涉人脸识别犯罪的关键问题

Key Issues on the Crimes Related to Facial Recognition

《个人信息保护法》第28条将人脸识别等包含个人生物识别特征在内的信息作为敏感个人信息加以特别保护极有必要,除此之外,应针对实践中涉人脸识别犯罪频发的现状,有效运用刑法手段精准打击,以全面保护人格权。获得个人知情同意的信息取得、利用行为,排除侵犯公民个人信息罪的客观构成要件,而非阻却违法性。网络放贷平台APP等擅自抓取贷款申请人的人脸识别数据,当然违反知情同意规则;即便征得该申请人同意,但读取其通讯录以及手机中储存的照片的,由于该申请人对于涉及他人的信息无权同意,获取行为也违背知情同意规则,有可能构成本罪。行为人未经允许,将他人的肖像加工成人脸识别数据,破解人脸识别安全验证,解除网络支付平台账户限制等,属于非法控制计算机信息系统的行为,不构成破坏计算机信息系统罪,也不宜认定为非法获取计算机信息系统数据罪。欺骗被害人"刷脸"后冒用其名义贷款的,构成盗窃罪而非诈骗罪。行为人同时实施非法控制计算机信息系统行为以及获取账户资金、个人信息等行为的,应当数罪并罚。准确认定涉人脸识别犯罪,需要坚持构成要件的观念,考虑刑法上所固有的违法性判断,并兼顾《民法典》及《个人信息保护法》的立场。

Facial recognition,as biometric information,is labeled as sensitive personal information and is specially protected by Article 28 of Personal Information Protection Law.However,to fully protect personality rights,it is necessary to use criminal law to crack down precisely the related crimes in view of the frequent occurrences of crimes involving facial recognition.The informed consent for obtaining and using personal information eliminates no illegality,though it excludes one objective constituent element for the crime of infringing citizens’personal information.In the case of the lending platform app and other similar ones arbitrarily grabbing the facial recognition data of the loan applicant,which of course violates the informed consent rule,even with the consent of the applicant,reading his address list or photos on his mobile phone may constitute the crime of infringing personal information,since the applicant has no right to consent to the information involving others.If the photos of others are further processed into 3 D facial recognition data so as to crack the facial recognition security verification,and to lift the account restrictions of the online payment platform,etc.,then such act is one of illegally controlling the computer information system,which does not constitute the crime of destroying the computer information system,and should not be held as the crime of illegally obtaining the data of the computer information system.To deceive a victim into facial-scanning and into making a loan in his name shall constitute the crime of theft rather than fraud.If the act of illegally controlling the computer information system and the act of obtaining banking accounts and other personal information are committed together,then combined punishment for several crimes shall be considered.To sum up,to accurately identify the crimes involving facial recognition,all need to be taken into account,including the concept of constituent elements,the judgement of illegality inherent in criminal law,and the perspectives of the Civil Code of PRC and the Personal Information Protection Law.