“去识别化”个人信息的刑法保护

Criminal Law Protection of “De-Identified” Personal Data

摘要: 司法解释将“去识别化”个人信息排除在刑法保护范围之外，但是个人信息彻底去识别化且达到无法复原的程度几乎不可能，只会导致大量形式上匿名化或者形式上已经去识别化的个人信息暴露于风险之中。“去识别化”个人信息的公共属性来源于其自身固有的流通利益，侵犯公民个人信息罪应坚守个人信息自决权的法益立场，因此“去识别化”个人信息的刑法保护具有正当性。“去识别化”个人信息有三方面刑法保护路径：修正对“识别”的理解以扩张本罪的保护对象；修正知情同意对个人信息再识别的效力规制；将“再识别”行为解释为“以其他方式非法获取”行为。

Abstract: The judicial interpretation excludes “de-identified” personal information from the scope of criminal law protection, but it is almost impossible to completely de-identify personal information to the extent that it cannot be recovered, which will only lead to a large number of formally anonymous or for-mally de-identified personal information being exposed to risks. The public attribute of “de-identified” personal information is derived from its inherent circulation interest, and the crime of infringement of citizens’ personal information should adhere to the legal benefit position of the right to self-determination of personal information, so the criminal law protection of “de-identified” personal information is justified. The criminal law protection of “de-identified” personal information has a three-pronged approach: amending the understanding of “identification” to expand the object of protection of this crime; amending the effect of informed consent to regulate the re-identification of personal information; and interpreting the act of “re-identification”.