侵犯公民个人信息罪司法裁量的实证研究

An Empirical Study of Criminal Sanctions on the Crime of Infringing Personal Information in China

通过对2009年2月至2021年7月间全国法院审结的侵犯公民个人信息罪案件进行量化分析后发现,我国法院裁量侵犯公民个人信息罪案件的实践与规范之间存在偏离现象,主要体现在法院实际判处的刑罚畸轻和未能准确识别个人信息的敏感程度。侵犯公民个人信息罪的设置过于注重预防功能和个人信息分级分类制度不健全,是导致司法裁量与应然规范出现偏离的原因。在数据安全形势不容乐观和个人信息行政法保护体系与民法保护体系逐步完善背景下,完善侵犯公民个人信息罪的立法方向,应包括调整定罪标准和细化敏感个人信息类型两个方面。未来应当以健全个人信息多部门法协同保护为目标,适时调整各部门法的保护边界,实现刑法与其他部门法的有效衔接,进而实现法律手段与其他规制手段的协同治理。

Drawing on the empirical analysis of verdicts on infringing personal information made by Chinese courts from February 2009 to July 2021, we find a considerable discrepancy between judicial practice and the law. The discrepancy reflects on the fact that the courts’ actual criminal sanctions were excessively light, and the courts failed to distinguish the sensitivity of personal information accurately. The main reasons for causing the discrepancy are twofold:(1) the existing criminal legal framework emphasizes too much on its preventive function against the abuse of personal information;(2) the legal rules of classifying personal information have not taken shape. Under the rapid development of administrative law protection and civil law protection on personal information, we suggest to adjust the criteria of criminalizing the behaviors of infringing personal information and specify the types of sensitive personal information. The long-term reform goal should be developing coordinated protection with the support of criminal law, administrative law and civil law, and then achieving coordinated personal information governance by legal and other regulatory means.