Article 20: Where two or more personal information handlers jointly decide on the purposes and methods of handling personal information, they shall agree on their respective rights and obligations. However, this agreement does not affect the individual's request to any of the personal information processors to exercise the rights provided for in this Law.
Where personal information handlers jointly handle personal information and infringe on rights and interests in personal information and cause harm, they shall bear joint and several liability in accordance with law.
【Purpose of the Article】
This article is about the obligations and responsibilities of multiple information processors to jointly determine the processing of personal information.
[Understanding of the article]
In practice, since the processing of personal information involves multiple links such as collection, use, and transmission, different links or the same link often involve multiple information processing subjects, and when it comes to jointly deciding to process personal information, it is often necessary to stipulate the rights and obligations between them in the form of an agreement. At the same time, this is directly related to the personal information rights and interests of natural persons between the subjects of personal information, and it is necessary to distinguish between the internal rights and obligations of the information processor and the external rights and obligations between the information processor and the natural person. Paragraph 1 provides that when multiple data processors jointly process personal information, they may contractually stipulate their internal rights and obligations, but this agreement shall not affect the natural person corresponding to the personal information being processed to claim corresponding rights against any of them. This is also in line with the basic jurisprudence that the internal agreement between the parties cannot be used against a third party.
Paragraph 2 of this article provides for situations where the joint processing of personal information by several information handlers constitutes joint infringement and shall bear joint and several liability in accordance with law. From the perspective of logical system, the circumstances provided for in this paragraph belong to the joint infringement situation provided for in Article 1168 of the Civil Code, and belong to the concretization of the rule of joint infringement liability in the field of personal information protection.
1. On the issue that the agreement between several information processors cannot be applied against the information subject
In this regard, the following points should be noted: First, if there is an agreement on the rights and obligations of information processing between several information processors, which is a contract adjusted by the contract section of the Civil Code, the relevant provisions of the contract section shall be applied, especially in connection with paragraph 1 of article 467 of the Civil Code, which stipulates that "for contracts not expressly provided for in this Law or other laws, the provisions of the General Principles of this Part shall apply, and the provisions of the most similar contract in this Part or other laws may be applied by reference." "Second, the rights that a natural person can claim against the information processor include all the rights and interests in personal information provided for in the Personal Information Protection Law and other laws, and this claim is not restricted by the agreement between the information processors, and from the meaning of this provision, whether the natural person is aware of the agreement between the information processors or not, it does not affect the exercise of its rights, unless it constitutes an abuse of rights. In this regard, Article 132 of the Civil Code stipulates that "civil entities shall not abuse civil rights to harm the interests of the state, the public interest or the legitimate rights and interests of others." "Of course, if the natural person agrees to claim the corresponding rights against only one of them, based on the principle of autonomy of will, it should also be allowed provided that it does not violate the mandatory provisions of the law. Third, the application of the provisions of this article not only includes the circumstances in which natural persons claim rights against information processors, but also includes that every information processor must be bound by the information processing rules provided for in this Law. Of course, if one of the information processors has fulfilled the corresponding obligations or the processing of personal information in accordance with the requirements of this Law has been able to protect the rights and interests of natural persons' personal information, there is no need to require the other information processors to continue to repeat the corresponding acts.
2. Application of the legal rules on joint infringement
Paragraph 2 of this article is a concretization of the application of joint infringement in the field of personal information protection, and the rules on joint infringement have the effect of general application to the joint commission of acts by several personal information processors that infringe on the rights and interests of natural persons' personal information. The key to the application of this paragraph lies in the determination of "joint". According to Article 1168 of the Civil Code, the following elements must be met to constitute a joint tortfeasor:
The first is the plurality of infringing entities. The subject of a joint tortfeasor must be two or more subjects. The subject of the act may be either a natural person or a legal person. This is an essential feature of a joint tortfeasor.
The second is to jointly commit infringements. The word "jointly" in this element mainly includes three meanings: first, joint intentional acts. Where the lawful rights and interests of others are infringed on the basis of joint intent and intent to be jointly infringed, it is a typical joint tortfeasor. Second, acts committed by contributory negligence. Contributory negligence refers to the joint engagement of several actors in a certain act, based on common negligence or overconfident negligence, causing damage to others. Third, the act of combining several tortious acts causes damage to others. In other words, although there is no intentional communication between several actors, their acts are combined to cause the same harmful result, forming an objective joint association, which also constitutes a joint tort. [3] This is the insight we have obtained based on the above analysis, and how to better connect with the share of liability provided for in Article 178 of the Civil Code, it is also necessary to continuously accumulate practical experience in adjudication practice in combination with the above analysis, and promote the formation of guiding cases and even judicial interpretations, so as to play a greater role in safeguarding fairness and justice and promoting the uniform application of law.
Third, there is a causal relationship between the infringement and the consequences of the damage. In joint tortfeasors, sometimes the proportion of the damage caused by each tortious act is different, but there must be a legal causal relationship.
Fourth, the victim's damage must be indivisible. This is a basic element for the victim to request the joint tortfeasor to bear joint and several liability. If there is no damage, there is no remedy; If there is no joint result of damage, there is no basis for joint tort liability.