風險預防視角下生物識別信息的刑法保護

隨著生物識別技術和網絡技術的快速發展，過限的生物識別信息採集、處理和利用行為不僅侵害個人基本權益，更可能引發重大社會與國家安全風險。傳統以權利保護為中心的個人信息治理路徑已無法適配信息風險的治理需求，亟需建立以風險預防原則為基礎的風險控制模式，將監管範圍從生物識別信息本身的保護擴展至潛在危害的預防，將治理重點從個人權利保障轉向對公私數據控制者權力的限制和監管。應當通過解構不同風險場景下法益侵害的內在邏輯，設立適配不同風險等級的刑法介入標準，將風險分級監管與場景化區分治理有機結合起來。同時，通過解釋和修改現有罪名的方式實現對侵犯生物識別信息行為的直接和間接規制，實現風險社會背景下個人信息保護、國家公共治理需求以及國家對個人信息的保護義務三者之間的平衡，兼顧刑法謙抑性與社會治理有效性，為風險社會生物識別信息的治理提供具有實踐可行性的刑法方案。

With the rapid advancement of biometric and digital technologies, the excessive collection, processing, and use of biometric information not only infringe upon individuals' fundamental rights but also pose substantial security threats to society and the state. The traditional rights-based approach to personal information governance proves inadequate in addressing the challenges of information risk management. It is therefore essential to establish a risk-oriented regulatory framework grounded in the precautionary principle—one that extends the scope of regulation from the mere protection of biometric data to the prevention of potential harms. The focus of governance should shift from safeguarding individual rights alone to regulating and supervising the powers exercised by both public and private data controllers. By deconstructing the intrinsic logic of legal interest infringement across diverse risk scenarios, it is imperative to establish differentiated criminal law intervention standards tailored to varying risk levels, thereby achieving an organic integration of risk-classified supervision and scenario-based governance. Concurrently, through interpretation and amendment of existing offenses, both direct and indirect regulations governing the infringement of biometric information should be implemented. This approach enables a balanced integration of personal information protection, national public governance demands, and the state's duty to protect personal data within a risk-sensitive framework. It seeks to harmonize the restraining of criminal law with the efficacy of social governance, ultimately providing a pragmatic criminal law framework for the governance of biometric information in a risk-oriented society.