企业破产中用户个人信息处置问题日益受到关注。然而个人信息的人身属性使得破产企业陷入平衡个人信息主体利益与债权人利益的两难。目前，在破产个人信息处理方面，我国存在两个问题：第一，我国法律并没有明确用户的个人信息能否纳入破产财产的范围进行交易；第二，现有的破产企业个人信息处置规则不清晰，且对个人信息主体利益的保护不足。对于第一个问题，本文基于个人信息的性质，结合理论学说以及我国的法律法规进行分析，认为个人信息属于破产财产范围。对于第二个问题，本文通过比较研究，吸收借鉴欧盟法和美国法中有关用户同意模式类型和合理利益规则的法律、司法判例和学说，并分析我国《个人信息保护法》的具体规则，基于对个人信息主体利益与债权人利益的权衡，对我国破产企业个人信息处置规则提出如下几点主要建议： 

第一，企业破产转让用户的个人信息应以取得用户明确同意为原则；其中，同意的形式包括获得用户同意授权的隐私政策。敏感个人信息的转让必须以取得用户同意为前提，否则可能造成隐私泄露。第二，用户同意收购方继承合同的行为，应被视为同意收购方获得合同履行所必需的用户个人信息。第三，当存在收购方与破产企业是同一行业、个人信息作为资产的一部分售卖、收购方不对原隐私政策作实质性修改等情况时，应当认定企业的债权人对个人信息的价值具有合理利益；此时破产企业应当采用选择退出模式——获得用户的默示同意后，方可转让个人信息。当然，合理利益的认定还可以结合其他条件进行综合判断，比如，破产管理人是否对收购方个人信息保护能力进行了考察。第四，若企业隐私政策明确规定企业将不会转让个人信息，则企业在破产中转让个人信息的行为应当取得用户的重新同意，即使企业债权人存在其他合理利益，这种重新同意也是必要的。

The disposal of personal information of users in enterprise bankruptcy has attracted more and more attention. However, the nature of personal information makes bankrupt enterprises fall into a dilemma of balancing the interests of  personal information subjects and creditors. At present, there are two problems in the processing of personal information in bankruptcy: First, the law does not specify whether the personal information of users can be included in the scope of bankruptcy property for transactions; Second, the existing personal information disposal rules of bankrupt enterprises are not clear, and the protection for the interests of the subject of personal information is insufficient. For the first question, based on the nature of personal information, combined with the theory and the laws and regulations of our country, this thesis holds that personal information can be regarded as bankruptcy property. For the second question, by learning the laws, judicial precedents and theories of user consent mode types and legitimate interest in European Union and American, and by analyzing the specific rules of China's Personal Information Protection Act, based on the balance between the interests of the subject of personal information and the interests of creditors, this thesis puts forward following main suggestions on the disposal of personal information of bankrupt enterprises in China：

Firstly, the transfer of the user's personal information in bankruptcy should be subject to the principle of obtaining the user's explicit consent; The form of consent includes the privacy policy authorized by the user's consent. The transfer of sensitive personal information must be subject to the consent of the user, otherwise it may cause privacy disclosure. Secondly, the user's consent to the acquirer's succession to the contract shall be deemed as consent to the acquirer's access to the user's personal information necessary for the performance of the Contract. Thirdly, when the acquirer and the bankrupt enterprise are in the same industry, personal information is sold as part of the assets, and the acquirer does not make material changes to the original privacy policy, the creditors of the enterprise shall be recognized as having legitimate interests in the value of personal information; In this case, the bankrupt enterprise should adopt the opt-out mode -- obtaining the user's tacit consent before transferring personal information. The determination of legitimate interest can also be combined with other conditions to make a comprehensive judgment, such as whether the bankruptcy administrator has investigated the acquirer's personal information protection ability. Fourthly, if the enterprise's privacy policy clearly stipulates that the enterprise will not transfer personal information, the enterprise's transfer of personal information in bankruptcy should obtain the user's re-consent; Even if the enterprise's creditors have other legitimate interests, such re-consent is necessary.