已公开个人信息刑法规制：体系构建与规制边界

Criminal Laws and Regulations on Disclosed Personal Information: System Construction and Regulatory Boundaries

摘要: 侵犯公民个人信息罪保护的法益不仅是信息自决权，还涉及复合权利，定位为具体人格权。该罪构造需要保护公民信息自决权的双向权能，既防止个人信息随意进入流通领域，又允许信息按个人意愿进一步流转。已公开个人信息指合法公开且供不特定第三方访问的信息，可基于个人法益处分或相关公共利益，且面向全社会的不特定多数人。刑法规制侵犯公民个人信息罪的关键在于是否存在“法益处分行为”。已公开的个人信息在“自愿公开”情形下的法益处分范围不具特定性，且行为人对信息处理后果认识不明确，导致该类型下的处罚容易过于宽泛，需要进一步限制适用范围。对已公开个人信息刑法规制的探索可视为我国数据犯罪方法论转向的重要尝试。在这一探索中，我们应尽可能转变思路，承认信息处理者的合法性，仅在信息处理者提供信息用于犯罪或其他违法行为并造成严重后果时，方可规制其行为。

Abstract: The offence of infringement of citizens’ personal information protects the legal interest not only in the right to information self-determination, but also involves a complex of rights, positioned as specific personality rights. The construction of the offence requires the protection of the two-way power of citizens’ right to informational self-determination, which prevents personal information from being put into circulation at will and allows it to be further circulated according to the will of the individual. Publicly available personal information refers to information that is legally available and accessible to unspecified third parties, either on the basis of individual legal division or in the relevant public interest, and is intended for an unspecified majority of society as a whole. The key to criminalising the offence of infringement of citizens’ personal information is the existence of an “act of legal benefit”. The lack of specificity in the scope of legal benefit distribution of disclosed personal information in the case of “voluntary disclosure” and the lack of clarity in the perpetrator’s understanding of the consequences of the information’s handling make it easy for penalties of this type to be overly broad, and further limitations on the scope of application are needed. The exploration of the criminal law system for disclosed personal information can be regarded as an important attempt to turn to the methodology of data crime in China. In this exploration, we should, as far as possible, change our thinking to acknowledge the legitimacy of the information processor and regulate the behaviour of the information processor only when the information is provided for use in a crime or other illegal act with serious consequences.