論為履行法定義務所必需的個人信息處理活動

On Personal Information Processing Which Is Necessary for Compliance with Legal Obligations

為履行法定義務所必需的個人信息處理活動是我國《個人信息保護法》第13條第1款第3項規定的處理個人信息無需取得個人同意的情形之一。該項的“法定義務”是直接來源於法律規定的義務，承擔法定義務的主體是個人信息處理者。只有我國法律法規和規章規定的義務才構成法定義務。處理者履行外國法律或法院、行政機關的判決或命令施加給其的義務時，應當適用我國法律關於國際司法協助或行政執法協助的相關規定。法定義務僅限於其內容與個人信息處理活動直接相關的公法上的義務。為履行法定義務所必需是指，處理活動符合設定法定義務的法律規範所明確的處理目的，符合必要性且與該目的直接相關，並採取了對個人權益影響最小的方式。在為履行法定義務所必需的個人信息處理活動中，個人沒有撤回同意的權利和個人信息可攜帶權。即便合同將法定義務約定為合同義務，也應當優先援引為履行法定義務所必需作為個人信息處理活動的合法性基礎。國家機關履行法定職責並不當然就給相對人設定了法定義務，故此，為履行法定職責所必需的處理活動並不與為履行法定義務所必需的處理活動相對應。

The processing of personal information necessary for fulfilling legal obligations is one of the circumstances under Article 13, Paragraph 1, Item 3 of China's Personal Information Protection Law (PIPL) where personal information can be processed without obtaining the individual's consent. Accurately defining the nature, content, and subjects of the legal obligations, as well as the scope of legal norms establishing these obligations and the criteria for determining ''necessity,'' is essential for fully protecting personal information rights and ensuring the appropriate fulfillment of legal obligations and the reasonable utilization of personal information. The ''legal obligations'' referred to in Article 13, Paragraph 1, Item 3 of the PIPL are those directly derived from legal provisions and do not include legal obligations arising from contracts. Additionally, legal obligations are limited to public law duties directly related to the processing of personal information. Public law obligations are duties determined by legal norms that regulate the relationship between public authorities and private entities. The distinguishing feature of these obligations is that non-fulfillment by the obligated party results in administrative legal liability, which may include penalties or even criminal liability. In the context of public law obligations that serve as a legal basis for personal information processing, the content of these obligations must be directly related to a specific personal information processing activity. The subjects responsible for fulfilling legal obligations are personal information processors. And in accordance with the legislative purpose and a systematic understanding of PIPL, as well as international accepted practices, the laws establishing these obligations are limited to Chinese laws, excluding any obligations set by foreign laws, foreign court's judgments, or orders from foreign administrative authorities. When personal information processors fulfill obligations imposed by foreign laws, judgments, or administrative orders, they should comply with relevant provisions of Chinese law concerning international judicial or administrative enforcement assistance. Even if personal information processors are legally obligated to carry out certain personal information processing activities, this does not automatically mean that the processing can occur without obtaining the individual's consent. Only when the processing activity is ''necessary'' for fulfilling legal obligations, as stipulated in Article 13, Paragraph 1, Item 3 of the PIPL, can the processing occur without obtaining the individual's consent. The ''necessity'' requirement reflects the principles of necessity and purpose limitation under the PIPL. Fulfilling the necessity requirement means that the processing activity aligns with the explicit purposes established by the legal norms, meets the necessity principle, is directly related to those purposes, and is carried out in a manner hat minimally impacts individual rights. In personal information processing activities necessary for fulfilling legal obligations, individuals do not have the right to withdraw consent or the right to data portability. Even if a contract stipulates that a legal obligation is also a contractual obligation, the necessity to fulfill the legal obligation should be prioritized as the legal basis for personal information processing activities. The mere fact that state organs perform statutory duties does not automatically impose legal obligations on the counterparties. An order issued by an administrative organ to a processor of personal information in order to fulfill its legal duty cannot serve as a basis for the legality of personal information processing, which instead, must be clearly set by the law. Therefore, processing activities necessary for fulfilling statutory duties do not correspond to those necessary for fulfilling legal obligations.