法定職責作為國家機關處理個人信息的邊界

《個人信息保護法》為國家機關確立了“告知同意”規則的豁免適用條件——“法定職責”和配套的必要性原則。借鑒個人信息權益的基礎性權能與工具性權能的二分法，可將個人信息處理行為區分為核心信息處理行為與輔助信息處理行為。對於核心信息處理行為，“法定職責”中的“法”應限定為規章以上的規範性文件，且必須明確授權；對於輔助信息處理行為，在上位法已經授予核心信息處理權限的前提下，“法”的範圍可擴展至所有合法規範，且無需明確授權。此外，應承認創設對等權利的行政協議和組織規範前提下的行政慣例，作為職責來源的補充。鑒於數字化改革推進的整體政府進程，必要性原則的適用不應局限於靜態的“最小化”，而應根據公共數據收集、共享與開放的階段特徵，結合個人信息處理活動對信息權益的具體影響，構建起情境化的必要性原則內涵，以實現職責履行與個人信息權益之間的動態平衡。

The Personal Information Protection Law established exemption conditions, namely“statutory duties”(or literally“duties fixed by regulations”) and the accompanying principle of necessity, from the“notification and consent”requirement for state organs. Drawing on the dichotomy between the foundational and instrumental functions of personal information rights and interests, personal information processing activities could be categorized into core information processing activities and auxiliary information processing activities. For the core information processing activities, the term“regulations”in“duties fixed by regulations”should be limited to normative documents at or above the level of Rules (Departmental Rules and Local Governmental Rules), and explicit authorization is required. For the auxiliary information processing activities, provided that superior legislation had already granted authority for core information processing, the scope of“regulations”may be extended to all legitimate norms, and explicit authorization is not required. Furthermore, administrative agreements establishing reciprocal rights and administrative practices on the premise of organizational norms should be recognized as supplementary sources of duties. Given the Whole-of-Government process promoted by digital reforms, the application of the necessity principle should not be confined to static“minimization”. Instead, we should construct a contextualized understanding of necessity, by considering the stage-specific characteristics of public data collection, sharing, and openness, along with the specific impacts of personal information processing activities on information rights and interests, thereby achieving a dynamic balance between duty fulfillment and the protection of personal information rights and interests.