as a legal basis for personal information processing under EU law.It points out that this approach has significant drawbacks and cannot be directly transplanted into the PIPL.Moreover,upon examining Chinese law,it can be found that comprehensive and systematic application of the existing law is in fact sufficient to protect the legitimate interests of processors and third parties.It neither needs nor should introduce legitimate interests as an independent legal basis for personal information processing.It is right and reasonable that Article 13,Paragraph 1 of the PIPL does not include legitimate interests as an independent legal basis for personal information processing.Specifically,on the one hand,from the Data Protection Directive to the GDPR,the scope of legitimate interests under EU law has always been too broad,and individual case circumstances and various factors need to be considered before application for interest balance test.Therefore,there is greater unpredictability and difficulty in interpretation and application,and it does not comply with the strict norms of Personal information processing and fully protecting personal information rights and interests in China.On the other hand,CCC,PIPL Cybersecurity Law and other Chinese laws already contain

关 键 词：合法利益 个人信息处理 法律根据 个人信息保护法 

分 类 号：D9[政治法律—法学]