海南大学学报(社会科学版)

《个人信息保护法》第21条规定了个人信息的委托处理，通过三个条款规定委托合同双方的法定义务和约定义务，为个人信息处理者采取委托处理方式提供了法律依据。委托处理个人信息中隐含两层法律关系，一是委托合同双方的内部法律关系，二是基于个人信息处理行为而发生的与信息主体之间的外部关系，此二层法律关系是委托处理方式与其他个人信息处理方式区分的关键所在。在告知与同意层面，委托人作为个人信息处理者的告知义务不可豁免，但基于信息控制权的未予移转及信息收集阶段已征得信息主体同意的前提，个人信息处理者采取委托处理方式无需再次征得同意。在委托合同双方对信息主体的责任承担问题上，须针对委托合同双方实施的不同的侵权行为形态加以辨析，适用不同的侵权责任形态。

Article 21 of the Personal Information Protection Law stipulates the entrusted processing of personal information, and provides a legal basis for the entrusted processing of personal information by stipulating the legal and agreed obligations of both parties to the entrusted contract through three articles. The entrusted processing of personal information implies two levels of legal relationship, one is the internal legal relationship between the two parties to the entrusted contract and the other is the external relationship with the information subject based on the act of personal information processing, and these two levels of legal relationship are the key to distinguish the entrusted processing method from other personal information processing methods. At the level of notification and consent, the principal as the personal information processor is not exempted from the obligation of notification, but based on the premise that the control of information is not transferred and the consent of the information subject has been obtained at the stage of information collection, the personal information processor does not need to obtain consent again when adopting the entrusted processing method.On the issue of the responsibility of both parties to the entrustment contract for the information subject, different forms of tort behaviors committed by both parties to the entrustment contract shall be analyzed and different forms of tort liability shall be applied.