最小必要原则在平台处理个人信息实践中的适用
武腾最小必要原则在平台处理个人信息实践中的适用
Application of the Principle of Data Minimization to the Processing of Personal Information by Online Platforms
期刊名称：《法学研究》
期刊年份：
作者：武腾
单位：
中文关键词：个人信息保护;最小必要原则;网络平台;忠实义务;补充性的合同解释
英文关键词：protection of personal information; the principle of data minimization; online platforms; duties of loyalty; supplementary interpretation of contract
中文摘要：
最小必要原则包括相关性、最小化、合比例性三个子原则。在适用该原则时，我国实践中的主流做法是只承认网络平台的次要处理目的，即实现具体业务功能，而不承认其主要处理目的，即提供精准的交易媒介服务。最小化原则的要求与网络平台实现其主要处理目的之间存在巨大张力，个人信息自主控制制度、匿名化制度都难以缓解该张力。鉴于最小必要原则的适用范围局限于利益减损型处理行为，如果网络平台实际上为增进信息主体的利益而行动，便不满足最小必要原则的适用条件。按照补充性的合同解释方法，网络平台在提供媒介服务时应当承担给付型忠实义务，即有义务为消费者在所媒介交易中的可得利益最大化而行动。履行给付型忠实义务的网络平台，在其个人信息处理的综合影响为正面，且给信息主体造成的损害或者危险有限的情况下，可以在合理的必要范围内处理非敏感的和敏感度低的个人信息。
英文摘要：
The principle of data minimization consists of three sub-principles:relevance, minimization and proportionality. The mainstream attitude adopted in the application of this principle is merely recognizing online platforms' accessory purpose of processing personal information that is the realization of specific business functions, while denying its main purpose that is to provide targeted intermediation services. There is a great tension between the sub-principle of minimization and the realization of the main purpose of online platforms, which can hardly be relieved by either the norms on data self-determination or the norms on anonymization. Given the fact that the principle of data minimization should be applied only if the processing of personal information has a negative impact on data subjects, the conditions of applying this principle are not satisfied as long as online platforms act for the data subjects' best interests. With the help of supplementary interpretation of contract, online platforms should be imposed duties of loyalty toward data subjects when they perform main contractual obligations, i.e., they should act for the maximization of consumers' expected interests in the promoted transactions. As to online platforms that fulfill duties of loyalty, they may process non-sensitive or low-sensitive personal information within a reasonably necessary scope, if the comprehensive impact of processing on data subjects' interests is positive, and the negative impact can be limited to a certain extent.
全文阅读： 点击下载
