信息控制权法理与我国个人信息保护立法

Legislation of Information Control Right and Personal Information Protection in China

民法典没有明确规定自然人的个人信息控制权是遗留课题,有待后续地方立法和国家立法进一步完善。深圳经济特区数据条例规定了自然人、法人和非法人组织、国家的数据权,未做实质区分。我国个人信息保护法草案二次审议稿规定了个人信息决定权等若干权利。信息的人格属性集中体现在其可识别特定自然人的性质,属于区别不同自然人人格权的客体种类。个人信息控制权是人格权,源自个人信息为自然人生命、身体、健康的表征或符号,对这些信息的控制实际是对生命、身体、健康权利的行使,是在维护自然人的尊严。我国正在进行的个人信息保护等立法,应坚持两元论,即个人信息保护法贯彻的是信息控制权法理,以信息处理为中心,隐私保护规则贯彻隐私权法理,以禁止侵犯隐私行为为中心。建议个人信息保护法将个人信息决定权修改为控制权、明确区分消费者保护与信息保护、删除处理者证明无过错不承担责任规定,增加规定公权力机关依法收集个人信息的具体情况、公共场所、利用技术手段监视的适用情况和条件、对人脸识别做出严格的限制。

The Civil Code does not clearly stipulate that the control right of personal information of natural persons is a legacy subject,which needs to be further improved by the subsequent local and national legislation.The Data Regulations of Shenzhen Special Economic Zone stipulate that the data rights of natural persons,legal persons,unincorporated organizations,and the state are without making substantive distinctions. The draft of China’s Personal Information Protection Law stipulates several rights such as the right to decide personal information. The personality attribute of information is embodied in that it can identify the nature of a specific natural person and belongs to the object category that distinguishes the personality rights of different natural persons. The right to control personal information is the right of personality,which originates from the fact that personal information is the representation or symbol of the life,body and health of natural persons. The control of such information is actually the exercise of the right to life,body and health and the maintenance of the dignity of natural persons. The ongoing legislation on personal information protection in China should adhere to the dualistic theory,that is,the personal information protection law carrying out the legal principle of information control and centers on information processing,while the privacy protection rules carrying out the legal principle of privacy and centering on the prohibition of privacy infringement. Suggestions of personal information protection law amend the personal information protection,and make a clear distinction between consumer protection and information protection. Meanwhile,deleting handlers certificate without fault is not liable regulation. Strict limits to face recognition could be accomplished by increased regulations,public power authority in accordance with the law of specific conditions of the personal information collection,public places,applicable conditions and conditions of monitor technology.