个人信息保护中“合同所必需”例外限缩适用

The Restrictive Application of the “Necessary for Contract” Exception in Personal Information Protection

摘要: 针对个人信息处理者滥用合同所必需例外强制收集用户画像信息的现象，探索限缩适用的制度路径。以指导性案例265号为样本，结合《个人信息保护法》第13条、第16条及必要个人信息清单规范，分析裁判逻辑与制度缺口。指导性案例确立了基本功能基准和拒绝选项规则，但类型化判断标准缺失，程序保障机制不足，证明责任分配不明，监管衔接不紧密。在理论层面，语境完整性、隐私悖论与同意疲劳理论揭示了滥用成因与规则失灵机理。应建立以基本功能清单为核心的类型化判断规则，强制设置拒绝选项并推广分层同意，在司法审查中引入比例原则，由处理者承担必要性证明责任，形成限缩适用的闭环路径。

Abstract: This article explores institutional paths to limit the abuse of the “necessary for contract” exception in personal information protection, particularly the compulsory collection of user profiling data. Taking Guiding Case No. 265 as a sample, the article analyzes the court’s reasoning and identifies institutional gaps by interpreting Articles 13 and 16 of the Personal Information Protection Law and the rules on necessary personal information. The guiding case establishes the basic function benchmark and the refusal option rule, but the typification judgment criteria are lacking, the procedural guarantee mechanism is insufficient, the allocation of proof responsibility is unclear, and the regulatory connection is not tight. At the theoretical level, the theories of contextual integrity, privacy paradox, and consent fatigue reveal the causes of abuse and the mechanisms of rule failure. A closed-loop restrictive path should be built, including a type-based judgment rule anchored in basic function lists, mandatory refusal options, layered consent mechanisms, proportionality review in judicial proceedings, and shifting the burden of proving necessity to data processors.