News

The Internet age characterized by massive data has given people unprecedented enthusiasm and attention to all kinds of information. Among them, the processing and protection of citizens' personal information is particularly prominent. On the one hand, ordinary people have an unprecedented awareness of protecting their personal information. The state has also continuously strengthened the protection of citizens' personal information from the aspects of legislation, law enforcement, justice and so on. On the other hand, the characteristics of the Internet information age determine that the collection and use of citizens' personal information has penetrated into all aspects of social life. Especially during the current epidemic prevention and control period, the personal information of citizens, not only the basic information such as name, ID card number and mobile phone number, has been collected and used many times, but also the personal information such as travel trajectory, which is considered to have a certain privacy nature, has been processed many times. Although no one will refuse the collection and use of personal information by relevant institutions in order to restore normal production and life as soon as possible, as ordinary people, they may worry about whether my information will be leaked and flow into the black ash industry after being collected, which will bring other risks? This paper attempts to do some simple analysis and interpretation of the problems in the processing and protection of citizens' personal information under the situation of epidemic prevention and control.

one

Basic meaning of citizen's personal information

According to Article 1034 of the civil code of China, the personal information of natural persons is protected by law. Personal information is all kinds of information recorded electronically or in other ways that can identify a specific natural person alone or in combination with other information, including the natural person's name, date of birth, ID number, biometric information, address, telephone number, e-mail, health information, whereabouts information, etc. Article 4 of China's personal information protection law also clearly points out that personal information is all kinds of information related to identified or identifiable natural persons recorded electronically or in other ways, excluding information after anonymization. Although the wording of the concept of personal information in the civil code and the personal information protection law is slightly different, there is no difference in the basic meaning. It is not difficult for us to see that the citizen's personal information in the legal sense, or the citizen's personal information protected by the law, can be determined from the following three aspects: first, whether it is identifiable, the personal information protected by the law must be the information that can directly or indirectly distinguish a specific natural person. For example, a person's ID card number can directly confirm a person's specific identity. It is worth noting that although some information can not "lock" a specific natural person alone, it can "identify" a person when combined with other information. This information is also a personal information protected by Chinese law. Second, the personal information protected by law must have a certain carrier. Information not recorded on a certain carrier is not personal information in the legal sense. Third, the subject of personal information can only be natural persons, not legal persons or other organizations.

picture

(picture from the network)

To understand the legal concept of citizens' personal information, we need to pay attention to the differences and connections between citizens' personal information and personal privacy. The right to privacy and the protection of personal information are jointly stipulated in Chapter 6 of Part IV of the civil code. This provision itself shows the close relationship between privacy and personal information. According to Article 1032 of the civil code of China, privacy is a private space, private activities and private information that a natural person has a peaceful private life and does not want to be known by others. The right of privacy is the right of natural person to control and control his privacy independently and exclude the intrusion of others. The right of privacy is one of the personality rights enjoyed by natural persons. We note that the privacy of natural persons includes private information. Under normal circumstances, such private information also belongs to the personal information of natural persons.

So is the protection of private information of natural persons protected from the perspective of privacy, or belongs to the protection category of personal information of natural persons? In fact, China's "Civil Code" has made provisions on this. According to Article 1034 of the civil code, the provisions on privacy shall apply to the confidential information in personal information; In the absence of such provisions, the provisions on the protection of personal information shall apply. From the perspective of judicial practice, the people's Court pointed out in the case of Pang Lipeng v. China Eastern Airlines Co., Ltd. and Beijing Quna Information Technology Co., Ltd. (the first batch of typical Internet related cases released by the Supreme People's court) that the overall information of individuals has become private information as a whole because it contains privacy, and can seek relief through privacy disputes.

two

General principles of citizen personal information processing

According to Article 1035 of the civil code and Article 4 of the personal information protection law, the processing of personal information includes the collection, storage, use, processing, transmission, provision, disclosure, deletion, etc. In dealing with personal information, the principles of legality, justness and necessity shall be followed, and excessive treatment shall not be allowed, and the consent of the natural person or his guardian (unless otherwise provided by laws and administrative regulations) shall be obtained, the rules for publicly dealing with information, the purpose, method and scope of dealing with information shall be clearly stated, and the provisions of laws and administrative regulations and the agreements of both parties shall not be violated.

The basic principle of informed consent shall be followed in handling personal information. This principle means that before collecting and using personal information, any institution shall inform the subject of personal information of the purpose and purpose of collecting and using information, and obtain the consent of the natural person. It should be said that this principle is the cornerstone for the respect and protection of personal information, which must be strictly observed and implemented in general. However, according to Article 13 of China's personal information protection law, under certain specific circumstances, based on specific purposes and needs, the relevant institutions do not need to obtain personal consent for the collection and use of personal information. Such circumstances include: necessary for the conclusion and performance of contracts to which the individual is a party, or necessary for the implementation of human resources management in accordance with the labor rules and regulations formulated in accordance with the law and the collective contracts signed in accordance with the law; Necessary for the performance of statutory duties or obligations; Necessary for responding to public health emergencies or protecting the life, health and property safety of natural persons in an emergency; Carry out news reporting, public opinion supervision and other acts for the public interest, and handle personal information within a reasonable range; Handle the personal information disclosed by individuals or other legally disclosed personal information within a reasonable range according to law; Other circumstances stipulated by laws and administrative regulations.

picture

(picture from the network)

In the process of processing personal information, the information processor has the legal obligation to protect the security of personal information according to law. This legal obligation includes: not disclosing or tampering with the personal information it collects and stores; Without the consent of a natural person, it is not allowed to illegally provide his personal information to others, except for those who cannot identify a specific individual after processing and cannot be recovered. At the same time, the law also requires information processors to take technical measures and other necessary measures to ensure the security of their collected and stored personal information and prevent information leakage, tampering and loss; Where personal information is or may be leaked, tampered with or lost, remedial measures shall be taken in a timely manner, and the natural person shall be informed in accordance with the provisions and reported to the relevant competent authorities. It is worth noting that article 1039 of China's civil code also specifically stipulates the obligation of state organs and their staff to keep personal information safe and confidential. According to this article, state organs, statutory bodies with administrative functions and their staff members shall keep confidential the privacy and personal information of natural persons they know in the course of performing their duties, and shall not disclose or illegally provide it to others.

In the process of processing personal information, the most important thing that should not be ignored is the rights of the subject of personal information. According to Article 1037 of China's civil code, natural persons can consult or copy their personal information from information processors according to law; If any error is found in the information, it shall have the right to raise an objection and request to take necessary measures such as correction in time. If a natural person finds that the information processor has processed his personal information in violation of the provisions of laws, administrative regulations or the agreement of both parties, he shall have the right to request the information processor to delete it in time. Article 43 of the network security law of the people's Republic of China also clearly stipulates that if an individual finds that the network operator collects and uses his personal information in violation of the provisions of laws, administrative regulations or the agreement of both parties, he has the right to require the network operator to delete his personal information; If it is found that the personal information collected and stored by the network operator is incorrect, it shall have the right to require the network operator to correct it. The network operator shall take measures to delete or correct it.

From the perspective of legislation, Chinese laws not only stipulate the basic principles of personal information processing, but also stipulate the legal obligations of information processors and the legal rights of personal information subjects. It should be said that from the basic level, the legal framework for personal information protection has been basically established.

three

Problems related to the collection and use of personal information under epidemic situation

1. In order to prevent and control the epidemic, relevant state organs and their authorized institutions have the right to process the personal information of natural persons without personal consent.

As mentioned earlier, according to Article 13 of China's personal information protection law, in order to respond to public health emergencies, or when it is necessary to protect the life, health and property safety of natural persons in an emergency, relevant institutions have the right to directly process personal information without personal consent. On february4,2020, the office of the central network security and Information Technology Commission issued the notice on doing a good job in personal information protection and using big data to support joint prevention and control, which clearly pointed out that except for the institutions authorized by the health department of the State Council in accordance with the network security law of the people's Republic of China, the law of the people's Republic of China on the prevention and control of infectious diseases, and the emergency regulations for public health emergencies, No other unit or individual may collect or use personal information without the consent of the recipient on the grounds of epidemic prevention and control and disease prevention. Where laws and administrative regulations provide otherwise, such provisions shall prevail. Accordingly, during the current epidemic prevention and control period, the institutions authorized by the health department of the State Council according to law, and only limited to this part of the authorized institutions, have the right to collect and use the personal information of natural persons without personal consent.

2. Under the epidemic situation, the personal information of natural persons should also be protected according to law. Epidemic prevention and control does not resist the protection of personal information of natural persons.

In order to prevent and control the epidemic and meet the needs of the public interest, it is not difficult to understand that the relevant institutions have the right to collect and use personal information. The question is, can we weaken or deny the protection of personal information of natural persons on the grounds of epidemic prevention and control? Of course not. In fact, not only the civil code and the personal information protection law clearly stipulate the obligations of relevant institutions as information processors to ensure personal information security, but also specific normative documents stipulate this. The aforementioned notice on doing a good job in personal information protection and using big data to support joint prevention and control clearly points out that all local departments should attach great importance to personal information protection. The collection of personal information necessary for joint prevention and control shall refer to the national standard personal information security code, adhere to the principle of minimum scope, and the collection object shall be limited to the diagnosed, suspected, close contacts and other key groups. Generally, it is not targeted at all groups in a specific region to prevent the formation of de facto discrimination against people in a specific region.

Personal information collected for epidemic prevention and control and disease prevention shall not be used for other purposes. No unit or individual shall disclose personal information such as name, age, ID card number, telephone number, home address, etc. without the consent of the collector, except for those who have been desensitized due to the needs of joint prevention and control. Any organization or individual that finds any illegal collection, use or disclosure of personal information can report it to the wechat and public security departments in a timely manner. The network information department shall, in accordance with the network security law of the people's Republic of China and relevant regulations, promptly deal with the illegal collection, use and disclosure of personal information, as well as the events that cause a large number of personal information leaks; Public security organs involved in crimes should crack down severely according to law. Therefore, whether from the legal level or from the perspective of national epidemic prevention and control policies, even for epidemic prevention and control, the personal information of natural persons should still be protected according to law. Epidemic prevention and control cannot resist the protection of personal information of natural persons.

3. The collection and use of personal information during epidemic prevention and control does not conflict with the protection of personal information.

The collection and use of citizens' personal information in epidemic prevention and control and the protection of personal information are two different levels of issues. Both can be achieved in accordance with the law. The two are not either or. The wrong understanding of this problem in practice should be corrected. Some people believe that during the epidemic prevention and control period, there is a conflict between the public's right to know and the protection of personal information. However, as long as a little analysis is made, it will be found that this conflict is an illusion and does not exist in fact. For example, according to the provisions of China's law on the prevention and control of infectious diseases, citizens have the obligation to report their recent activities to the relevant departments after the diagnosis of their illness. After mastering the personal information of citizens, based on the public's right to know and the needs of epidemic prevention and control, the relevant departments will release the information related to epidemic prevention and control and that the public should know to the public after desensitizing the personal information according to law.

We must note that in this process, the relevant authorities do not disclose personal information without principle. The basic principle that must be adhered to is based on the needs of epidemic prevention and control and desensitization. At the same time, the scope of public knowledge should also be limited to the personal information related to epidemic prevention and control, and not all the personal information of natural persons should be known by the public. For example, the information such as the real name, telephone number and ID card number of the confirmed patient is neither the information that the relevant authorities should disclose based on the needs of epidemic prevention and control, nor the information that the public should know based on the needs of epidemic prevention and control. After correctly understanding the real connotation of the public's right to know and personal information protection, we find that there is no conflict between them. In practice, there is also a wrong view that during the epidemic prevention and control, the relevant institutions collect and use personal information without personal consent, which is actually a negation of the principle of informed consent that should be adhered to in the protection of personal information. In this regard, we believe that although the principle of informed consent is the basic principle in the personal information protection system, as mentioned above, the law not only stipulates this basic principle, but also stipulates exceptions under specific circumstances. This is the original law. How can we talk about the failure of this principle under the epidemic prevention and control?

4. During the epidemic prevention and control period, the key to protecting personal information is that relevant institutions handle personal information strictly according to law.

According to the above analysis, it is not difficult to see that the current laws and relevant national policies have made clear provisions on the basic framework of personal information protection of natural persons. Of course, these provisions need to be further improved. In practice, some deputies to the National People's Congress have proposed to speed up the revision of the emergency response law, the law on the prevention and control of infectious diseases and other relevant laws, establish a personal information protection system in the prevention and control of emergencies and epidemics, and clearly stipulate the principles of collecting and using personal information in the prevention and control of emergencies and epidemics, the protection methods of personal information, the protection limits of personal information and other contents. However, I personally believe that many laws and regulations need to be further refined and revised, but under the current situation, the focus of strengthening the protection of personal information is the implementation of existing laws and policies. Several cases of infringement of personal information occurred during the epidemic prevention and control period are the result of illegal operations by relevant personnel. Epidemic prevention and control does not resist the protection of personal information, which is the basic concept we must establish. During the epidemic prevention and control period, the relevant departments must collect, use and disclose personal information in strict accordance with the law, and any violation of personal information shall be investigated.