Analysis on the phenomenon of personal information protection law

For half a century, with the development of the information society, the legal protection of personal information has become increasingly prominent. Due to social concept, information industry, science and technology, legislative planning and other reasons, China has not realized the importance of protecting personal information for a long time, so until now, China has not formulated a special personal information protection law. Of course, this does not mean that China does not protect personal information. At present, the protection of personal information in China is mainly reflected in two aspects: First, personal information protection clauses are set in relevant laws and regulations to protect personal information legally. The legal protection of personal information can be expressed as direct protection and indirect protection of the law. The so-called direct legal protection means that laws and regulations explicitly protect "personal information"; Indirect protection means that laws and regulations extend the protection of personal information by proposing the protection of personal dignity, personal privacy and personal secrets. The second is to protect personal information by self-discipline through the unilateral commitment of information controllers or the commitment of self-discipline norms in specific industries. The self-discipline protection of personal information is also manifested in two aspects, that is, enterprises protect personal information through unilateral commitments, and specific industry organizations establish industry protection standards for personal information through industry self-discipline norms.

First of all, China's laws directly protect personal information.

Through the search engine of the national laws and regulations database on the website of the National People's Congress, it is found that the number of laws, regulations, rules and judicial interpretations that directly protect "personal information" in China is quite limited, among which only the Passport Law of the People's Republic of China, the Nationality Law of the People's Republic of China and the National Identity Card Law directly stipulate the protection of "personal information". Paragraph 3 of Article 12 of the Passport Law of the People's Republic of China (passed on April 29th, 2006, and implemented on June 65438+1 October1day, 2007) stipulates: "Passport issuing organs and their staff members shall keep confidential the personal information of citizens they know as a result of making and issuing passports." Article 20 stipulates: "Any staff member of the passport issuing authority who commits one of the following acts in the process of handling passports shall be given administrative sanctions according to law; If the case constitutes a crime, criminal responsibility shall be investigated according to law: …… (5) divulging personal information of citizens obtained by making and issuing passports, which infringes upon citizens' legitimate rights and interests … "Paragraph 3 of Article 6 of the Law of the People's Republic of China on Resident Identity Cards (passed on June 28, 2003 and implemented on June 30, 2004) stipulates:" Article 19 stipulates: "If the people's police commit one of the following acts, according to the seriousness of the case. If a crime is constituted, criminal responsibility shall be investigated according to law.

There are only the following issues directly mentioned in administrative regulations, departmental rules and judicial interpretations with normative effect nationwide: (1) National Informatization Development Strategy for 2006-2020. The fifth item of Article 6 of the development strategy puts forward the requirement of "promoting the construction of informatization legal system", and puts forward: "Accelerate the construction of informatization legal system, properly handle the relationship between the formulation, revision and abolition of relevant laws and regulations, and formulate and improve laws and regulations such as information infrastructure, e-commerce, e-government, information security, government information disclosure and personal information protection, so as to create a good legal environment for the development of informatization. According to the needs of information technology application, timely revise and improve laws and regulations on intellectual property rights, protection of minors, electronic evidence and so on. Strengthen international exchanges and cooperation in information-based legal system construction, and actively participate in the research and formulation of relevant international rules. ; (2) Regulations on the Administration of Internet Bulletin Board Services (adopted on October 8, 2000 10 and implemented on the same day). Article 12 of the Administrative Regulations stipulates: "Bulletin board service providers shall keep the personal information of Internet users confidential and shall not disclose it to others without the consent of Internet users, except as otherwise provided by law. (3) Emergency Notice of the Supreme People's Court and the Supreme People's Procuratorate on Effectively Ensuring Judicial Personnel to Perform Their Duties according to Law (Fa Fa Fa [2005] 173No.) (promulgated on August 25th, 2005, and implemented on the same day). Article 6 of the notice, "Strengthen the construction and confidentiality of the judicial police team and do a good job in publicity and education", puts forward: "... strengthen the confidentiality of cases, and it is strictly forbidden to disclose personal information such as case information, communication methods and addresses of case handlers in violation of regulations. Those who divulge secrets shall be given a heavier punishment in accordance with the relevant provisions of the Measures for Disciplinary Actions of the People's Courts and the Regulations on Disciplinary Actions of Prosecutors ... "In addition, in a few local laws and regulations, there are occasionally direct provisions concerning the protection of personal information. For example, Article 49 of the Regulations on the Protection of Minors in Beijing revised in 2003 stipulates: "... no organization or individual may collect, use or publish personal information of minors on the Internet without the consent of their guardians." On February 23, 2003, 65438, Shanghai passed the local regulations on personal credit information-the Trial Measures for the Management of Personal Credit Information in Shanghai, which made detailed provisions on the collection, processing and provision of personal credit information.

In particular, in 2005, the People's Bank of China adopted a special departmental regulation on the management and protection of personal credit information-Interim Measures for the Management of Basic Database of Personal Credit Information (adopted on June 16, 2005 and implemented on June 10, 2005). This method includes seven chapters, including general principles, submission and collation, inquiry, objection handling, safety management, punishment and supplementary provisions, and makes detailed provisions on the collection, processing, utilization and circulation of personal credit information. In content, this method largely follows the principles of collection restriction, information quality, specific use, use restriction, safety guarantee, publicity, individual participation and responsibility. Although there are still some defects and loopholes in the content of this method, such as the lack of the system of sealing up disputed information and the system of civil compensation for personal injury caused by false information, in any case, we can regard this method as a milestone in the legislative history of personal information protection in China, which has created a legislative precedent for personal information protection in special fields in China.

Second, the indirect protection of personal information by China laws.

In China, in addition to the above-mentioned laws and regulations that directly and explicitly protect personal information, there are also some laws that protect personal information by stipulating personal dignity, personal privacy, personal secrets and other categories related to personal information. In terms of fundamental law, the relevant provisions in China's Constitution (1982) such as "citizens' personal dignity is inviolable", "citizens' homes are inviolable", "citizens' right to freedom and privacy of correspondence" and "the state respects and guarantees human rights" can all be interpreted as the constitutional basis for personal information to be protected by law. In the basic department law of the country, there are also some legal provisions related to the protection of personal information more or less, explicitly or implicitly. For example, the General Principles of Civil Law (1986) provides that "the personal dignity of citizens is protected by law"; The Criminal Law (1997) clearly lists "illegally searching another person's body or residence, or illegally invading another person's residence" and "infringing citizens' freedom of communication" as criminal acts in the special chapter "Infringement of citizens' personal rights and democratic rights"; The Civil Procedure Law (199 1 year) stipulates that "cases involving personal privacy shall not be heard in public"; The Criminal Procedure Law stipulates that "cases involving personal privacy shall not be heard in public" and "criminal cases involving minors over the age of 14 but under the age of 16 shall not be heard in public. /kloc-cases of crimes committed by minors over 0/6 and under 0/8 are generally not heard in public. "

Regarding the indirect protection of personal information, in addition to the above-mentioned national fundamental law and basic department law, there are many department laws or administrative regulations, rules and judicial interpretations that are easily overlooked. On the special protection of women's and children's personal information: The Law on the Protection of Women's Rights and Interests (1992) stipulates that "women's personal dignity is protected by law"; The Law on the Protection of Minors (199 1) stipulates that "the personal dignity of minors shall be respected" and "no organization or individual shall disclose the personal privacy of minors"; The Law on Maternal and Infant Protection (1994) stipulates that "personnel engaged in maternal and infant health care should strictly abide by professional ethics and keep secrets for the parties concerned". In terms of personal medical information: The Law on Medical Practitioners (1999) stipulates that "doctors shall not disclose health information obtained during treatment"; "Regulations on the Management of Medical Records of Medical Institutions" (2002) requires that "no institution or individual may consult the patient's medical records without authorization, except medical personnel who carry out medical treatment activities for patients and medical service quality monitoring personnel"; The Regulations on Handling Medical Accidents (2002) further requires that "when medical institutions copy or copy medical records, patients should be present"; The Law on the Prevention and Control of Infectious Diseases (2004) prohibits "deliberately revealing personal privacy-related information and materials of patients with infectious diseases, pathogen carriers, suspected patients with infectious diseases and their close contacts"; The Opinions on the Management of HIV-infected Persons and AIDS Patients (1995) stipulates: "Personnel engaged in the diagnosis, treatment and management of HIV-infected persons and AIDS patients shall not disclose relevant information to irrelevant personnel. No unit or individual may publish or disseminate personal information such as the names and addresses of HIV-infected people and AIDS patients. " In terms of personal communication information: The Postal Law (1986) stipulates that "postal enterprises and postal staff shall not provide any organization or individual with information about users' use of postal services"; The decision of NPC Standing Committee on maintaining Internet security (2000) prohibits "illegally intercepting, tampering with or deleting other people's emails or other data"; Provisions on Technical Measures for Internet Security Protection (2005) stipulates: "Internet service providers and Internet users shall establish corresponding management systems. Without the consent of the user, the user registration information shall not be disclosed or leaked, unless otherwise stipulated by laws and regulations. "In terms of personal financial information, the Commercial Bank Law stipulates that" commercial banks should follow the principle of confidentiality for depositors "and" commercial banks have the right to refuse any unit or individual to inquire, freeze or deduct personal savings deposits, except as otherwise provided by law "; Real-name registration system Regulations on Personal Deposit Accounts stipulates that "unless otherwise stipulated by laws and regulations, financial institutions shall not provide personal deposit account information to any unit or individual". In the practice of lawyers: The Lawyers Law (200 1) stipulates that "lawyers should keep the privacy of clients they know in their practice"; The Code of Practice for Lawyers (2004) stipulates that "lawyers must keep their clients' personal privacy". In terms of archival information, the Archives Law stipulates: "All state organs, armed forces, political parties, social organizations, enterprises and institutions and citizens have the obligation to protect archives. "

Third, the self-discipline mechanism of information controller's personal information protection.

Due to the lack of special and unified legislation on the protection of personal information in China at this stage, some information controllers have unilaterally made a commitment to protect personal information or formulated an internal code of conduct for the protection of personal information in order to enhance the confidence of the opposite party and further promote the greater development of related industries through the collection, processing, utilization and transmission of personal information. This is a typical self-discipline measure taken by information controllers to protect personal information. The information controllers who take such self-discipline measures to protect personal information in China are mainly concentrated in the non-public sector, especially some large commercial websites, and of course, operators in other industries such as banks. The following are some typical self-discipline measures for information controllers in private sectors to protect personal information.

Well-known comprehensive website "Sina. Com "declared its" privacy protection "policy on its home page. This privacy protection policy typically reflects the self-discipline measures taken by the current website operators, so this paper briefly introduces it. In its privacy protection policy, Sina.com first stated: "Privacy is your important right. Providing us with your personal information is based on your trust in us. I believe that we will treat your personal information responsibly. We believe that the information you provide can only be used to help us provide you with better services. Therefore, we have formulated the Sina personal information confidentiality system to protect your personal information. " Sina's self-discipline measures for personal information protection generally include the following contents: 1. Types of personal information collected by this website. "Usually, you can visit our website anonymously and get information. Before we ask you to provide relevant information, we will explain the purpose of this information. Some of our websites need to be registered to join. In general, such registration only requires you to provide an email address and some basic information such as your job and position. Sometimes we ask you for more information. We do this in order to better understand your needs and provide you with effective services. The information collected on our website includes name, address and telephone number. You have the right to decide not to accept any information provided by us at any time. " Second, about the protection and use of personal sensitive information. "We will take appropriate measures to protect your privacy. Whenever you provide us with sensitive information, we will take reasonable steps to protect your sensitive information, and we will also take reasonable security measures to protect the stored personal information. Without your permission, we will not provide any of your personal information to unrelated third parties (including companies or individuals) unless it is mandatory by law or government. However, if you ask us to provide specific customer support services or deliver certain items to you, we need to provide your name and address to a third party (such as a transportation company). Our website will provide links to third-party websites. Since we can't control these websites, we suggest that you carefully read the personal information confidentiality system of these third-party websites. " Third, the privacy protection principle of this website. (1) Whenever Sina needs to identify you or contact you, it will explicitly request the required information, that is, personal data. Generally speaking, you will be asked about this information when you register on the website, ask for special services, or participate in a prize contest. If possible, Sina will use some methods to confirm the correctness and timeliness of your personal data. (2) Sina website and its necessary service partners use your personal data to operate websites and services, and will inform you of various new functions and services, as well as various products of Sina.com and its affiliated companies. Sina will also carefully select the products or services of other companies and send them to you, usually about the services of the website itself, but this is not necessary (only for secondary use). (3) If Sina wants to use personal data for secondary purposes, Sina will provide you with instructions on how to refuse this service. You can stop sending these letters according to the information sent to you by Sina. Or the instructions on the promotion letter. (4)Sina.com may disclose personal data according to legal requirements, or in good faith think it is necessary to do so: comply with legal announcements or follow legal procedures applicable to Sina.com; Protect the rights or property of Sina users; In case of emergency, in order to protect the personal or public safety of Sina and its users. (5) At any time, if you think that Sina has not complied with these principles, please inform us by email privacy @ staff Sina.com, and we will make every effort to immediately improve this problem within a reasonable and appropriate scope. "Fourth, the use of cookies." Sina website sometimes uses cookies to let us know which websites are popular, so that you can get better service when visiting our website. Cookies don't track personal information. Sina will also use cookies when you register our website program. In this case, we will save useful information so that our website can identify you when you visit our website again. Cookies on Sina website can only be read by Sina website. If your browser is set to reject cookies, you can still visit most of our websites. "Fifth, update personal information and privacy protection policy." If your address, position (title), telephone number or email address changes, you can inform Sina according to the contact information published on Sina website to help us keep your information accurate. You can also update your personal information by logging in to the Update Member Information column on Sina.com's user registration page. Sina welcomes your comments and questions about this security system. We will be committed to protecting your personal information and do our best to ensure the security of this information. Due to the rapid development of online technology, we will update our information security system at any time. "

In banking, some banks protect customers' personal information by formulating relevant internal regulations. 1999, China Industrial and Commercial Bank issued the Code of Conduct for Employees of China Industrial and Commercial Bank, which stipulated that employees of ICBC should "strictly keep customer secrets. Employees have the obligation to keep the information provided by customers confidential in order to safeguard the legitimate rights and interests of customers. Employees have no right to disclose customer information without authorization, except information that can be provided according to law or agreed by customers. Don't talk about customers with colleagues unless it is necessary for work. When communicating or transmitting business information by telephone or electronic means, attention should be paid to protecting the security of customer information. Answering questions about credit status should be responsible to both the consultant and the customer. The data provided by the other party shall not exceed the scope allowed by the bank. Irrelevant personnel shall not touch customer information at will, and shall not use customer information for personal purposes. To provide customer information to the public security bureau, procuratorate, court and other judicial organs, there must be complete procedures issued by the public security and judicial departments and strictly follow the prescribed procedures. It is strictly forbidden to disclose or provide customer information to relatives and friends. " In 2002, China Construction Bank issued the Measures for the Administration of Personal VIP Customer Service of China Construction Bank (Trial), which stipulated: "Banks at all levels must establish files for each VIP customer, and record the personal data and service information of the customer, without omission." "Banks at all levels must properly keep customer files. Except as required by law or allowed by customers, no unit or individual may disclose or disclose customer information such as personal assets and account transactions to the public."

Fourth, the industry self-discipline mechanism of personal information protection.

In China, the Internet industry, as an important part of the information industry, has paid close attention to the increasingly serious threat of personal information. In China, the industry that adopts self-discipline measures for the protection of personal information is mainly the Internet industry. In 2002, internet society of china promulgated the China Convention on Self-discipline of Internet Industry, advocating Internet industry practitioners to join the Convention, requiring members to "consciously safeguard the legitimate rights and interests of consumers and keep user information secret; Do not use the information provided by users to engage in any activities unrelated to the promises made to users, and do not use technology or other advantages to infringe upon the legitimate rights and interests of consumers or users. "At the same time, it is agreed that internet society of china will be responsible for organizing the implementation of the Convention, transmitting the laws, policies and industry self-discipline information on Internet industry management to the member units of the Convention, reflecting the wishes and requirements of the member units to the competent government departments in a timely manner, safeguarding the legitimate interests of the member units, organizing the implementation of Internet industry self-discipline and supervising the compliance of the member units with the Convention.

As an important means to implement the self-discipline mechanism of personal information protection industry, the industry self-discipline logo has also appeared in China. However, with the rapid development of the Internet industry in China, a series of discordant notes are hidden behind the rapid growth of the industry: the proliferation of spam, viruses, malware, online language violence, online pornography and other phenomena, which make netizens unable to enjoy the Internet life freely, and their basic rights and interests are seriously violated. On June 1 65438+1October1day, 2006, internet society of china, Illegal and Bad Information Reporting Center, Anti-Spam Information Center, Evening News Association and Qihoo Company officially announced that the first Internet public welfare brand "Clean Blue Ribbon" was officially launched. As a sign of putting an end to malicious acts on the Internet, the clear blue ribbon is used to publicize the message that "it is everyone's responsibility to purify the Internet space and fight against cyber crimes" and call for "saving vulnerable groups on the Internet and putting an end to malicious acts on the Internet". The blue ribbon symbolizes the ties that closely link relevant government agencies, Internet companies and netizens. * * * is a symbol of the country's concern and support for the healthy development of the Internet industry, a symbol of netizens' love for the Internet and their desire for pure Internet space, and a symbol of Internet companies' commitment to pay attention to netizens' feelings and abide by self-discipline.

Verb (abbreviation of verb) abstract

Based on the above discussion, we can judge that the current situation of personal information protection in China has the following characteristics:

First, in the legal protection of personal information: (1) As far as the scope of application of the law is concerned, the number of legal provisions protecting personal information is relatively limited and the scope of application is relatively narrow, and there is no special and unified personal information protection law applicable to all information controllers; (2) As far as the legal protection means of personal information are concerned, criminal punishment and administrative management are emphasized, while civil confirmation and civil liability are neglected, which leads to the infringement of personal information. Even if the infringer is finally punished by criminal punishment or administrative punishment, it is impossible to make any substantial compensation for the property and non-property losses of the information subject; (3) As far as the operability of the law is concerned, most clauses lack operability, and many clauses only stipulate the obligation to keep personal information confidential, but do not stipulate the consequences of violating this obligation; (4) As far as the systematization of law is concerned, there is a lack of systematic response between the existing provisions, which gives people a feeling of "disorganized" and "leaderless", which is not in line with the legal thinking of the continental law system inherited by China and is not conducive to the application of the law; (5) As far as the specific contents of legal provisions are concerned, most provisions usually only ignore the protection of personal information, and often fail to reveal the legislative reasons, basic principles, rights of information subjects, rules, implementation mechanisms and supervision mechanisms for the protection of personal information. (6) As far as the concept of protecting personal information is concerned, the direct protection of personal information by Chinese laws is the development trend in recent years. For a long time, due to the lack of correct understanding of the significance of personal information protection, only limited indirect protection measures have been taken for personal information.

Secondly, in the self-discipline protection of personal information: (1) Non-public departments, especially some commercial websites, have gradually realized the great value of personal information and its great significance to the information subject, and provided relatively detailed privacy protection policies in order to enhance consumers' use of Internet information. However, we should also see that the level of personal information protection of domestic commercial websites varies greatly, and most large commercial websites have relatively perfect personal information protection policies; However, some small websites are worried about the protection of personal information. Not only do they not disclose the corresponding personal information protection policies, but they even care about their business reputation. As long as it can bring benefits to website operators, they will improperly collect, use or even sell visitors' personal information. In addition, in the non-public sector, except for a few subjects such as commercial websites, most non-public sectors will not unilaterally provide personal information protection policies to each other. Corresponding to the above-mentioned self-discipline measures of personal information controllers in personal information protection, there are few self-discipline conventions for personal information protection in other non-public sectors except the Internet industry.

(2) As far as public * * * departments are concerned, due to the long-standing "official standard" mindset, the concern for personal information is basically due to its management needs, and more emphasis is placed on the obligation of individuals to provide information, while the rights enjoyed by individuals for their own information are basically ignored. For example, when browsing the websites of governments at all levels in China, we can hardly see the "privacy policies" of some large commercial websites. Even the website of the Central People's Government-"China Government Network" has not provided corresponding policies for the protection of personal online information, which is a great pity for the development of e-government in China. For this phenomenon, some scholars think, "This may be because our government website is still in the primary stage of development, and its main function is only to publicize government policies and procedures, and it only plays the role of bulletin board system. The government website is provided for network users to read information and materials, and will not collect personal information of network users. " But these scholars also believe that "it is an inevitable trend for government websites to develop into interactive platforms like most commercial websites." In order to better serve taxpayers, government websites will definitely develop in the direction of diversified functions in the future. In order to facilitate the operation of users and websites and provide more personalized services, the future government web pages may be developed to send different personalized web pages to different users to suit users' appetites. In this way, government websites can't stay on the level of electronic blackboard newspaper forever, and don't collect personal information of network users. In addition, different government departments use online government affairs, and there are a lot of information submitted by citizens through the Internet. If there is no personal information protection policy, they will be willing to infringe on personal information. "I quite agree with this statement.

It is precisely because of the current situation of personal information protection mechanism that personal information is frequently threatened in our social life. Faced with this situation, in addition to strengthening self-protection and advocating the construction of self-discipline mechanism for personal information protection, more and more people hope that China can formulate a special law in the field of personal information protection. In fact, from the background of building a society ruled by law, whether it is to strengthen the self-protection of information subjects, to advocate the construction of a self-discipline mechanism for personal information protection, or to formulate a personal information protection law, we should focus on observing and understanding personal information protection from the perspective of civil law. Although criminal law and administrative law can play an important and indispensable role in protecting personal information, they can also prevent violations of personal information to some extent. Criminal law, on the other hand, focuses on punishment and administrative management, and plays a limited role in confirming the rights of information subjects and providing comprehensive relief afterwards.

First of all, we can strengthen the power of information subjects to protect their personal information through the self-help system in civil law. In a society ruled by law, although self-help is not allowed in principle, when it is too late to take public relief measures and the rights are in real danger of being infringed, the law allows limited use of self-help, and the information subject can protect his personal information through self-defense or self-help within the scope permitted by law.

Secondly, as far as the self-discipline mechanism is concerned, if the information controller voluntarily and unilaterally makes a commitment to information protection, this behavior of the controller can be judged as a legal act with effective conditions in civil law. Once the conditions are met, that is, the information of the information subject is controlled by the promisor, the information controller's commitment behavior will take legal effect, and at this time, the information controller should undertake its promised information protection obligations; If an industry self-regulatory organization makes a commitment to the protection of personal information, it can be regarded as that all information controllers who join the self-regulatory organization make a commitment to information protection. In this way, it can also be explained and handled by the relevant theories of legal acts of effective conditions.

In addition, if we start from the theory of civil society, the social basis for the growth of civil law, trade organizations are an important part of modern civil society. It is a buffer zone between state power and civil rights, and the important role of trade organizations in protecting personal information cannot be underestimated. Finally, although the content of the Personal Information Protection Law is inseparable from the administrative protection and criminal protection of personal information, the most powerful and substantial protection for information subjects is to give them corresponding rights through the Personal Information Protection Law, so that information subjects can resist the improper interference of public power on their personal information through their own rights and balance the rights conflicts with other private rights subjects. At the same time, when other people's personal information is improperly infringed, imposing civil liability on the infringer through law can make the infringed information subject get comprehensive relief and compensation.