【线上云德】疫情期间律师说（二十三）|疫情防控期间， 与你聊一聊个人信息安全的那些事儿

2020 年新冠疫情爆发至今已经超过一月有余，全国各地的政府机关、医疗单位、街道社区、村镇和全体国民齐心协力共同抗击疫情，在抗击疫情过程中采取了各种各样行之有效的措施；其中，各基层工作人员协助政府部门收集、统计、使用有关人员的个人信息在这其中就发挥了重要作用。然而，随着大量的个人信息被收集、使用，却发生了严重的泄密事件，全国范围内，警方查处的涉疫情个人信息泄漏案件也已有多起。今天就随着本律师一起来看看疫情期间，应该如何确保个人信息安全。

It has been more than a month since the outbreak of the new crown epidemic in 2020. Government agencies, medical units, street communities, villages and towns and all citizens across the country have made concerted efforts to fight the epidemic and have taken various effective measures in the process of fighting the epidemic. Among them, all grass-roots staff have played an important role in assisting government departments to collect, count and use personal information of relevant personnel. However, with the collection and use of a large amount of personal information, there have been serious leaks. Across the country, the police have investigated and dealt with many cases of personal information leakage involving the epidemic. Today, please come with me to see how to ensure personal information security during the epidemic.

01.什么属于公民个人信息？

公民个人信息是指以电子或者其他方式记录的能够单独或者与其他信息结合识别特定自然人身份或者反映特定自然人活动情况的各种信息，包括姓名、身份证件号码、通信通讯联系方式、住址、账号密码、财产状况、行踪轨迹等。

Personal information of citizens refers to all kinds of information recorded electronically or in other ways that can identify the identity of a specific natural person or reflect the activities of a specific natural person alone or in combination with other information, including name, identity number, communication contact information, address, account number password, property status, whereabouts track, etc.

02.个人信息的泄露的原因和危害？

个人信息泄漏的原因一是得益于网络信息技术和网络共享技术的发展，导致信息的传播速度异常恐怖，一旦被泄露出去，那么很难进行消除。根据公开信息，2011年至今，已有11.27亿用户隐私信息被泄露。

One of the reasons for personal information leakage is that thanks to the development of network information technology and network sharing technology, the speed of information dissemination is extremely horrible. Once leaked out, it is difficult to eliminate it. According to public information, 1.127 billion users' private information has been leaked since 2011.

二是在市场经济和信息社会条件下，公民个人信息已成为一种重要的市场资源，也就是说，有市场的刚性需求。这种需求无非是商家的商业活动和不法分子实施的“下游”违法犯罪活动。

Second, under the conditions of market economy and information society, citizens' personal information has become an important market resource, that is to say, there is a rigid demand of the market. This kind of demand is nothing more than the commercial activities of merchants and the "downstream" illegal and criminal activities carried out by criminals.

显而易见的危害是垃圾短信源源不断、骚扰电话接二连三、垃圾邮件铺天盖地、各种坑蒙拐骗也在不断趁虚而入、账户存款不翼而飞等。个人信息泄露还可能给他们人身和财产安全带来危险，引发人身伤害和财产损失的风险；此外大范围的人员信息泄露可能引发公众的恐慌和政府信任的减损，是对于公共安全的严重威胁。

The obvious hazards are the continuous flow of spam messages, the continuous flow of harassing phone calls, the overwhelming flow of spam, the continuous entry of various kinds of tricks, and the disappearance of account deposits. The disclosure of personal information may also bring danger to their personal and property safety, causing risks of personal injury and property losses. In addition, a wide range of personnel information disclosure may cause public panic and the loss of government trust, which is a serious threat to public safety.

03.私自泄漏公民个人信息，会受到哪些法律惩罚呢？

根据《网络安全法》第 64 条“网络运营者、网络产品或者服务的提供者违反本法第二十二条第三款、第四十一条至第四十三条规定，侵害个人信息依法得到保护的权利的，由有关主管部门责令改正，可以根据情节单处或者并处警告、没收违法所得、处违法所得一倍以上十倍以下罚款，没有违法所得的，处一百万元以下罚款，对直接负责的主管人员和其他直接责任人员处一万元以上十万元以下罚款；情节严重的，并可以责令暂停相关业务、停业整顿、关闭网站、吊销相关业务许可证或者吊销营业执照。违反本法第四十四条规定，窃取或者以其他非法方式获取、非法出售或者非法向他人提供个人信息，尚不构成犯罪的，由公安机关没收违法所得，并处违法所得一倍以上十倍以下罚款，没有违法所得的，处一百万元以下罚款。”

According to Article 64 of the Cyber Security Law, "Network operators and providers of network products or services violate the provisions of Paragraph 3 of Article 22 and Articles 41 to 43 of this Law. Infringement of the right of personal information to be protected according to law, The relevant competent department shall order it to make corrections, and may, according to the circumstances, impose a single or combined warning, confiscate the illegal income, impose a fine of not less than one time but not more than ten times the illegal income, impose a fine of not more than one million yuan if there is no illegal income, and impose a fine of not less than 10,000 yuan but not more than 100,000 yuan on the directly responsible person in charge and other directly responsible personnel. If the circumstances are serious, it may be ordered to suspend relevant businesses, suspend business for rectification, close websites, revoke relevant business licenses or revoke business licenses. Whoever, in violation of the provisions of Article 44 of this Law, steals or obtains, illegally sells or illegally provides personal information to others by other illegal means, which does not constitute a crime, shall have his illegal income confiscated and shall also be fined not less than one time but not more than ten times his illegal income. If there is no illegal income, he shall be fined not more than one million yuan. "

《传染病防治法》第 68、69 条规定，“如果疾病预防控制机构或者医疗机构故意泄露传染病病人、病原携带者、疑似传染病病人、密切接触者涉及个人隐私的有关信息、资料，由县级以上人民政府卫生行政部门责令限期改正，通报批评，给予警告；对负有责任的主管人员和其他直接责任人员，依法给予降级、撤职、开除的处分，并可以依法吊销有关责任人员的执业证书；构成犯罪的，依法追究刑事责任”。

Articles 68 and 69 of the Law on the Prevention and Control of Infectious Diseases stipulate that "if disease prevention and control institutions or medical institutions intentionally disclose relevant information and materials concerning personal privacy of infectious disease patients, pathogen carriers, suspected infectious disease patients and close contacts, the health administrative department of the people's government at or above the county level shall order it to make corrections within a time limit, informed criticism and give a warning;

《刑法》第二百五十三条之一规定：“违反国家有关规定，向他人出售或者提供公民个人信息，情节严重的，处三年以下有期徒刑或者拘役，并处或者单处罚金；情节特别严重的，处三年以上七年以下有期徒刑，并处罚金。违反国家有关规定，将在履行职责或者提供服务过程中获得的公民个人信息，出售或者提供给他人的，依照前款的规定从重处罚。窃取或者以其他方法非法获取公民个人信息的，依照第一款的规定处罚。单位犯前三款罪的，对单位判处罚金，并对其直接负责的主管人员和其他直接责任人员，依照各该款的规定处罚。”

Article 253-1 of the Criminal Law stipulates: "Whoever, in violation of the relevant provisions of the State, sells or provides personal information of citizens to others, if the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention and shall also, or shall only, be fined; If the circumstances are especially serious, he shall be sentenced to fixed-term imprisonment of not less than three years but not more than seven years and shall also be fined. Whoever, in violation of the relevant provisions of the State, sells or provides personal information of citizens obtained in the course of performing his duties or providing services to others shall be given a heavier punishment in accordance with the provisions of the preceding paragraph. Whoever steals or illegally obtains personal information of citizens by other means shall be punished in accordance with the provisions of the first paragraph. If a unit commits the crimes mentioned in the preceding three paragraphs, it shall be fined, and the persons directly in charge and other persons directly responsible shall be punished in accordance with the provisions of each of these paragraphs. "

律 师 建 议：

鉴于大量个人信息泄密的情况普遍存在，因此，有关机构、部门人员在公开披露个人信息时，应当做好以下措施。

Lawyers suggest that in view of the widespread disclosure of a large number of personal information, the personnel of relevant institutions and departments should take the following measures when publicly disclosing personal information.

1、加强信息保密意识，严格落实有关个人信息保护的法律规定。在收集个人信息时，由组织机构统一登记入册，做好保密工作，不得肆意、非法传播。

Strengthen the awareness of information confidentiality and strictly implement the legal provisions on personal information protection. When collecting personal information, the organization shall register it in a unified way, do a good job of confidentiality, and shall not spread it arbitrarily or illegally.

2、公开披露患者的活动轨迹、报告来源、患者个人状况等信息时，应当对上述信息进行脱敏化处理。

When publicly disclosing the patient's activity track, report source, patient's personal status and other information, the above information shall be desensitized.

3、在对外公示场所，公示管控人数以及病症情况时，不再公布姓名全称、电话、住址等可识别特定自然人的信息。

When publicizing the number of people under control and the disease situation in public places, the full name, telephone number, address and other information that can identify specific natural persons will no longer be published.

互联网不是法外之地，在网络上的行为一定要遵守法律法规，切实做到知法、守法、畏法，不随意散布他人隐私及实施其他违法犯罪行为，不给犯罪分子可乘之机，共同营造和谐清朗的网络环境。对于侵犯公民个人信息等违法犯罪行为，公安机关将依法予以严处。

The Internet is not a place outside the law. Acts on the Internet must abide by laws and regulations. They must be aware of the law, abide by the law and fear the law. They must not spread other people's privacy and commit other illegal and criminal acts at will. They must not give criminals the opportunity to jointly create a harmonious and clear network environment. The public security organs will severely punish illegal and criminal acts such as infringement of citizens' personal information according to law.