非法获取个人数据犯罪的法益分析及处罚限定

Legal Interests and Penalty Restrictions Against the Crime of Illegally Obtaining Personal Data

个人信息权益、数据权益、信息管理秩序、数据安全秩序,是大数据时代下刑法保护的新兴法益。侵犯公民个人信息罪保护个人信息权益,非法获取计算机信息系统数据罪保护数据权益,二者都应作为个人法益保护。一方面,侵犯公民个人信息罪中“同意”要件的规范化构造,以刑法对个人信息的保护程度为基础,在因“同意”而产生的合理预期范围内由信息主体承担信息社会的风险。另一方面,以私法上个人数据确权理论为依据,非法获取计算机信息系统数据罪的对象应包含个人数据所承载的数据控制者的数据权益,处罚范围取决于个人数据上的企业投入及合法获取。非法获取个人数据的行为,可能构成侵犯公民个人信息罪与非法获取计算机信息系统数据罪的想象竞合。

Personal information rights,data rights,information management order,and data security order are emerging legal benefits protected by criminal law in the era of big data.The establishment of the crime of infringing citizens’personal information protects personal information rights,and the establishment of the crime of illegally obtaining computer information system data protects data rights.Both personal information rights and computer information system data are protected as personal legal interests.On one hand,the standardized structure of the“consent”element in the crime of infringing citizens'personal information is based on the degree of protection of personal information provided by the criminal law.Within the scope of reasonable expectations arising from“consent”,the information subject bears the risk.On the other hand,based on the theory of personal information in private law,the object of the crime of illegally obtaining computer information system data should include the data controller's right to personal data.The scope of punishment against this crime depends on the company's investment in and legal acquisition of personal data.The act of illegally obtaining personal data may constitute an imaginative joinder of offenses between the crime of infringing on citizens'personal information and the crime of illegally obtaining computer information system data.