《民法典》强化隐私权和个人信息的民法保护

目录
一、区分、明确个人信息与隐私权的边界
Distinguishing and Clarifying the Boundaries of Personal Information and Privacy Right
二、明确个人信息的范围
Defining the Scope of Personal Information
三、引入个人信息保护要求
Introduction of Personal Information Protection Requirements
四、规定个人信息保护的责任义务及例外情形
Provisions on the Responsibilities on the Protection of Personal Information and Exceptions
五、增加了国家机关及其工作人员保护个人信息的义务
Incorporating the Obligations of State Bodies and their Staff regarding Personal Information Protection
六、其他个人信息和隐私保护条款
Other Personal Information and Privacy Protection Provisions
七、我们的观察
Our Observations
2018年8月，《中华人民共和国民法典（草案）》首次对外公布，并经过第十三届全国人大常委会多次审议，不断的修改、完善。2019年12月，经第十三届全国人大常委会第十五次会议审议，全国人大常委会决定将《中华人民共和国民法典（草案）》提交第十三届全国人民代表大会第三次会议审议。2020年5月28日，第十三届全国人大三次会议表决通过《中华人民共和国民法典》（简称“《民法典》”），其中人格权独立成编，成为亮点之一 （简称“《民法典人格权编》”）。《民法典人格权编》以专章八个条款，对隐私权和个人信息保护的定义范围、个人信息保护要求、责任主体和相对自然人的权利义务进行规定，将于2021年1月1日起实施。
In August 2018, the Civil Code of the People's Republic of China (Draft) (“Draft Civil Code”) was released for the first time to the public and has been continuously revised and improved after numerous deliberations by the Standing Committee of the Thirteenth National People's Congress. In December 2019, the Standing Committee of the Thirteenth National People's Congress decided to submit the Draft Civil Code to the third session of the Thirteenth National People's Congress for deliberation, and ultimately the latest version of the Draft Civil Code was officially adopted on May 28, 2020 (“Civil Code”). According to the Civil Code, rules and regulations regarding personality rights were independently codified as one of the highlights (“Chapter of Personality Rights”). As a special section of the Chapter of Personality Rights, there are eight articles stipulating in detail the definition and the scope of privacy and personal information protection, the requirements for personal information protection, the rights and obligations of responsible subjects and opposite natural persons. The Civil Code will be implemented on January 1, 2021.
一、区分、明确个人信息与隐私权的边界
Distinguishing and Clarifying the Boundaries of Personal Information and Privacy Right
在《民法典人格权编》生效之前，《民法总则》第110条明确自然人享有隐私权，第111条明确规定个人信息受法律保护，但《民法总则》并未对“个人信息”、“隐私”作出定义。《民法典人格权编》在现行法律规定的基础上，首次对“隐私”的定义作出了规定，进一步明确了个人信息与隐私权的边界和范围。
Before the Chapter of Personality Rights takes effect, Article 110 of the General Rules of Civil Law makes it clear that natural persons have the right of privacy and Article 111 prescribes that personal information is protected by law, but the General Rules of Civil Law do not define “personal information” or “privacy”. The Civil Code defines “privacy” on the basis of the existing legal provisions for the first time and further clarifies the boundaries and scope of personal information and right of privacy.
《民法典人格权编》第1032条基本采纳了目前关于隐私权界定的通说，规定“隐私是自然人的私人生活安宁和不愿为他人知晓的私密空间、私密活动、私密信息”，第1034条明确：“个人信息中的私密信息，适用有关隐私权的规定；没有规定的，适用有关个人信息保护的规定”。
Article 1032 of the Chapter of Personality Rights basically adopts the current general definition of the right of privacy, and stipulates that privacy is the peace of a private life of natural persons and private space, private activities and private information that natural persons do not want others to know. Article 1034 makes it clear that the provisions on the rights of privacy shall apply to the private information that belongs to personal information; if there is no corresponding provisions, the provisions on the protection of personal information shall apply.
二、明确个人信息的范围
Defining the Scope of Personal Information
在《民法典人格权编》生效之前，个人信息的定义分别在《电信和互联网用户个人信息保护规定》、《侵害消费者权益行为处罚办法》、《中华人民共和国网络安全法》（简称“《网络安全法》”）等法律法规之中均有规定。相较于《网络安全法》第76条的规定，《民法典人格权编》第1034条在个人信息定义的列举部分增加了“电子邮箱、健康信息、行踪信息”，其规定，“个人信息是以电子或者其他方式记录的能够单独或者与其他信息结合识别特定自然人的各种信息，包括自然人的姓名、出生日期、身份证件号码、生物识别信息、住址、电话号码、电子邮箱、健康信息、行踪信息等。”在《民法典人格权编》草案三审稿审议的过程中，部分委员建议应当区分一般信息和敏感信息、对可能影响人身财产安全的个人隐私敏感信息的内涵和范围适度扩大 ，但《民法典人格权编》最终并没有在草案三审稿的基础上进一步区分一般信息和个人敏感信息。这也可能留待《民法典》生效后在民事司法实践之中的进一步解释和应用。
Prior to the promulgation of the Chapter of Personality Rights, the definition of personal information is stipulated in the Regulations on the Protection of Personal Information of Telecommunications and Internet Users, the Measures on the Punishment of Acts that Violate the Rights and Interests of Consumers, and the Cybersecurity Law of the People's Republic of China (“Cybersecurity Law”), respectively. In contrast to the provisions of Article 76 of the Cybersecurity Law, Article 1034 of the Chapter of Personality Rights adds the “e-mail, health information and whereabouts information” to the enumeration of the definition of personal information, which states that "personal information is all kinds of information recorded electronically or otherwise that can identify a particular natural person, either alone or in combination with other information, including the natural person's name, date of birth, identity document number, biometric information, address, telephone number, e-mail, health information, whereabouts information, etc."
In the course of deliberations on the third draft of the Chapter of Personality Rights, some committee members suggested that a distinction should be made between general information and sensitive information, and that the content and scope of sensitive information of personal privacy that may affect the security and property of people should be appropriately expanded, but the Chapter of Personality Rights ultimately does not further distinguish between general information and personal sensitive information on the basis of the third draft. This may be left to be further interpreted and applied in civil judicial practice after the Civil Code takes effect.
三、引入个人信息保护要求
Introduction of Personal Information Protection Requirements
《民法典人格权编》第1035条重申了合法、正当、必要的原则并规定了处理个人信息的具体要求：（1）征得自然人或监护人同意，但是法律、行政法规另有规定的除外；（2）公开处理信息的规则；（3）明示处理目的、方式和范围；（4）不违反法律、行政法规的规定和双方的约定。
Article 1035 of the Chapter of Personality Rights reaffirms the principles of legality, legitimacy and necessity and stipulates specific requirements for the processing of personal information: (1) the consent of the natural person or guardian should be obtained, unless otherwise stipulated by laws and administrative regulations; (2) the need for rules for the public processing of information; (3) the need for statements clearly informing the purpose, method and scope of processing; and (4) not to violate the provisions of laws and administrative regulations and agreements between the parties.
相较于《网络安全法》等以往的法律法规，《民法典人格权编》在获取信息主体同意时，强调了对于未成年人等无民事行为能力人或者限制民事行为能力人的个人信息收集需要征得监护人同意。关于未成年人个人信息保护，《民法典》规定不满18周岁的自然人为未成年人，属于无民事行为能力人或限制行为能力人[1]。处理未成年人个人信息的，应获得监护人同意。而《儿童个人信息网络保护规定》规定收集、使用不满14周岁的未成年人个人信息的，应当征得儿童监护人的同意。关于处理已满14周岁但未满18周岁未成年人的个人信息是否需要取得监护人同意，需要在实践中进一步明确。并且，该条还适用于其他无民事行为能力或限制行为能力人的情形，如处理辨别能力不足的老年人的个人信息等，具体如何实施也需要明确。
Compared to previous laws and regulations such as Cybersecurity Law, the Chapter of Personality Rights emphasizes the need to obtain the consent of a guardian for the collection of personal information of persons without civil capacity, such as minors, or persons with limited civil capacity. With regard to the protection of the personal information of minors, the Civil Code defines natural persons under the age of 18 as minors and persons with no civil capacity or limited civil capacity. The consent of a guardian shall be obtained for the processing of the personal information of minors. The Provisions on the Cyber Protection of Children's Personal Information stipulates that the collection and use of the personal information of a child under the age of 14 shall be subject to the consent of the child's guardian. Whether it is required to obtain consent from the guardian for processing personal information of minors over 14 years old needs further clarification in practice. Moreover, Article 1035 also applies to the handling of the personal information of other persons with no or limited civil capacity such as elderly persons with inadequate capacity to discern and understand, and this remains to be clarified in practice.
此外，《民法典人格权编》删除了个人信息收集的概念，而将收集视为个人信息处理的一部分，规定“个人信息处理包括个人信息的收集、存储、使用、加工、传输、提供、公开等”。相较于《民法典人格权编》草案三审稿，该条额外强调了“不得过度处理”个人信息。
In addition, the Chapter of Personality Rights removes the concept of the collection of personal information and treats collection as part of personal information processing, stating that "personal information processing includes the collection, storage, use, processing, transmission, provision and disclosure of personal information". This Article places additional emphasis on the “non-disproportionate handling” of personal information as compared to the third draft of the Chapter of Personality Rights.
《民法典人格权编》第1037条明确了自然人对其个人信息所享有的权利。除《网络安全法》明确的更正权、删除权之外，《民法典人格权编》进一步规定了自然人可以依法查阅或者复制其个人信息的权利。根据《信息安全技术个人信息安全规范》规定，个人信息主体可向个人信息控制者请求实现个人信息主体的权利，委托处理者、相关个人信息接收方协助个人信息控制者响应个人信息权利的请求[2]。而《民法典人格权编》第1037条则规定自然人有权向信息处理者依法行使其个人信息主体权利，则似乎是意味着自然人有权向收集、存储、使用、加工其个人信息的各方主体请求行使个人信息主体权利。这一点还待在实践之中明确。
Article 1037 of the Chapter of Personality Rights clarifies and specifies the rights of natural persons on their personal information. In addition to the rights of correction and deletion explicitly provided in the Cybersecurity Law, the Chapter of Personality Rights further provides the right of natural persons to access or copy their personal information in accordance with the law. According to the Information Security Technology - Personal Information Security Specification, when the subject of a personal information requests the personal information controller to realize the rights of the subject of the personal information, the entrusted processor and the relevant personal information recipient shall assist the personal information controller to respond to the request for the rights of personal information. Article 1037 of the Chapter of Personality Rights, on the other hand, provides that natural persons have the right to exercise their personal information subject rights in accordance with the law to the information processor, which seems to imply that natural persons have the right to request the exercise of personal information subject rights from all the parties that collect, store, use and process their personal information. This remains to be clarified in practice.
四、规定个人信息保护的责任义务及例外情形
Provisions on the Responsibilities on the Protection of Personal Information and Exceptions
《民法典人格权编》第1036条首次明确规定了行为人处理个人信息不承担民事责任的三种情形：（1）在自然人或者其监护人同意的合理范围内；（2）合理处理该自然人自行公开的或者其他已经合法公开的信息，但是该自然人明确拒绝或者处理该信息侵害其重大利益的除外；（3）为了维护公共利益或者该自然人合法权益，合理实施的其他行为。
Article 1036 of the Chapter of Personality Rights clearly stipulates for the first time three situations in which the protagonist does not bear civil liability for handling the personal information: (1) within the reasonable limits of the consent of the natural person or their guardian; (2) in a case whereby the reasonable handling of information has been made public or lawfully made public, unless the natural person expressly refuses or the handling of such information infringes on their vital interests; and (3) other acts reasonably carried out in order to safeguard the public interests or the legitimate interests of the natural person.
《民法典人格权编》第1038条规定，信息处理者不得泄露或者篡改其收集、存储的个人信息；未经自然人同意，不得向他人非法提供个人信息，但是经过加工无法识别特定个人且不能复原的除外。
Article 1038 of the Chapter of Personality Rights stipulates that information processors shall not divulge or falsify the collected or stored personal information; illegally provide personal information to others without the consent of the natural person, except for the information that has been processed and cannot be recovered and through which no particular individual may be identified.
另外，《民法典》第999条也规定，为公共利益实施新闻报道、舆论监督等行为的，可以合理使用民事主体的姓名、名称、肖像、个人信息等；使用不合理侵害民事主体人格权的，应当依法承担民事责任。
In addition, Article 999 of the Civil Code also stipulates that the name, title, image and personal information of a civil subject may be used reasonably for the purpose of public interest, such as news reporting and public opinion monitoring; if the use unreasonably infringes on the personality rights of a civil subject, the civil liability shall be borne in accordance with the law.
五、增加了国家机关及其工作人员保护个人信息的义务
Incorporating the Obligations of State Bodies and their Staff regarding Personal Information Protection
《民法典人格权编》第1039条明确规定国家机关、承担行政职能的法定机构及其工作人员对于履行职责过程中知悉的自然人的隐私和个人信息，应当予以保密, 不得泄露或者向他人非法提供自然人隐私和个人信息。
Article 1039 of the Chapter of Personality Rights clearly stipulates that State bodies, statutory body with administrative functions and their personnel shall keep the private and personal information of natural persons known to them in the course of their duties confidential and shall not divulge or unlawfully make available to others the private and personal information of natural persons.
在《民法典人格权编》草案三审稿审议过程中，部分委员指出，建议增加关于泄露、篡改、非法提供个人信息以及国家机关及其工作人员泄露或者向他人非法提供自然人隐私和个人信息的责任条款 ，但《民法典人格权编》最终并未明确非法提供个人信息的相关责任。
During the deliberation of the third draft of the Chapter of Personality Rights, some committee members advised on adding provisions regarding the liability for leakage, falsification, and the unlawful provision of personal information, and the leakage or unlawful provision of privacy and personal information of natural persons to others by State bodies and their staff. The Chapter of Personality Rights did not ultimately specify the liability for the unlawful provision of personal information.
六、其他个人信息和隐私保护条款
Other Personal Information and Privacy Protection Provisions
《民法典》之中也对两类特殊情形下的个人信息保护要求作出了特别规定。
The Civil Code also contains special provisions for the protection of personal information in two special instances.
第一，特别规定了患者隐私和个人信息保护，1226条规定，医疗机构及其医务人员应当对患者的隐私和个人信息保密。泄露患者的隐私和个人信息，或者未经患者同意公开其病历资料的，应当承担侵权责任。
Firstly, a patient’s private and personal information protection are specifically stipulated. Article 1226 states that medical institutions and their personnel shall keep the private and personal information of their patients confidential. If a patient's private and personal information is leaked, or if a patient's medical records are disclosed without their consent, the medical institution or their personnel shall be liable for an infringement.
第二，1030条规定，民事主体与征信机构等信用信息处理者之间的关系，适用《民法典人格权编》有关个人信息保护的规定和其他法律、行政法规的有关规定。
Secondly, Article 1030 stipulates that the relationship between civil subjects and credit information processors such as credit agencies should be subject to the provisions in the Chapter of Personality Rights relating to the protection of personal information and the relevant provisions of other laws and administrative regulations.
七、我们的观察
Our Observations
《民法典》经过多次审议、修改最终定稿，在民法体系下区分、确定了个人信息与隐私权的边界、明确了个人信息的范围，引入了个人信息保护的要求，规定了个人信息保护的责任与义务，并为下一步制定个人信息保护法留下了空间。该等条款在未来的司法实践之中将如何具体运用，在隐私权之外，“个人信息”保护之诉如何成为个人的救济途径，都非常值得关注。
The Civil Code has been finalized after numerous reviews and amendments. It defines the boundaries between personal information and right of privacy under the civil law system, clarifies the scope of personal information, introduces requirements on personal information protection and stipulates the responsibilities and obligations around personal information protection. It also leaves room for the further formulation of personal information protection laws. How these provisions will be applied in future judicial practice and how “personal information” protection claims will become a remedy for individuals in addition to the right to privacy are of great concern and remain to be seen in practice.
注：
1.《民法典》第17、18、19、20条
2.GB/T 35273—2020 《信息安全技术个人信息安全规范》第8、9.1、9.2条