Social phenomenon of personal information protection law

Illegal trading of personal information has become a new industry.

China Academy of Social Sciences published the Blue Book of Rule of Law on March 2, 2009. The Blue Book points out that with the continuous development of information processing and storage technology, the problem of personal information abuse in China is becoming more and more serious, and the social demand for personal information protection legislation is becoming more and more urgent.

From September 2007 to June 5438+February 2008, the Institute of Law of Chinese Academy of Social Sciences specially formed a research group on the status quo of personal information protection, and conducted research in Beijing, Chengdu, Qingdao, Xi 'an and other places. The results made the members of the research group quite "shocked". They roughly divided the abuse of personal information in China into the following categories:

The first is excessive collection of personal information. Relevant institutions collect a large amount of unnecessary or completely irrelevant personal information beyond their business needs. For example, some merchants require customers to provide information such as ID number, work unit, education level, marital status and children's status. Some banks require customers who apply for credit cards to provide personal client information, spouse information and even contact information.

The second is to disclose personal information without authorization. Relevant institutions disclose other people's personal information without legal authorization, personal permission or beyond the necessary limit. For example, some places publicize the names, home addresses, work units and illegal acts of pedestrians and non-motor vehicle traffic offenders; Some banks disclose the debtor's name, certificate number, mailing address and other information through websites and related media; Some schools publicize the reasons for teachers and students' absence from classes on the campus network, or publish the details of poor students without authorization.

The third is to provide personal information without authorization. Relevant institutions provide their personal information to other institutions without legal authorization or consent. For example, banks, insurance companies, airlines and other institutions enjoy customer information without customer authorization or beyond the scope of authorization.

Even worse is the illegal sale of personal information. The survey found that a large number of phenomena such as peddling owner information, shareholder information, business personnel information, owner information, telecom user information and patient information appeared in society, and a new industry was formed. For example, after an individual goes through the formalities of buying a house, buying a car, being hospitalized, etc. Relevant information is sold by relevant institutions or their staff to housing agencies, insurance companies, maternal and child products enterprises, advertising companies, etc.

The survey found that although most people think that they have the right to know the existence of personal information and can claim compensation if the abuse causes losses, many people think that they have no right to refuse to provide information.

42.5% of the respondents told the research group that they had encountered improper handling of their personal information by relevant institutions. However, the research group believes that this data only reflects the situation that the public obviously feels that their personal information has been abused to a certain extent, and cannot reflect the situation of those who have abused their personal information without knowing it.

Respondents generally feel that there are many problems in the process of handling personal information by relevant institutions. For example, the purpose of personal information is not clearly informed; A lot of information has nothing to do with the business to be handled; Relevant institutions use personal information beyond the original purpose; The personal information storage mechanism of relevant institutions is not perfect, and there is the possibility that information may be leaked or tampered with. This situation also exists in quite a few government agencies.

During the investigation, many interviewees expressed the hope that relevant institutions would delete some or all of their information. Because they either stop accepting their services or are often harassed by phone calls and emails. "The abuse of personal information is threatening my peace of life, and my life and property are safe, which makes me feel stressed or unhappy." One interviewee said.

It should be noted that only about 4% of the respondents whose personal information is abused have filed a complaint or filed a lawsuit. The factors that cause the public to encounter difficulties or are unwilling to complain or file a lawsuit include: uncertainty about which institutions should bear the responsibility, uncertainty about which institutions to complain to or whom to file a lawsuit, inability to obtain strong evidence, and high cost of complaint or lawsuit.

Even if remedies such as complaints or lawsuits were taken, only 8. 1% of the people got relief or achieved their goals. Others either fail because of the prevarication and prevarication of the institutions that handle personal information, or give up halfway because they are not expected to get relief through complaints or lawsuits.

The research group believes that this result is closely related to the defects in the current personal information protection regulations. Due to the lack of special provisions on the protection of personal information, there are doubts about what principles should be followed in personal information processing activities, what rights information subjects enjoy in personal information processing activities, how to punish information processors who abuse personal information, and which institutions are responsible for law enforcement.

In addition, the current regulations are generally limited to prohibiting the disclosure of personal information. However, the rights of personal information subjects in information collection, storage and utilization, such as the right to know, the right to consent, the right to request the correction of wrong information, the right to delete unnecessary information and even the right to obtain relief, have hardly been recognized.

In the survey, almost all respondents are in favor of strengthening the legislative work of personal information protection (99.3%), and hope that government agencies can strengthen the law enforcement of personal information protection, severely crack down on the abuse of personal information (99.3%), and set up special institutions to investigate and deal with the abuse of personal information (93.8%).

On February 25, 2009, a provision was added to the draft amendment (VII) of the Criminal Law submitted to the Third Trial of the Seventh Session of the 11th the National People's Congress Standing Committee (NPCSC), stating that units selling or illegally providing citizens' personal information obtained in the course of performing their duties or providing services to others will be punished if the circumstances are serious.

The second draft of the draft stipulates that the staff of state organs or financial, telecommunications, transportation, education, medical and other units sell or illegally provide personal information of citizens obtained by their own units in the course of performing their duties or providing services to others. If the circumstances are serious, he shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention and shall also be fined.

During the deliberation, some members of the Standing Committee and departments suggested that the above-mentioned behavior of the unit is also serious, and the provisions on unit crime should be added. Therefore, the draft adds a provision that if a unit commits the above-mentioned criminal acts, it shall be fined, and the directly responsible person in charge and other directly responsible personnel shall be punished in accordance with the provisions of this paragraph.

Expose the source of spam.

Operator: The account manager is very cautious when sending advertising information. The attitude of Jinan Mobile Company is somewhat secretive, but in other mobile companies in Shandong Province, as long as it comes to sending commercial advertising messages, the staff are very straightforward.

Keywords: community short message: In order to improve the speed of sending short messages, some mobile companies have also adopted a way-community short message. Cell short message is to send short messages to mobile users in the coverage area of the base station with the base station as the sending center.

Blacklist: In addition to limiting the sending area, they also made some special treatments for some special users. It may involve some senior leaders who are generally forbidden to send, and the blacklist will be directly filtered out.

Publish illegal information: this is a content that foreign companies issue VAT invoices on their behalf. In the business hall of Texas Mobile Company, Mr. Ma is enthusiastically bridging the information transmission.

Takeaway information: Not only mobile companies are sending spam messages, but also some advertising companies that cooperate with them can send spam messages.

Telecommunications and other units will be punished for illegally selling citizens' personal information.

According to reports, since 2003, the State Council has entrusted relevant experts to start drafting the Personal Information Protection Law. In 2005, the draft of experts' suggestions was completed and submitted to the State Council for deliberation, and the legislative procedure of personal information protection was initiated. Every year at the "two sessions" of the country, there are people's congress deputies shouting loudly. To some extent, this reflects that the personal information of China citizens has been leaked and abused to a considerable extent, and has even become a public hazard. It is urgent to speed up the pace of legislation and formulate a personal information protection law.

Prior to this, there was no special provision on personal information in Chinese law. In the past, article 10 1 stipulated that "citizens and legal persons enjoy the right of reputation, and citizens' personal dignity is protected by law. It is forbidden to damage the reputation of citizens and legal persons by insulting or defaming. " Such general and vague regulations have become too principled and lack of operability. As for the "right to privacy" confirmed in the Supreme People's Court's Opinions on Several Issues Concerning the Implementation of General Principles of Civil Law (Revised Draft), only when personal information is really infringed and actually damaged can we claim tort liability compensation. This protection is neither timely nor effective enough.

On August 25th, 2008, the first draft of the Seventh Amendment to the Criminal Law (hereinafter referred to as the draft) specially added provisions, clearly pointing out that the staff of state organs or financial, telecommunications, transportation, education, medical and other units, in violation of state regulations, sell or provide citizens' personal information obtained in performing official duties or providing services to others, or illegally obtain the above information by means of stealing or buying, and if the circumstances are serious, criminal responsibility shall be investigated according to law.

The purpose of collecting and storing personal information by government agencies and public service units is to improve the quality and efficiency of administrative management and public services, but on the other hand, it also makes it possible to disclose personal information. More than 50 countries or regions in the world have enacted personal information protection laws, and it is a common practice to protect personal information by restricting public power. In this context, the draft has a strong reality and pertinence to investigate criminal responsibility for violations of citizens' personal information. The role of criminal law is also limited to preventing, stopping and punishing criminal acts. However, the provisions of the existing criminal law focus on regulating public power, and the criminal law is dignified, and there is nothing to be done for acts that have not yet violated the criminal law. The combination of criminal law and personal information law and even the formation of information protection laws and regulations system is the fundamental to change the disorderly environment of information protection.

Regarding the protection of network privacy, China is basically in a state of no legal basis. The internet's invasion of privacy mainly focuses on the collection, processing, transmission and utilization of personal information. To sum up, the infringement of network privacy is mainly manifested in: illegally obtaining, transmitting and using users' personal data, illegally infringing users' private space, interfering with private activities, and undermining the peace and order of users' personal network life.

Only the Regulations on the Administration of Internet Bulletin Board Services issued by the Ministry of Information Industry on June 7, 2000 mentioned that "bulletin board service providers should keep the personal information of Internet users confidential and shall not disclose it to others without the consent of Internet users". In violation of these provisions, the telecommunications regulatory agency shall order it to make corrections, and if it causes damage or loss to Internet users, it shall bear legal responsibility according to law.

1.3 million postgraduate entrance examination information was called.

1.3 million graduate information 15000 for sale.

20 14 12 Postgraduate Entrance Examination List Data Packet 1 * * has130,000 pieces of information, all of which are students who registered for postgraduate entrance examination that year, covering the whole country. Pack and sell 15000 yuan. In order to prove the authenticity of the data in the database, the "seller" of graduate information posted some screenshots of graduate information. As can be seen from the screenshot, in addition to the candidate's name and gender, the information you can buy also includes sensitive information such as mobile phone number, landline number, ID number, home address, zip code, school and application major, which is very detailed. As for where this information comes from, the seller is not willing to say more.

Facing the current environment, enterprises should increase the investment in network information security in information systems and establish a special security team; If there is a lack of relevant professionals to maintain it, we should outsource the network security maintenance to a professional security company.