What Is Identity Protection?

The Personal Information Protection Law is a legal provision for the protection of personal information, and is currently under development. Involved in the establishment of the name of the law, the issue of the legislative model, the significance and importance of the legislation, the status of the legislation and the legislative basis, the scope of application of the law, the exceptions to the application of the law and the manner in which it is provided, the basic principles of personal information processing, and the regulations on government information disclosure Relationships, different regulatory approaches to government agencies and other personal information processors and their effects, the relationship between coordinating the protection of personal information and promoting the free flow of information, the application of personal information protection laws in specific industries, issues concerning sensitive personal information, legal issues Enforcement agencies, industry self-regulation mechanisms, information subject rights, cross-border information exchange issues, and criminal liability issues. It has a great effect on individuals and industries. ^[1]

Personal Information Protection Act

The Personal Information Protection Law is a legal provision for the protection of personal information and is currently under development. Involved in the establishment of the name of the law, the issue of the legislative model, the significance and importance of the legislation, the status of the legislation and the legislative basis, the scope of application of the law, the exceptions to the application of the law and the manner in which it is provided, the basic principles of personal information processing, and the regulations on government information disclosure Relationships, different regulatory approaches to government agencies and other personal information processors and their effects, the relationship between coordinating the protection of personal information and promoting the free flow of information, the application of personal information protection laws in specific industries, issues concerning sensitive personal information, legal issues Enforcement agencies, industry self-regulation mechanisms, information subject rights, cross-border information exchange issues, and criminal liability issues. It has a great effect on individuals and industries. ^[1]

The legal protection of personal information is a problem that has become increasingly prominent with the development of the information society in the past half century. Due to social ideas, information industry, science and technology, and legislative planning, China has not recognized the importance of protecting personal information for a long time. Therefore, until now, China has not formulated a special law on personal information protection. . Of course, this does not mean that China does not protect personal information. At the present stage, the protection of personal information in China is mainly reflected in two major aspects: First, the provision of personal information protection clauses in laws and regulations related to the protection of personal information provides legal protection of personal information. The legal protection of personal information can also be expressed as the direct and indirect protection of the law. The so-called direct protection of laws means that the laws and regulations explicitly provide protection for "personal information"; indirect protection means that laws and regulations pass on "Privacy", "personal secrets" and other areas related to personal information are protected to further extend the protection of personal information. The second is to protect the personal information in a self-disciplined manner through the unilateral commitment of the information controller or the commitment of the self-regulatory norms of the specific industry. The self-regulatory protection of personal information is also manifested in two aspects, that is, companies protect their personal information through unilateral commitments in this way of market operation, and specific industry organizations establish industry protection standards for personal information through industry self-regulation norms to protect.

I. Direct protection of personal information by Chinese law

Through a search of the National Laws and Regulations Database Search Engine on the website of the National People s Congress, we found that the number of laws, regulations, rules and judicial interpretations that directly protect personal information in China is quite limited. The Passport Law of the People's Republic and the "Identity Card Law of the People's Republic of China" directly regulate the protection of "personal information." "

Urgency of legislation

Professor Xie Wangyuan, an expert in criminal law at Renmin University of China Law School, believes that some citizens' personal information obtained in the performance of official duties or service provision activities by some state agencies and telecommunications organizations has been illegally leaked. Personal privacy poses a serious threat. Such serious violations of citizens' rights and interests shall be investigated for criminal responsibility. Compared with foreign countries or China s Hong Kong and Taiwan regions, the protection of personal privacy by our laws is far from enough. A distinguishing feature of modern criminal law is that it not only serves as the "knife" of the country, but also becomes a "major charter" that protects the legitimate rights and interests of citizens. This draft criminal law amendment, which is a criminal legislative idea that focuses on protecting the privacy of citizens, constraining public power and public services, deserves further development.

Dr. Wang Chunhui, a researcher at the China Development Strategy Institute, believes that with the rapid development of information technology, the collection of personal information has become easier. Improper use or disclosure of such information can cause personal and property damage to individuals. Therefore, the protection of the right to privacy of individuals should not be limited to the protection of the so-called right of solitude, but should be developed in the direction of protecting personal information. The right to privacy has evolved from the traditional negative right of "individual peace and undisturbed" to a modern and positive "information right of privacy." In addition, according to the draft amendment's description of the subject of the crime: the perpetrator violated national regulations and will sell or illegally provide personal personal information of citizens obtained in the course of performing the duties of the unit or providing services, or illegally stealing, buying, etc. Obtaining the above information, if the circumstances are serious, will constitute a crime. It can be seen that the criminal subjects infringing on citizens' information rights include not only special subjects, but also general subjects. That is to say, staff members specializing in financial, telecommunications, transportation, education, medical and other units are special subjects constituting this crime, and those who illegally obtain the above information by stealing, buying, etc. can also constitute the subject of this crime.

Dr. Wang Chunhui proposed that the amendments to the Criminal Law specifically provide for the protection of citizens' personal information, which is undoubtedly a deterrent to criminals who illegally sell, provide, or illegally obtain citizen information by stealing, buying, etc. Because, of all legal responsibilities, the punishment and deterrence of criminal legal responsibilities is the most severe. China's involvement in the protection of personal information by amending the criminal law shows the importance the country attaches to the protection of personal information of citizens, and also confirms the strength of the country's protection of personal information of citizens.

Of course, the protection of citizens' personal information is not enough with just one amendment to the criminal law, it is impossible to solve all the problems of personal information protection. The legal system for the protection of personal information is a comprehensive system involving multiple departmental laws such as the Constitution, Criminal Law, Civil Law, and Administrative Law.

Therefore, Dr. Wang Chunhui suggested that a special law to protect personal information should be enacted and promulgated as soon as possible. This special law should make a difference in two major areas: First, the use of public power by government departments to disclose individuals Information should be regulated. Second, some public service enterprises, such as financial, telecommunications, transportation, education, medical, and other units, should strictly regulate the protection of customer information.

The formulation of the Personal Information Protection Law will also protect personal privacy and information on the Internet in a more comprehensive and complete manner, and at the same time play a role in strengthening Internet industry self-regulation. In contrast to international practices, European countries have adopted national legislation-led models in the protection of personal data and data; while the US federal government has advocated a self-regulatory model. The "Federal Elements of Effective Self-Regulatory Approaches to Protect Privacy" published by the US Federal Government in 1997 , Believe that promoting enterprises to formulate and improve the protection of personal data privacy plans and policies will make consumers trust, and then willing to provide personal data and Internet transactions, only in this way can promote the development of business activities.

In terms of personal information protection legislation, China should also achieve a certain balance between protecting and promoting economic development. We must weigh the interests of both sides. We must protect the requirements of personal privacy data protection and make network users have confidence in the network. It is also necessary to avoid inhibiting the development of the Internet cause, with a view to formulating the most appropriate and complete legal rules that are suitable for China's national conditions and the future development of the network cause. At the same time, when the Personal Information Protection Law is about to be promulgated and the basic spirit of protecting individual privacy is established, Internet companies must strengthen self-discipline, abide by basic ethics and network order, and enhance the social responsibility of online corporate citizens. The combination of regulations and self-discipline makes a relatively complete personal information protection system suitable for national conditions no longer far away.

Why is legislation slow?

"Because we do not effectively protect the privacy of personal information, our daily work and life have suffered serious interference due to the leakage of personal information, and even caused damage to property and reputation." CPPCC member Hu Xusheng recently submitted a proposal calling for Enact the Personal Information Protection Law as soon as possible. It is also a response to the formulation of the personal information protection law. The 2009 "Blue Book of Rule of Law" issued by the Chinese Academy of Social Sciences pointed out that the continuous development of information processing and storage technology has aggravated the problem of abuse of personal information in China, and the worse is illegal. Buying and selling personal information, society's need for personal information protection legislation is becoming more and more urgent.

The information protection provisions scattered in some legal provisions can no longer meet the requirements of dignity and rights, and we need a "Personal Information Protection Law", which is hard to say. However, the relevant legislative work has become deeply hesitant. As early as 2003, expert drafts of the Personal Information Protection Law began to be drafted and submitted to relevant departments in 2005. "Because of the importance and urgency of legislation on the protection of personal information," Zhou Hanhua, the leader of the research group and a researcher at the Chinese Academy of Social Sciences Law Institute, once thought that the law would eventually be promulgated "will not take long." But after five years, members of the CPPCC National Committee of the NPC and CPPCC are still submitting proposals for the formulation of this law. The public has repeatedly paid the price of being a "transparent person" while waiting for a long time.

Personal information has been bought and sold illegally, the right to be alone has been rudely invaded, and the public usually has nowhere to defend their rights, but this is only one aspect. On the other hand, the larger fact is that the personal information that should be disclosed is therefore in a state of vagueness and refusal to disclose. This is really an aspect of personal information legislation that cannot be avoided, that is, not all personal information is protected. For example, information about public figures, especially officials.

We already know that the disclosure of information, which is mainly characterized by the declaration of official property, is one of the achievements of human civilization, and it clearly shows the transfer of rights that public figures must bear, and the public supervision that power must accept. This means that in order to establish the Personal Information Protection Law, it is inevitable to evade the requirement for disclosure of official information. At the two sessions, the department s response to the proposal of the official property declaration system was still less mature. As an important aspect of personal information protection, official information disclosure requirements suddenly became distant, and the previously issued The Government Information Disclosure Ordinance is also unclear on how to define official property and personal privacy. Such a lack of doom meant that the "Personal Information Protection Law" could only be in a situation of "only smelling the stairs and not seeing people down".

Eventually it showed a result: the absence of the "Personal Information Protection Law" not only failed to effectively protect citizens' right to privacy, but also allowed official information that should be made public to refuse to make public on the grounds of "privacy." For example, in the "Guangzhou Municipality's Application for Disclosure of Government Information by Law," which was issued in 2007, it was clearly stipulated that "leading members' integrity information" should not be made public. It is also at this point that personal information legislation has become hesitant. What's stuck in it is not the question of whether the privacy of citizens should be protected, but whether the personal information of officials should be made public. I remember Wang Youjie, a deputy to the National People s Congress at the National People s Congress in 2005, provided a statistic: 97% of officials opposed the declaration of official property. Therefore, it is not vain that Shixin Interest Group interfered with the legislation.

Xinhua News Agency s Xinhua Viewpoint column broadcast on January 11 "Your credit card personal information" can be bought online for only 5 cents "? "Report on Bank Credit Card Information Leakage Investigation" has aroused widespread concern in society ^[6] .

Relevant persons in charge of the National Internet Information Office responded in an exclusive interview with Xinhua Viewpoint reporters. In response to the leakage of personal credit cards and other information networks, China will expedite the study and formulation of personal information protection laws and increase the number of illegal collection, disclosure, and sale of personal information. Strike force. The regulatory authorities also announced to the public the channels for reporting residents' information leakage: citizens can safeguard their rights through various methods such as the "12377" report phone, and Internet companies have the responsibility to curb illegal personal information transactions.

National Internet Information Office: will accelerate the development of personal information protection laws

The "Xinhua Perspective" report revealed that the bank's credit card customer data leakage was quite serious. Through online tools such as QQ group and WeChat, you can buy the name, phone, address, work unit, account bank, etc. for only 5 cents. Credit card account opening data with complete personal information. The quotation of some old personal data is even as low as "2000 yuan and 100,000." These leaked personal information has become an important source of fraud traps and harassing phone calls.

"At present, the leakage of personal information on the Internet is very serious." Yang Chunyan, deputy director of the Cyber Security Bureau of the State Cyberspace Office, pointed out that in particular, the leakage of sensitive information on bank cards has repeatedly occurred and was used by some criminals to engage in illegal crimes and harm the interests of users. "The state attaches great importance to this and has adopted a series of measures."

According to reports, the Chinese government is promoting the protection of personal information on the Internet in terms of legislation, legislation and standards, and technical protection measures. Yang Chunyan said that relevant departments such as the Internet Information Office, the Ministry of Industry and Information Technology, and the Ministry of Public Security will speed up the research and formulation of personal information protection laws and accelerate the implementation of the network security review system. "The focus will be to strengthen the supervision of network service providers and increase the crackdown on illegal collection, disclosure and sale of personal information."

In addition, according to the Xinhua Viewpoint report survey, commercial banks have become one of the sources of information leakage through banks' "inner ghosts" reselling information and changing hands to "cooperative companies". But various exceptions and exemptions often leave consumers accountable. In response, the National Cyberspace Information Office reminded citizens that after personal information has been leaked, citizens can defend their rights in the following three ways:

-In accordance with the Decision of the Standing Committee of the National People's Congress on Strengthening the Protection of Network Information, individuals experiencing information leakage have the right to immediately request the network service provider to delete the relevant information or take other necessary measures to stop it.

-Individuals can also report complaints to the public security department, Internet management department, industry and commerce department, consumer association, industry management department, and relevant agencies. "The China Internet Information and Illegal Information Reporting Center affiliated to the State Cyberspace Information Office will receive and handle the public's reports of Internet illegal and bad information on a full-time basis," said Yang Chunyan.

-Consumers can also further protect their legal rights through legal means, such as asking the infringer to apologize, eliminate impact, restore reputation, and compensate for losses, according to the "Tort Liability Law" and "Consumer Rights Protection Law."

What other information is being resold? Hospital visits, online shopping records, etc.

According to central bank data, as of the end of the third quarter of 2014, China had issued a total of 436 million credit cards. After preliminary investigation by the Internet management department, the reasons for the leakage of credit card information are more complicated. First, the information leakage of commercial banks due to internal management and other reasons; second, the theft of information due to cardholders' poor security awareness; third, third-party institutions are holding In the process of online payment by cardholders, illegal storage of bank card sensitive information resulted in information leakage.

"The leak of bank card information may involve multiple links such as card application, card use, card management, etc. The supervisory department must first identify the problem link and then deal with it according to law and regulations." Yang Chunyan said.

The reporter's investigation also found that in reality, "massive" personal information is sold online, and there are many channels for information leakage and reselling. Even citizens' hospital visits, online shopping records, and house opening information have been sold for "a few cents." :

-Patient visit records are publicly sold. According to clues provided by people familiar with the matter, the reporter joined a QQ group called "Health Resources-Patient Data". In the group's profile information, the words "operating and selling patient data, hospitalization data, registered data, medical insurance settlement reimbursement data" are prominently listed. Some sellers said that they can provide data on neonatal and hypertension, diabetes, cardiovascular disease, tumor patients, and private information such as the patient's name, age, and medical history.

"Just after the operation, I received a sales call for drugs, equipment and health products, which lasted two or three years." Mr. Liu, a citizen of Shanghai Yangpu District in his 60s, told reporters that after he was treated in Shanghai Changhai Hospital in 2010, After the operation, I continued to receive sales calls and letters about her illness. "Some harassers also made it clear that they knew my home address."

-Online shopping flow information is bought and sold at will. The number of online shopping users in China has reached 332 million. Personal names, delivery addresses, contact numbers, shopping categories and other information provided by online shopping consumers have entered the "black market" of public sales. A QQ platform seller who claims to be a Taobao data merchant said that online buyers have a large demand for data such as logistics information and purchased product information, which can be shipped all day, and the cheapest one "you can buy 30,000 items for 2,000 yuan Personal information".

"Some e-commerce platforms are dominated by individual merchants, and information is scattered in the hands of individual merchants, which is more prone to the risk of information leakage." Said Fu Weigang, executive director of the Shanghai Institute of Finance and Law.

A large number of membership cards and membership services require "identity cards to use", but poor management leads to information leakage. Industry insiders said that various businesses require more and more information from individuals, and consumers generally have no choice. In December 2012, Shanghai white-collar worker Wang Jinlong stayed at the Hanting Hotel in Guangzhou and Shenzhen. In 2013, after a piece of "20 million house opening information" data was leaked online, Wang Jinlong downloaded the online circulation file package and found that his name, ID card number, mobile phone number, and house opening time were all among them. The New District Court sued the hotel.

The "black market" of personal information is still rampant. Can monopolies not do anything?

Yang Chunyan said that since the establishment of the State Network Information Office, in 2014, it has launched a new "Ten WeChat Ten Rules", which clearly specifies the personal information protection responsibilities of instant messaging tool service providers: for example, operators such as QQ and WeChat must protect user information And personal privacy of citizens, consciously accept social supervision, and promptly deal with illegal and bad information reported by the public.

"The supervisory authorities will continue to protect personal information by administering the network in accordance with the law, and individuals should also raise awareness to actively safeguard their rights." Yang Chunyan reminded the general public to further increase their awareness of personal information protection and try not to provide their personal information at will.

In fact, the rampant black market of information transactions has cost consumers a painful price. "There are many buyers of personal information, including illegal precious metal trading and private lending companies, which pose great social risks," said Xu Feng, a partner of Shanghai Huarong Law Firm.

For example, in September 2013, Mr. Zhang, a Nanjing-based investor in Jiangsu, received constant harassment calls from the sales staff of illegal wealth management companies after purchasing a well-known stock market software. In 15 trading days, it lost about 350,000 yuan.

In 2014, the reporter searched on the QQ group, WeChat and some e-commerce platforms and found that many black markets of personal information still exist. Use the search function only in the QQ group to search for the keywords of "bank card information". There are at least 120 groups with more than 30 participants and active transactions. In some online "Library" websites, there is still public telephone data of bank customers.

Liu Chunquan believes that the leakage of user information involves multiple illegal subjects, from the bank as the source to the Internet platform as the channel of communication, as well as the disseminator and user of the information. "For commercial banks and Internet companies that are in a monopoly position, strictly preventing customer data leakage from internal control has no obvious benefit to them, and they often use various excuses to shirk responsibility."

Fu Weigang suggested that when residents encounter spam text messages or harass phone calls, they can adopt the "inversion of burden of proof", that is, companies that use customer data to engage in telephone sales need to obtain self-certified information through legal channels. "Websites that allow personal privacy information to be traded and sold for free, have also obtained traffic and profits through illegal information markets, and should also be punished." (Xinhua News Agency Xinhua Viewpoint reporters Du Fang and Luo Zheng) ^[6]