Research On The Application Of "Contract Necessity" Rule In Data Processing

Today’s society has already entered the digital era,and the network has become an indispensable part of people.We can learn,shop,play and so on from the network,but correspondingly,we will leave our data traces on the network,which is also the greatest value in the big data era.As a kind of resource,data can accelerate the development of data economy if it can be used reasonably.It can make great contributions to personal consumption,commerce,security and other aspects.However,the existence of data has two sides.It brings us benefits as well as risks.When data involves personal rights and user privacy,it will cause great damage to the data subject if the data cannot be safely managed and leaked or used at will.Therefore,how to use data rationally is the most important problem that we should solve at present.Choosing the right legal basis in data processing can greatly help us avoid the negative effects brought by using data.The principle of consent was the basis of legitimacy that was widely applied before.However,the shortcomings and limitations of the consent principle are also obvious.After the data parties sign the agreement,new data processing needs will arise due to the situation,and everything will be subject to the consent of the data subject,which is cumbersome and not conducive to the realization of the purpose of data processing.Moreover,the principle of consent cannot well safeguard the rights and interests of data subjects in data processing activities.In many cases,data subjects may be forced to agree.This situation may lead to some data infringement."Contract Necessity" has not been mentioned too much before as the legal basis for data processing,but it is a common way to use contracts to regulate data parties in data processing.Therefore,the EU issued a draft of "Guidance No.2/2019 on Handling Personal Data According to Article 6(1)(b)of GDPR when Providing Online Services to Data Subject" in 2019.This article also uses the ideas proposed in this draft to do some research on the application of "Contract Necessity" and explore its applicable scope and standards in data processing.The first part of this article mainly explains the "necessity" in the "necessity of the contract" in a limited way,and points out that not all the data processing behaviors written into the contract can be necessary for the performance of the contract,even if the data processing behavior explicitly written into the contract is a necessary data processing behavior in the contract,it must be judged from an objective point of view.Then it explains the role of contract "necessity" in reconciling the protection of data rights and the value of data utilization.Contract "necessity" opens a window for data processing.In a contract,as long as the data processing behavior satisfying "necessity" is allowed,contract "necessity" is different from other legal bases,such as the principle of consent is absolute,and no subsequent operation can be carried out without consent click.The second part of this article mentioned the position of "necessity" of contract in data processing.As one of the legal bases for data processing,the contract "necessity" can alleviate the long-standing contradiction between the data parties,make up for the limitation of data rights protection,and allow both parties to reach a win-win situation.At the same time,it is also mentioned that "contract necessity" can protect the rights of data subjects,thus establishing its status as the legal basis for data processing.The third part of this article mainly analyzes the scope of application of the "necessity" of the contract.Mainly from the two aspects of the data processing behavior in order to fulfill the contract and the data processing behavior in order to conclude a new contract,it points out that the applicable scope conforming to the "necessity of the contract" is based on the data processing for the contract.At the same time,whether the data processing for the purpose of meeting the contract or for signing a new contract must be based on meeting the "necessity".The fourth part of this article mainly studies the judgment standard of "necessity" of the contract.Judging the "necessity" needs to consider the reasonable expectations of both sides of the data based on objective factors.For example,the signing of the privacy policy needs to be based on the conditions provided by the data processor.The reasonable expectations need to be determined by both sides and must be legal and enforceable.The data subject needs to exclude damages caused by public interests when suffering infringement and needs compensation.The contract in data processing may be considered more strictly on the necessary elements of the contract.The fifth part of this article discusses the obligations of data processors in applying the "necessity of contract".The data processor has the obligation to prove whether the data processing behavior has "necessity".First,the "contract necessity" is incorporated into the design of the product or service as the legal basis for data processing.Then,the data processor can agree to legally process the data based on "contract necessity" through the clause design in the privacy policy or another agreement.In the data management,the data map is used for data compliance management and trace management so as to prove that the data processing behavior conforms to the "contract necessity" standard during the data compliance audit.Obligations and responsibilities coexist.If the data processor cannot prove that it has such legal basis,the data processing is illegal and constitutes infringement.Failure to fulfill the obligation of proof itself is not conducive to the passing of compliance audit and may face administrative sanctions.