GDPR合法處理數據的六大法律依據——你的數據處理“合法嗎”？
引言
隨著全球數字化進程的加速，數據已成為企業運營不可或缺的資產。然而，在享受數據帶來的便利與價值的同時，企業也面臨著日益嚴格的數據保護法規挑戰。其中，歐盟的《通用數據保護條例》（GDPR）無疑是全球範圍內最具影響力的法規之一。對於出海歐盟的中國企業而言，理解並遵守GDPR是其在歐洲市場合法運營的基石。GDPR的核心原則之一是數據處理的合法性，即企業在處理個人數據時必須擁有明確的法律依據。本文將深入探討GDPR規定的六大合法處理數據依據，並通過真實案例，幫助中國企業更好地理解和應用這些原則，確保其數據處理活動“合法”。
GDPR合法處理數據的六大法律依據
根據GDPR第六條第一款的規定，個人數據處理的合法性必須至少滿足以下六種情況之一：
1. 同意 (Consent)
定義：數據主體已明確同意為一個或多個特定目的處理其個人數據。同意必須是自由給予的、具體的、知情的且明確的。這意味著數據主體必須通過明確的肯定行動來表示同意，例如勾選方框或簽署聲明。沉默、預勾選的方框或不作為不能構成同意。
案例：某中國電商平臺在歐盟地區運營，用戶注冊時，平臺要求用戶勾選“我同意接收營銷郵件”的選項。如果用戶主動勾選，則平臺獲得了處理其個人數據用於發送營銷郵件的合法依據。如果用戶未勾選，平臺則不能發送營銷郵件。
2. 合同履行 (Contractual Necessity)
定義：數據處理對於履行數據主體作為一方當事人的合同是必要的，或者為了在簽訂合同前應數據主體的請求采取措施是必要的。
案例：一家中國SaaS公司為歐盟客戶提供雲服務。為了履行服務合同，該公司需要處理客戶員工的姓名、郵箱等信息以創建賬戶並提供技術支持。這種數據處理是履行合同所必需的，因此具有合法依據。
3. 法律義務 (Legal Obligation)
定義：數據處理對於遵守控制者所承擔的法律義務是必要的。這裏的法律義務是指歐盟或成員國法律規定的義務，不包括合同義務。
案例：某中國金融科技公司在歐盟設有分支機構，根據當地反洗錢（AML）法規，該公司需要收集並存儲客戶的身份信息和交易記錄。這種數據處理是為了遵守法律義務，因此是合法的。
4. 重大利益 (Vital Interests)
定義：數據處理對於保護數據主體或另一自然人的重大利益是必要的。這通常指涉及生命安危的緊急情況。
案例：一家中國醫療設備制造商在歐盟銷售其產品。當其設備發生故障可能危及患者生命時，制造商需要緊急處理患者的個人健康數據以提供必要的醫療支持或召回產品。這種處理是為了保護數據主體的重大利益。
5. 公共任務 (Public Task)
定義：數據處理對於履行公共利益任務或行使控制者被賦予的官方權力是必要的，且該任務或權力的基礎有明確的法律規定。
案例：某中國研究機構與歐盟某大學合作進行公共衛生研究項目，該項目涉及處理大量匿名化或假名化的個人健康數據。如果該研究被認定為履行公共利益任務，且有明確的法律依據支持，則數據處理是合法的。
6. 合法利益 (Legitimate Interests)
定義：數據處理對於控制者或第三方追求的合法利益是必要的，除非這些利益被數據主體的基本權利和自由所推翻，特別是當數據主體是兒童時。公共機構在履行其官方任務時不能依賴此依據。
案例：某中國遊戲公司為了防止欺詐行為和確保遊戲公平性，需要收集並分析玩家的遊戲行為數據。這被視為公司的合法利益。然而，公司必須進行“合法利益評估”（LIA），權衡其利益與玩家的權利和自由，並確保采取適當的保護措施，例如數據匿名化或假名化。
如何選擇合適的法律依據
選擇合適的法律依據是GDPR合規的關鍵。企業在決定數據處理的法律依據時，應遵循以下原則：
-
特殊類別數據： 對於特殊類別個人數據（如健康數據、種族信息等），除了上述六大依據外，還需要滿足GDPR第九條規定的額外條件。
-
目的導向： 明確數據處理的目的，並根據目的選擇最合適的法律依據。沒有哪個依據是“更好”或“更重要”的，關鍵在於其與處理目的的匹配度。
-
必要性原則： 確保數據處理對於實現特定目的而言是必要的。如果可以通過其他侵入性較小的方式實現相同目的，則不應選擇當前的處理方式。
-
透明性： 在隱私政策中清晰地告知數據主體數據處理的法律依據和目的。
-
不可隨意更換： 一旦確定了法律依據，不應隨意更換。特別是從“同意”切換到其他依據，可能會被視為不公平。
結論
GDPR的六大合法處理數據依據為企業在歐盟地區處理個人數據提供了明確的框架。對於中國出海歐盟的企業而言，深入理解並正確應用這些依據，不僅是法律合規的要求，更是建立數據信任、維護企業聲譽的重要途徑。企業應在數據處理活動開始前，仔細評估並記錄其法律依據，確保每一步數據處理都“合法”，從而在歐洲市場行穩致遠。
The Six Lawful Bases for Processing Data under GDPR – Is Your Data Processing “Lawful”?
Introduction
With the acceleration of global digitalization, data has become an indispensable asset for business operations. However, while enjoying the convenience and value brought by data, enterprises also face increasingly stringent data protection regulations. Among them, the European Union’s General Data Protection Regulation (GDPR) is undoubtedly one of the most influential regulations worldwide. For Chinese enterprises expanding into the EU market, understanding and complying with GDPR is the cornerstone of their legal operations in Europe. One of the core principles of GDPR is the lawfulness of data processing, meaning that enterprises must have a clear legal basis when processing personal data. This article will delve into the six lawful bases for processing data stipulated by GDPR, and through real-world cases, help Chinese enterprises better understand and apply these principles to ensure their data processing activities are “lawful.”
The Six Lawful Bases for Processing Data under GDPR
According to Article 6(1) of the GDPR, the processing of personal data shall be lawful only if and to the extent that at least one of the following applies :
1. Consent
Definition: The data subject has given clear consent to the processing of his or her personal data for one or more specific purposes. Consent must be freely given, specific, informed, and unambiguous. This means that the data subject must signify agreement by a clear affirmative action, such as ticking a box or signing a statement. Silence, pre-ticked boxes, or inactivity do not constitute consent.
Case Study: A Chinese e-commerce platform operating in the EU requires users to tick a box stating “I agree to receive marketing emails” during registration. If the user actively ticks the box, the platform obtains a lawful basis for processing their personal data to send marketing emails. If the user does not tick the box, the platform cannot send marketing emails.
2. Contractual Necessity
Definition: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Case Study: A Chinese SaaS company provides cloud services to EU customers. To fulfill the service contract, the company needs to process customer employees’ names, email addresses, and other information to create accounts and provide technical support. This data processing is necessary for the performance of the contract and therefore has a lawful basis.
3. Legal Obligation
Definition: Processing is necessary for compliance with a legal obligation to which the controller is subject. This refers to obligations imposed by EU or Member State law, excluding contractual obligations.
Case Study: A Chinese FinTech company has a branch in the EU. According to local Anti-Money Laundering (AML) regulations, the company needs to collect and store customer identity information and transaction records. This data processing is necessary to comply with a legal obligation and is therefore lawful.
4. Vital Interests
Definition: Processing is necessary in order to protect the vital interests of the data subject or of another natural person. This typically refers to emergency situations involving life-threatening circumstances.
Case Study: A Chinese medical device manufacturer sells its products in the EU. When a device malfunction may endanger a patient’s life, the manufacturer needs to urgently process the patient’s personal health data to provide necessary medical support or recall the product. This processing is for the protection of the data subject’s vital interests.
5. Public Task
Definition: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, and the task or function has a clear basis in law.
Case Study: A Chinese research institution collaborates with a university in the EU on a public health research project that involves processing a large amount of anonymized or pseudonymized personal health data. If the research is deemed to be carried out in the public interest and has a clear legal basis, then the data processing is lawful.
6. Legitimate Interests
Definition: Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child. Public authorities cannot rely on this basis when performing their official tasks.
Case Study: A Chinese gaming company needs to collect and analyze player behavior data to prevent fraud and ensure fair gameplay. This is considered a legitimate interest of the company. However, the company must conduct a “Legitimate Interests Assessment” (LIA), balancing its interests against the rights and freedoms of the players, and ensuring appropriate safeguards are in place, such as data anonymization or pseudonymization.
How to Choose the Appropriate Lawful Basis
Choosing the appropriate lawful basis is crucial for GDPR compliance. When deciding on the legal basis for data processing, enterprises should follow these principles:
-
Special Category Data:
For special categories of personal data (e.g., health data, racial information), in addition to the six bases above, additional conditions stipulated in Article 9 of the GDPR must also be met. -
Purpose-driven: Clearly define the purpose of data processing and select the most suitable lawful basis accordingly. No single basis is “better” or “more important” than the others; the key is its alignment with the processing purpose.
-
Necessity Principle: Ensure that data processing is necessary to achieve the specific purpose. If the same purpose can be achieved through less intrusive means, the current processing method should not be chosen.
-
Transparency: Clearly inform data subjects about the lawful basis and purpose of data processing in the privacy policy.
-
No Arbitrary Switching: Once a lawful basis has been established, it should not be arbitrarily changed. In particular, switching from “consent” to another basis may be considered unfair.
Conclusion
The six lawful bases for processing data under GDPR provide a clear framework for enterprises processing personal data in the EU. For Chinese enterprises expanding into the EU, a deep understanding and correct application of these bases are not only requirements for legal compliance but also important ways to build data trust and maintain corporate reputation. Enterprises should carefully assess and document their lawful basis before commencing data processing activities, ensuring that every step of data processing is “lawful,” thereby achieving steady and long-term success in the European market.
聲明
本文僅為交流探討之目的，不代表廣悅律師事務所或其律師出具的任何形式之法律意見或建議。如需轉載或引用本文的任何內容，請與本所溝通授權事宜，並於轉載或引用時注明出處。如您有意就相關業務進一步交流或探討，或需要專業的法律支持，歡迎與本所聯系。
聯系人：葉文女士
期待與您的進一步交流！
廣悅律師事務所介紹
廣悅律師事務所成立於2008年，是一家立足大灣區，堅持一體化管理的涉外綜合性律師事務所。發展至今，廣悅建立了由上百位律師及其他法律服務人員組成的專業團隊，打造了多元化的業務體系，可以為客戶提供高品質、全方位、一站式的法律服務。秉承“立足灣區、協同港澳、面向世界”的發展戰略，廣悅已擁有廣州、中國香港、深圳，以及泰國曼穀、美國洛杉磯、澳大利亞悉尼、日本東京、意大利米蘭八個辦公室，客戶遍及境內外多個國家和地區。
供稿丨廣悅米蘭辦公室
編輯丨餘皚琳
審核丨歐陽進潼
審定丨品牌宣傳與市場拓展委
