刑事訴訟中適用《個人信息保護法》相關問題研究

Studies on Relevant Issues Concerning the Application of Personal Information Protection Law in Criminal Proceeding

《個人信息保護法》的頒布實施將刑事訴訟統一納入個人信息保護法律規範體系當中，需要認真研究刑事訴訟中如何適用《個人信息保護法》的相關規定。個人信息保護中的核心規則“告知－同意”規則在刑事訴訟中基本失效，同意規則無須適用，告知規則設置了寬泛的例外，刑事訴訟法律規範中應當明確例外的界限與適用情形。對于個人信息保存時限、委托處理個人信息的相關規則、自動化决策和敏感個人信息的處理，刑事訴訟中都應當進一步予以細化規定。個人信息權益在刑事訴訟中呈减損狀態，但不應被徹底剝奪，應當著力强化刑事執法、司法機關的個人信息保護的合規義務，構建《個人信息保護法》適用于刑事司法領域的若干支撑配套制度，包括將規制場景由技術偵查擴展至更爲廣闊的信息收集實踐，强化事先數據合規制度建設，增設檢察機關作爲刑事司法系統中投訴處理的負責機構等。

The promulgation and implementation of the Personal Information Protection Law will integrate criminal proceedings into the legal and standard system of personal information protection, and it is necessary to carefully study how to apply the relevant provisions of the Personal Information Protection Law in criminal proceedings. The core rule in personal information protection-the rule of “notificationconsent”is basically invalid in criminal proceedings. The consent rule does not need to be applicable. The notification rule sets broad exceptions, and the boundaries and application of exceptions should be clear in the law norms of criminal procedure law. In addition, the time limit for personal information preservation, relevant rules for entrusting personal information processing, automatic decisions and sensitive personal information processing, which should be further detailed in criminal proceedings. The rights and interests of personal information are derogated but cannot be deprived in criminal proceedings, so efforts should be made to strengthen the protection obligations of criminal law enforcement and judicial organs and establish several supporting systems of the Personal Information Protection Law applicable to the field of criminal justice: the scope of regulation should include covert surveillance as well as other evidence collection practice; strengthening data compliance programs and design prosecutors as information protection officer.