人臉識別技術濫用行為刑法規制的頂層設計

The Top-Level Design of Criminal Law Regulation on the Abuse of Facial Recognition Technology

合理規制人臉識別技術濫用行為，必須做好頂層設計。對待人臉識別技術應用的價值取向，理論上存在原則禁止論與合規許可論的對立。原則禁止論過分強調風險，會阻礙人臉識別技術的進步；合規許可論將前置法與刑法應當秉持的立場混同，且沒有揭示刑法規制人臉識別技術檻用行為的深層法理。對待人臉識別技術檻用行為的應然態度是有所為有所不為。關於人臉識別技術濫用行為刑法規制的方向選擇，理論界存在刑法規制優先論與科技創新優先論的分野。科技創新優先論與刑法規制優先論各有優劣，只有將人臉識別信息放到第一層級進行強保護，才能真正實現兩種規制方式的平衡。關於刑法如何預防人臉識別技術檻用產生的風險，存在事前預防與事後打擊兩種模式。事後打擊模式雖然有利於保障公民的自由，但不利於保障安全；事前預防模式可以實現對法益更前位的保護，但會對刑法的謙抑原則造成衝擊，動搖罪責原則的基礎。理性的選擇是，根據不同類型人臉識別技術濫用行為的不同特質分域而治。

With the development of information science, the application of facial recognition technology is becoming increasingly widespread, and there are more and more incidents of abusing facial recognition technology to infringe on the rights and interests of others. The misuse of facial recognition technology is related to personal privacy, property, and personal safety. The criminal law, as the last resort of social defense, cannot ignore the abuse of facial recognition technology. Facial recognition technology is a technology that combines advantages and disadvantages. To reasonably regulate the abuse of facial recognition technology, it is necessary to make the top-level design. There is a theoretical opposition between the theory of principle prohibition and the theory of compliance licensing regarding the value orientation of facial recognition technology applications. The theory of principle prohibition excessively emphasizes risks, which will hinder the progress of facial recognition technology; the theory of compliance licensing confuses the position of the pre-existing law and criminal law, and does not reveal the deep jurisprudence of criminal law in regulating the abuse of facial recognition technology. The attitude towards the abuse of facial recognition technology is to do something but not everything. We should limit the scope of criminal law intervention in the abuse of facial recognition technology through the principles of last resort, the principle of proportionality and allowed danger theory, and focus on regulating the abuse of facial recognition technology with modern risk characteristics. There is a theoretical divergence regarding the direction of regulating the abuse of facial recognition technology between the theory of priority in criminal law regulation and the theory of prioritizing technological innovation. If we adhere to the theory of prioritizing technological innovation, we should provide weak protection for facial recognition information; if we adhere to the theory of priority in criminal law regulation, we need to provide strong protection for facial recognition information. The guiding case released by the Supreme People's Court of China regards facial recognition information as a second level of information, which appears to choose a compromise solution, but in essence tends to the priority of technological innovation. The theory of prioritizing technological innovation and the theory of priority in criminal law regulation have their own advantages and disadvantages. Under the premise that the current criminal law essentially shifts towards the priority of technological innovation, only by strongly protecting facial recognition information as the first level of information can we truly achieve a balance between the two regulatory methods. There are two regulation modes on how to prevent the risks caused by the misuse of facial recognition technology: pre-prevention and post-combating. Although the mode of post-combating is beneficial for safeguarding the freedom of citizens, it is not conducive to ensuring safety; the mode of pre-prevention can achieve a more advanced protection of legal interests, but it has an impact on the principle of leniency in criminal law and erodes the foundation of the principle of criminal responsibility. Rational choice is to adopt different governance strategies based on the different characteristics of abusive behavior of different facial recognition technologies. The risks caused by ''deep forgery'', ''facial fraud'', facial impersonation, and account registration belong to traditional risks, which can be regulated by using the model of post-combating; the risks caused by technological cracking and illegal acquisition of facial data belong to modern risks, and it is advisable to adopt the mode of pre-prevention to regulate.