中华人民共和国个人信息保护法 第十三条

符合下列情形之一的，个人信息处理者方可处理个人信息：

（一）取得个人的同意；　　

（二）为订立、履行个人作为一方当事人的合同所必需，或者按照依法制定的劳动规章制度和依法签订的集体合同实施人力资源管理所必需；　　

（三）为履行法定职责或者法定义务所必需。

Personal Information Protection Law of the People's Republic of China, Article 13

Personal information processors may not process personalinformation unless:

(1) the individual’s consent has been obtained;

(2) the processing is necessary for the conclusion or performanceof a contract to which the individual is a party or for conducting humanresource management in accordance with the labor rules and regulationsdeveloped accordance to the law and the collective contract signed according tothe law;

(3) the processing isnecessary to fulfill statutory functions and statutory obligations.