刑事诉讼中适用《个人信息保护法》相关问题研究

Studies on Relevant Issues Concerning the Application of Personal Information Protection Law in Criminal Proceeding

《个人信息保护法》的颁布实施将刑事诉讼统一纳入个人信息保护法律规范体系当中,需要认真研究刑事诉讼中如何适用《个人信息保护法》的相关规定。个人信息保护中的核心规则“告知-同意”规则在刑事诉讼中基本失效,同意规则无须适用,告知规则设置了宽泛的例外,刑事诉讼法律规范中应当明确例外的界限与适用情形。对于个人信息保存时限、委托处理个人信息的相关规则、自动化决策和敏感个人信息的处理,刑事诉讼中都应当进一步予以细化规定。个人信息权益在刑事诉讼中呈减损状态,但不应被彻底剥夺,应当着力强化刑事执法、司法机关的个人信息保护的合规义务,构建《个人信息保护法》适用于刑事司法领域的若干支撑配套制度,包括将规制场景由技术侦查扩展至更为广阔的信息收集实践,强化事先数据合规制度建设,增设检察机关作为刑事司法系统中投诉处理的负责机构等。

The promulgation and implementation of the Personal Information Protection Law will integrate criminal proceedings into the legal and standard system of personal information protection, and it is necessary to carefully study how to apply the relevant provisions of the Personal Information Protection Law in criminal proceedings. The core rule in personal information protection-the rule of “ notificationconsent”-is basically invalid in criminal proceedings. The consent rule does not need to be applicable. The notification rule sets broad exceptions, and the boundaries and application of exceptions should be clear in the law norms of criminal procedure law. In addition, the time limit for personal information preservation,relevant rules for entrusting personal information processing, automatic decisions and sensitive personal information processing, which should be further detailed in criminal proceedings. The rights and interests of personal information are derogated but cannot be deprived in criminal proceedings, so efforts should be made to strengthen the protection obligations of criminal law enforcement and judicial organs and establish several supporting systems of the Personal Information Protection Law applicable to the field of criminal justice: the scope of regulation should include covert surveillance as well as other evidence collection practice;strengthening data compliance programs and design prosecutors as information protection officer.