Since the outbreak of the epidemic, the information of Hubei classmates returning home has been leaked; the deputy director of the Hunan First District Health Bureau and others forwarded the investigation report of patients with new coronary pneumonia to unrelated personnel and then spread it to WeChat group; five hospital employees in Wenshan, Yunnan, leaked patient information; Liujiang CDC The staff of the center leaked patient information; Beijing newly imported a new case of Ms. Wang from Thailand, and her online distribution of Basic Verification of Ms. Wang's Diagnosis of New Coronary Pneumonia Patients removed Ms. Wang's personal information from the mask. Ms. Wang Troubled by various harassment calls and messages. The leakage of personal information should not be a consequence of Ms. Wang’s act of concealing her whereabouts, nor should the leakage of personal information become a secondary hazard after the epidemic storm.
1. Legal analysis of personal information related to epidemic
In the current situation of this new type of pneumonia epidemic, each of us is not a spectator sitting on the hill and watching the fight. The situation of the patient's personal information constantly leaking is also a mirror of each of us. No one is willing to streak his personal information. During the epidemic, personal information can be collected and used for the benefit of the public interest. However, the personal information and the public interest are not incompatible with both fish and bear's paws, but can protect the personal information while ensuring the public interest. .
There is currently no special legislation on personal information in China. Most of the provisions on personal information are scattered in laws, administrative regulations, etc. At the same time, the Personal Information Protection Law (Draft) has been included in the planning of legislative projects. The draft stipulates the basic principles such as the legal principles to be followed, the principle of informed consent, the principle of clear purpose, the principle of restricted use, the principle of completeness and correctness, and the principle of security, etc., and further subdivides the right of personal information into the right to decide 12), right to confidentiality (Article 13), right to access (Article 14), right to correction (Article 15), right to portability (Article 16), right to blockade (Article 17), right to deletion (Article 18) Article 8), the right to be forgotten (Article 19) and other eight specific personal information rights. The Personal Information Protection Law (Draft) undoubtedly provides guidelines for combating crimes that violate citizens' personal information.
Article 12 of the Law on the Prevention and Control of Infectious Diseases stipulates that all units and individuals in China must accept prevention and control measures such as investigation, inspection, sample collection, and isolation treatment of infectious diseases in disease prevention and control institutions and medical institutions, and provide relevant information truthfully Happening. Disease prevention and control institutions and medical institutions shall not disclose relevant information and materials concerning personal privacy. Article 68, paragraph 5: If the disease prevention and control agency violates the provisions of this law and has any of the following circumstances, the health administrative department of the people's government at or above the county level shall order corrections within a time limit, report criticisms, and give warnings; And other directly responsible personnel shall be given the punishment of demotion, removal, or dismissal according to law, and may revoke the practice certificates of the relevant responsible personnel; if it constitutes a crime, the criminal responsibility shall be investigated according to law: (5) Intentional disclosure of infectious disease patients, pathogen carriers, suspected Infectious disease patients and close contacts are related to personal privacy related information and materials.
Article 1 of the Law on the Prevention and Control of Infectious Diseases stipulates that the legislative purpose of the law is to prevent, control and eliminate the occurrence and prevalence of infectious diseases, protect human health and public health, and it can collect and include individuals for the benefit of public health such as epidemic prevention. Personal information including privacy. The range of personal information is very wide, ranging from the name of the individual to the trajectory of the individual's actions. According to Article 76, Item 5 of the Cybersecurity Law, personal information refers to various information recorded electronically or in other ways that can identify a natural person’s personal identity alone or in combination with other information, including but not limited to the natural person’s name, Date of birth, ID number, personal biometric information, address, telephone number, etc. The new crown is contagious and closely related to public health and public interests. Without timely understanding of infectious patients, it is difficult to carry out effective monitoring and prevention, and it is impossible to take corresponding measures such as isolation observation and treatment, and ultimately it is difficult to suppress the spread of the epidemic. The effective control of this epidemic is inseparable from the collection and processing of the patient's whereabouts and address. This shows that in the face of public interest, personal information rights will be affected to a certain extent, but it is not without boundaries. The restriction on the collection of personal information in the Law on the Prevention and Control of Infectious Diseases is only to really provide relevant information, not to collect information not related to infectious diseases.
In the aforementioned case, Ms. Wang has been tortured by various harassing calls and information every day since her personal information was exposed. This is not what we like to hear. At present, there are many enterprises in the society that exclude people from Wuhan, Hubei. If the personal information of the cured patients is improperly exposed, this will undoubtedly violate the personal privacy of these patients and will have a certain impact on the survival of these patients. Will expand social risks.
In addition, the “Notice on Doing a Good Job in Protecting and Utilizing Big Data to Support Joint Prevention and Control of Personal Information” (hereinafter referred to as the “Notice”) of the Central Internet Office clearly stated the limits for the collection and use of personal information to ensure the epidemic. Protection of personal information during the period. The contents are as follows:
1. All localities and departments must attach great importance to the protection of personal information, except for the institutions authorized by the State Council Health Department under the Network Security Law of the People's Republic of China, Law of the People's Republic of China on the Prevention and Control of Infectious Diseases, and Regulations on Emergency Response to Emergencies in Public Health Events No other unit or individual may use personal information without the consent of the person being collected on the grounds of epidemic prevention and disease prevention and control. Where there are other provisions in laws and administrative regulations, they shall be implemented in accordance with their provisions.
2. The collection of personal information necessary for joint defense and joint control should refer to the national standard Personal Information Security Standards and adhere to the principle of minimum scope. In principle, the collection objects are limited to key groups such as diagnosed persons, suspected persons, and close contacts, and are generally not targeted at specific areas. To prevent the formation of de facto discrimination against people in specific regions.
3. Personal information collected for epidemic prevention and disease prevention and control shall not be used for other purposes. No unit or individual may disclose personal information such as name, age, ID card number, telephone number, home address and other personal information without the consent of the person being collected, except for joint prevention and control work, except after desensitization.
4. The organization that collects or masters personal information is responsible for the security protection of personal information, and adopts strict management and technical protection measures to prevent theft and leakage.
5. Encourage competent companies to actively use big data under the guidance of relevant departments to analyze and predict the flow of key people such as diagnosed, suspected, and close contacts, and provide big data support for joint prevention and control.
6. Any organization or individual that finds violations of laws and regulations to collect, use, and disclose personal information can report it to the network and public security department in a timely manner. The network information department shall promptly deal with violations and illegal collection, use, and disclosure of personal information, as well as incidents that cause a large amount of personal information to be leaked in accordance with the “Network Security Law of the People’s Republic of China” and related regulations; public security organs involved in crimes shall be severely cracked down according to law.
During the epidemic situation, it is important to check the information of people returning to the hometown and diagnosed patients, but the collection and disclosure of personal information of infectious disease patients, pathogen carriers, suspected infectious disease patients, and close contacts are personal The same information should be treated equally. Especially when it is for the public interest, the personal information of the aforementioned persons can be collected, but when it is made public, a degree must be mastered, and the public interest cannot override the personal rights, especially the personal information related to personal privacy , The above Notice emphasizes that the collection of personal information must adhere to the principle of minimum scope in principle, and without the personal consent of the person being collected, personal information such as name, age, ID number, telephone number, home address, etc. must not be disclosed at will. These are more importantly related to personal privacy, personal privacy should not be violated at will. The disclosure of personal information must be part of the disclosure of personal information under the legal, necessary and justified premises, and used for epidemic prevention purposes. However, such as the disclosure, secret shooting and dissemination of personal information listed at the beginning and causing adverse effects are acts of infringement of citizens’ personal information, and serious circumstances may constitute a crime of infringement of citizens’ personal information.
2. The application of the crime of infringing citizens’ personal information
One of the Article 253 of the Criminal Law is the crime of infringing citizens’ personal information: in violation of the relevant state regulations, selling or providing citizens’ personal information to others. If the circumstances are serious, they shall be sentenced to fixed-term imprisonment of not more than three years or detention, and shall be punished with a single fine. ; If the circumstances are particularly serious, he shall be sentenced to fixed-term imprisonment of more than three years but less than seven years, and a fine. Anyone who violates relevant state regulations and sells or provides citizens’ personal information obtained in the course of performing duties or providing services shall be given a heavier punishment in accordance with the provisions of the preceding paragraph. Whoever steals or otherwise illegally acquires personal information of citizens shall be punished in accordance with the provisions of the first paragraph. If the unit commits the crimes of the first three paragraphs, the unit shall be fined, and the person in charge and other persons directly responsible for the unit shall be punished in accordance with the provisions of each paragraph.
The legal protection of this crime is the right to self-determination of information in personal information. The right to self-determination of information is one of the manifestations of human dignity and freedom. If we cannot enjoy the right to self-determination for personal information that is closely related to ourselves, we do not know our own personal The extent to which information is collected and used cannot determine the extent to which your personal information is disclosed, and it is difficult for people to manifest themselves as their autonomy and uniqueness and become tools. Combined with the epidemic situation, it can be found that the act of freely disclosing personal information related to the epidemic not only violates the provisions of the Network Security Law, Infectious Disease Prevention and Control Law, and Public Health Emergency Response Regulations, but also in serious cases, it also violates criminal law.
The behavior of this crime: in violation of relevant state regulations, selling, providing and illegally obtaining personal information of citizens. The Interpretation of the Supreme People’s Court and the Supreme People’s Procuratorate on Several Issues Concerning the Application of Laws in Handling Criminal Cases of Infringement of Citizens’ Personal Information (hereinafter referred to as the “Interpretation”) provides a clearer explanation of the application of Article 253 of the Criminal Law. Relevant regulations refers to the provisions on the protection of citizens' personal information in violation of laws, administrative regulations, and departmental regulations. The aforementioned Network Security Law, Infectious Disease Prevention and Control Law, and Public Health Emergency Response Regulations are included. Provide personal information of citizens refers to providing personal information of citizens to specific people and publishing personal information of citizens through information networks or other channels. In the aforementioned case, the deputy director of the Hunan First District Health Bureau and others forwarded the investigation report of patients with new coronary pneumonia to unrelated persons. It is consistent with providing personal information of citizens. If the situation is serious, it constitutes a crime of infringing on personal information of citizens.
This crime is a plot offense. In order to constitute this crime, it must reach serious circumstances. Articles 5 and 6 of the Interpretation cite relevant circumstances of serious circumstances to combat crimes infringing citizens' personal information, safeguard the right to self-determination of personal information, and realize the function of safeguarding human rights. In practice, the leakage of most of the personal information related to the epidemic is not enough to meet the standard for filing the crime, but the amount of personal information collected during the epidemic is huge, and the collection personnel are numerous. At present, no corresponding policy measures have been promulgated, so the individuals collected Information is in a state of risk, and it can become a weapon in the hands of criminals at any time.
3. The second half of the protection of epidemic-related personal information
For the protection of epidemic-related personal information, it should be implemented in the collection, storage, use and disclosure. For example, when collecting personal information of epidemic-affected personnel, the purpose and method of collection of personal information should be explained to the person being collected. Information beyond the purpose of infectious disease prevention and control should be avoided, such as credit information, property information, etc.; in the storage link, Information collection units and individuals should take measures to avoid the leakage of stored information. Sealing measures can be taken at the end of the epidemic. The collection of personal information during the epidemic is not limited to medical institutions, but also neighborhood committees, village committees, supermarkets, buses, pharmacies, Community property, etc., the storage of these collected personal information is a big problem. Not all information collectors will destroy the information. This requires these information collectors to improve storage measures; The disclosure of personal information related to personal privacy, such as ID card number, avoids the identifiability of the information. In this epidemic, many of the information about the patient’s case contains unnecessary personal information. Take the patient Ms. Wang who was imported from abroad as an example , Household registration is not necessary to disclose information. Victims of infringed personal information should have the right to delete their own rights, such as the right to delete and be forgotten.
During the epidemic situation, the legality, necessity and legitimacy of the disclosure of personal information shall be ensured, and a balance shall be reached between the prevention and control of the epidemic situation and the protection of personal information. At present, our country's epidemic prevention and control is in place, and the resumption of production in various places has been steadily advancing. Among them, the health codes issued by various regions are the needs of epidemic prevention and control, and the personal information in the health codes can only serve the epidemic prevention and control, but not another. For other purposes, this requires strict protection measures to wear a mask.