WU Tong*

 

Abstract: In criminal procedures, the right to personal information does not conform to the human rights characteristics of criminal procedures centered on due process right, in which the right to be forgotten and the right to access data possess no attributes of independent litigation right. The theory of the independent right to personal information lacks a legitimate basis and should not be used as the protection model for personal information in criminal proceedings. Given the particularity of interest measurement and the individuality and negativity of human rights in criminal procedures, the protection of personal information in the criminal procedure should be aimed at the risk of transformation from collective general information to private sensitive information. Specifically, it is the right of personal information not to be excessively collected. Accordingly, the personal information protection should be included in the scope of criminal procedures by the conceptual interpretation of the informational privacy, i.e., the dependency protection model. In this regard, the criminal proceeding should appropriately introduce the basic principles of personal information protection and the limited general forensic to deal with the impact and challenge of emerging right claim on the criminal justice system.

 

Keywords: personal information · basic rights · Personal Information Protection Law · dependency protection

 

 

In recent years, personal information protection has become one of most controversial legal research topics and one of the most complex problems in judicial practice. On the one hand, all countries in the world, considering the interests of cross-border data flows, have conducted in-depth theoretical and legislative studies on the legal protection of personal information, and the generalization of data legislation and the expansion of extraterritorial application have become prominent,¹ which has also aroused the continuous concern of researchers in China about personal information protection. On the other hand, the issue of personal information protection, which initially emerged in the field of private law, has gradually expanded to various public law fields such as criminal law and administrative law, and personal information protection is increasingly becoming a “field law.”² The Personal Information Protection Law (hereinafter referred to as the Information Protection Law) came into effect on November 1, 2021. Article 1 of the Law clearly stipulates: “This Law is enacted in accordance with the Constitution for the purposes of protecting rights and interests relating to personal information, regulating personal information processing activities, and promoting the reasonable use of personal information.” Therefore, how to construct a legal system framework to protect data rights and promote data flows according to the development trend of personal information protection has become an urgent issue to be addressed in current theoretical research and judicial practice.

 

“China seems to have initially established a multi-level and comprehensive personal information protection system framework that integrates laws and regulations, industry norms and technical standards.”³ However, compared with the private law protection of personal information in the field of civil and commercial law and the restriction on government administration in the field of administrative law, “personal information protection in the fields of criminal justice and law enforcement based on exceptions such as national security and social security has become a weak link in the overall system of personal information protection.”⁴ Although there are differences in the interest nature and value hierarchy between national security and individual rights, criminal justice does not take the protection of national security as the only value pursuit, and the conflict between security and rights is by no means the normal state of justice. From the perspective of the conflict between the public interest of prosecuting crimes and the protection of civil rights, criminal justice should not be excluded when it comes to personal information protection. The legislation of personal information protection in China does not exclude the personal information processing of state organs. Article 33 of the Information Protection Law stipulates: “This Law shall apply to the activities of a State organ to process personal information; where there are special provisions in this Section, such provisions shall apply.” As state organs, public security and judicial organs should naturally follow the basic principles and special rules of the Information Protection Law. How to protect personal information in criminal procedures is the key issue of this paper.

 

Although strengthening the legal protection of personal information has become the consensus in academic circles, fundamental theoretical disputes still exist with regard to criminal procedures, such as what is the basis of rights for personal information protection and how to protect it. This concerns the nature of personal information in criminal procedures and determines the form and degree of personal information protection in criminal procedures. The above controversy can be expressed by raising the following four questions: Can the practical consideration and theoretical significance of distinguishing personal information and privacy in private law be directly applied to criminal justice, which regulates state power? If the right to personal information is introduced into criminal procedure, should it be an independent litigation human right or litigation right? Can personal information be included in the scope of “traditional human rights protection” as an integral part of the right to privacy? How should criminal procedures deal with the claim to protect the “emerging rights” in the context of the information age? To answer these questions, we need to take the particularity of personal information protection in criminal procedures as the premise, the theory of ownership of personal information protection as the basis, and the specific system design as the solution.

 

Focusing on the above issues, the second part of this paper will summarize the elements involved in the balancing of personal information protection interests and the particularity of criminal justice activities, referring to the interest theory of personal information protection in criminal procedures. The third part will summarize the current academic view of personal information as an independent right in criminal procedures, and reflect on the problems of the theory of independent rights, i.e., the ownership theory of personal information protection in criminal procedures. The fourth part will propose a solution for how to protect personal information in criminal procedures in China, referring to the system theory of personal information protection in criminal procedures.

 

 

As a research issue, personal information protection has grown from merely a field in private law to a field concerning both public law and private law. At present, the concept of comprehensive protection or public and private protection put forward by researchers provides answers to the question of how personal information should be protected in the overall legal system, reveals the basis of multiple legal interests of personal information, and has become the reason for establishing an incentive-compatible personal information protection law.⁵ Therefore, we have unavoidable considerations in the balancing of various interests when it comes to personal information protection. However, the complexity of interests cannot overshadow the particularity of personal information protection in different departmental laws. In other words, we should distinguish the personal information protection in special laws and that in departmental laws, and follow the idea of “unified legislation and classified protection.” Concerning personal information protection, both public and private laws deal with the claims and conflicts of interest among different subjects. Therefore, the way we regard the balancing of interests is of great significance when discussing the particularity of personal information protection in criminal procedures.

 

 

The meaning of personal information varies according to the discussion background and context, which determines that there are essential differences in the elements involved in interest balancing and the judgment criteria of personal information in different law departments. In the field of private law, we face two major debates in personal information protection: How to distinguish privacy from personal information and whether personal information is a right or an interest. At present, researchers have basically reached a consensus on the former, i.e., personal information and privacy are compatible but different⁶: “Privacy is the communication between subjects with equal information ability. And personal information protection is the processing of personal information by information processors.”⁷ The debate over the latter continues. Suppose we claim that personal information is a specific personality right. In that case, the right to personal information is a right of autonomous control, which has the dominance and exclusiveness of the specific personality right. In this case, the interest balancing of personal information protection is transformed into an issue of coordination between the interests of personal dignity and freedom enjoyed by the information subject and the interests of freedom of speech of other natural persons, and the economic interests of legal persons or other organizations, and the judgment criteria of interest balancing should also focus on the protection and respect of civil rights.⁸ If we claim that personal information is an interest of general personality rights protected by law, we deny the dominance and exclusiveness of the personal information right. In this case, personal information protection in the field of private law mainly relies on the remedy of tort law. “In other words, as long as the use of personal information does not infringe on the lawful interests of the subject, the use of information controllers has legality.”⁹

 

However, whether it is to distinguish privacy protection from personal information protection or to discuss the legal nature of personal information if it is limited to the field of civil and commercial law, the protection and use of personal information both concern the conflict of interests between equal civil subjects, which cannot be aimed at the subjects with the persistent unequal information-gathering ability¹⁰ or involve the compromise and concession of the interests of civil subjects in the face of higher interests such as national security, prosecution of crimes, and social management. State organs do not directly intervene as the interest subject in the interest balancing between the information subject and the obligation subject, but coordinate the above-mentioned interest conflicts as a neutral third party through legislative norms or judicial guidelines.

 

From the perspective of private law, conflicts in personal information protection happen among equal civil subjects, usually with civil liabilities such as stopping infringement, removing the obstruction, eliminating dangers, and compensating for losses as sanctions and remedies.¹¹ However, personal information contains public management value, which means the state will become the subject of collecting and using personal information. This naturally gives rise to the practical demand for public law to intervene in personal information protection. In public law, the individual value of personal information, such as autonomy of will and equality of subjects, has been narrowed. In contrast, the public value, such as interactivity and sharing, has been magnified, thus forming a theoretical analysis framework of “the right to protect personal information and the obligation of state protection.” In particular, the defensive function of the right to protect personal information corresponds to the negative obligation of the state, i.e., to seriously restrict the scope of collecting and using personal information based on the needs of public interests. The objective law function of the right to protect personal information corresponds to the positive obligation of the state, i.e., the state must create and maintain an institutional environment conducive to the realization of personal information protection.¹² Therefore, when it comes to the balancing of interests in public law, personal information protection is related to public interest. In this case, the state organs may be both the infringer of personal information and the builder of the personal information protection system, and the coordination of the two identities depends on the implementation of the state’s protection obligations. For this reason, Chinese constitutional researchers argue that from the perspective of basic rights, “the legal system of personal information protection is based on the concept of the right to protect personal information as a basic constitutional right.”¹³

 

It can be seen that although personal information protection involves the relationship among the state, enterprises, and individuals, private law protection is only a matter of balancing the interests of equal civil subjects, while public law protection can coordinate the conflict of interests between the right to protect personal information and the obligation of state protection, thus complementing each other. As the nature of behavior and legal adjustment relationships vary, they also show differences in the object and standard of interest balancing. As far as criminal procedure is concerned, how to realize personal information protection under the dual position of public law and procedural law is obviously not directly related to the above-mentioned discussion in the civil and commercial fields, and there are essential differences between the public interest based on the purpose of social management and that based on the purpose of prosecuting crimes, which need to be discussed separately.

 

 

The particularity of personal information protection in criminal procedure should be a “reasonable restriction” rather than “complete exclusion.” On the one hand, criminal justice is also facing the basic contradiction of balancing the protection of personal information and the use of personal information, i.e., the interest balancing of personal information protection. On the other hand, personal information protection by criminal justice also has its particularity, which is mainly manifested in the particularity of interest form and interest choice in the balancing of interests.

 

In traditional theoretical research, interests in criminal procedure are often divided into the interests of the state and society, the overall interests of a certain social aspect, and individual interests. “When conflicts of different interests arise, and they need to be balanced, choices should be made based on whether the result of the balancing is beneficial to the fundamental interests of the state and society.”¹⁴ However, only when interests of different nature are juxtaposed can the basic premise of choice be met, and the above classification and balancing criteria only reflect the hierarchy between different interests in criminal procedures, rather than the choice of interests. In this regard, some researchers have put forward the division of the interests of the state and society, the interests of criminal suspects and defendants, and the interests of victims, and pointed out that legislators do not always completely protect one interest and give up the other interest when making choices, but appropriately suppress the two opposing interests to achieve a dynamic balance of selective interests.¹⁵

 

On the issue of personal information protection, in the past, many countries’ personal information protection laws excluded national security as a common exception to ensure that the activities of law enforcement agencies were not interfered with and influenced by non-relevant parties.¹⁶ However, as personal information becomes more relevant to citizens’ lives, national security or the need to prosecute crimes may not be absolutely superior to the interests of personal information protection. For example, the mosaic theory, which has been frequently quoted in criminal judgments in recent years in many countries, holds: “Personal information is like a mosaic puzzle, which at first glance looks trivial and insignificant, can help piece together a broad,comprehensive image. Individuals may not subjectively feel that their privacy has been infringed when a small piece of their information is collected. However, the continuous collection will still cause serious harm to their privacy.”¹⁷ The boundaries between personal information and privacy are increasingly obscure in criminal justice. Meanwhile, it is urgent and important to realize public interest by prosecuting crimes, which means personal information protection in criminal procedures is different from that indiffers from civil and commercial law or administrative law. Therefore, the particularity of personal information protection in the criminal procedure requires a transformation from the exceptional “complete exclusion” to the gradual “reasonable restriction.”

 

First, when it comes to the subject of personal information protection, we should distinguish between criminal suspects, defendants, and other participants in the proceedings. From the perspective of power relations, although criminal suspects, defendants, and other participants in the proceedings have an obligation to cooperate with criminal justice organs, the manifestations of their obligations are not the same. The cooperation obligation of criminal suspects and defendants lies in the fact that criminal justice organs can restrict their basic rights based on legitimate purposes. In this case, criminal suspects, defendants, and criminal justice organs present the relationship of “rights derogation.” “The relationship between other participants in the proceedings and the criminal justice organs is either manifested as a principal-agent relationship, i.e., all the powers of the state to prosecute crimes come from the contract or entrustment between citizens and the government,”¹⁸ or as the obligation of citizens to assist the state and the right of immunity, such as the obligation and immunity of witnesses in criminal procedures. Therefore, when the personal information interests of other participants in the proceedings are in conflict with public interests, such as when the victim should truthfully state the facts of the case to the public security and judicial organs, and accept personal examination by these organs; or when an open trial or the act of testifying in court discloses the personal information of the witness and the victims, exposing them to the risk of “secondary harm,” it is not “necessary” for criminal justice organs to collect and publish personal information of other participants in the proceedings beyond the purpose of “requiring cooperation.”

 

Second, the protection of personal information of criminal suspects and defendants in the criminal procedure has two attributes: Basic rights and public interests. In the interest balancing in criminal procedures, public interest and basic rights become the typical objects. Therefore, the protection of personal information of criminal suspects and defendants in criminal procedures means that when criminal justice organs collect personal information for the purpose of prosecuting crimes, the legitimacy of their actions depends on whether the results of balancing public interests and basic rights are appropriate and whether the implementation process of the actions is legitimate, i.e., the appropriateness of the results and the legitimacy of the process. Specifically, the rights enjoyed by criminal suspects and defendants in the criminal procedure are divided into the rights stipulated by the Constitution and the rights based on the right of defense and prosecution. The former and the public interest are heterogeneous so it is impossible to draw a conclusion on whether the interest balancing is appropriate or not simply from the results, and the criminal justice organs should fulfill the negative obligation for the negative rights. The latter exists to maintain the legal order and due process promised by the state and is necessary for fulfilling social tasks and realizing public values.¹⁹ These rights and the public interest are homogenous, so they can be balanced. The public interest derived from the purpose of criminal prosecution is superior, and the criminal justice organs should provide the necessary procedural protection for the positive right.²⁰

 

Finally, the interest balancing of personal information protection in criminal procedures mediates the conflict between national public power employed for the purpose of prosecuting crimes and the personal interests of the parties involved in criminal procedures. Therefore, on the one hand, if investigators are collecting personal information for the purpose of crime prevention or social management, such as by means of large-scale public video surveillance, registering and storing personal information in the police system, managing police information, and taking predictive police actions, these activities should not be regulated by the law on criminal procedure but through the administrative law. Criminal justice organs mainly collect and use the above-mentioned personal information for a second time by “accessing” it. Therefore, the focus of regulation is on the action of “secondary collection and use,” rather than the action of collection and storage for administrative purposes. On the other hand, the improper disclosure of a large amount of personal information due to loopholes in the information management system of criminal justice organs concerns not only the protection of personal information in criminal procedures, but the administrative responsibility of criminal justice organs for personal information protection.

 

It can be seen that as personal information protection makes its way to public law, the rules for interest balancing between equal civil subjects cannot be directly applied to government administrative law enforcement. In private law, the connotation of the right to personal information is restricted to “the right to protect personal information.” On the one hand, the state organs bear the negative obligation of non-infringement, so the subjective aspect of the right to protect personal information often competes and interacts with the constitutional right to privacy and communication secrets;²¹ on the other hand, they bear the positive obligation of building an environment conducive to the protection of personal information. However, this distinction is further restricted in the field of criminal procedures. First, a criminal procedure is an activity to solve the criminal responsibility of suspects and defendants in accordance with legal procedures,²² and the objective legal order constructed by the basic rights in criminal procedures can only be embodied in the criminal procedure. Therefore, the criminal procedure can neither regulate the “quasi-data power” of commercial organizations nor restrict the “public data power” of the subjects performing public functions.²³ In academic circles, public surveillance and face recognition are topics for police administration rather than criminal investigation. Second, even in criminal procedures, the personal information interests of criminal suspects and defendants are only manifested as simple sensitive information and indirect sensitive information formed by the collection of non-sensitive information.

 

 

The particularity of personal information protection in criminal procedures can only lead to the idea that “the protection of personal information in criminal justice should move from complete exclusion to reasonable restriction.” However, in the above discussion, the author does not distinguish between personal information and privacy but uses personal information as a substitute for both to discuss the particularity of protecting personal information (privacy) in criminal procedures. To further demonstrate how to protect personal information in criminal procedures, it is also necessary to investigate the classification of the right to personal information in criminal procedures.

 

 

How to introduce the concept of personal information protection into the specific criminal procedures system depends on clarifying the ownership of personal information. In other words, we have to make it clear what kind of right the right to personal information is and who owns this right.²⁴ The independent rights theory of personal information protection is particularly worth our attention on this issue.

 

At present, there are three main arguments about the independence of the right to personal information in the field of criminal procedure: Firstly, due to the limitations of the object of protection, the negativity of the way of protection, and the ambiguity of the boundary of protection, it is necessary to establish the basic rights attribute of the right to personal information to make up for the defects of the protection of privacy.²⁵ According to this view, the right to personal information is independent due to the unavoidable loopholes in the protection of privacy. Second, the right to personal information should be a basic right not enumerated in the Constitution, which is a common practice in non-regional countries, and also can be deduced from the human dignity, privacy, and freedom of communication, and the right not to be illegally searched in our Constitution. Therefore, the right to personal information is an independent human right in criminal procedures.²⁶ Third, the right to personal information in criminal procedures and the personal rights in criminal procedures share a high degree of similarity in the structure of rights. The right to personal information includes the entire concept attributes of the personal rights to criminal procedures. The right of personal information can be put into the third level of litigation rights carrying other personal interests of citizens.²⁷ This view classifies personal information rights as a litigation right mainly from the aspects of the right structure and right attributes.²⁸

 

In the information age, it is evident that citizens strongly demand the protection of personal information. However, in criminal procedures, whether the demand for rights will inevitably be transformed into emerging rights remains to be further discussed. In terms of jurisprudence, emerging rights cannot be directly derived from the demand for rights. Otherwise, it will inevitably lead to the generalization of rights with negative impacts. The reason why an emerging right can be justified needs to be discussed independently based on the internal reasons and external right theories.²⁹ Moreover, “the concept of human rights is the product of abstraction of the essence of human beings in economic, cultural and political activities created in the process of social development.”³⁰ The theory of criminal procedure alone cannot justify the human rights attribute of personal information rights. Therefore, to justify that the right to personal information is an independent right theoretically, we need to answer at least the following two questions: First, is the right to personal information an independent basic right or independent litigation right? Secondly, is there a fundamental difference between the right to personal information and the right to privacy? This paper argues that the first two views are not sufficient to demonstrate that the right to personal information is a basic right, while the view that it should be regarded as a third-level litigation right can neither prevent the improper interference of public power on the right nor justify the independence of such rights as the right to be forgotten and the right to access data.

 

 

From the perspective of civil and commercial law, the right to personal information has the positive power based on informed consent, such as the right to know, consent, access, portability, and use of income, and the negative power represented by the right to delete, such as the rights to rectify, restrict, oppose, and to be forgotten.³¹ These subsidiary rights make the right to personal information a comprehensive right different from the right to privacy. However, the rationality of the above-mentioned private law rights cannot directly become the legitimate basis of human rights in criminal procedures.

 

“Human rights is a de jure idea, an institutional fact, and real social relationships.”³² If we want to claim that the right to personal information is a human right in criminal procedures, we should first demonstrate its status as a basic right in the Constitution. Some legal researchers believe that the way of information existence, the data and information environment for rights development, and the social disintegration of the information age jointly promote digital human rights to become the fourth generation of human rights.³³ However, this view also faces the question that digital human rights do not meet the “human dignity” and “minimum basic” standards.³⁴ Whether the concept of digital human rights is established or not is still controversial, and therefore it is difficult to directly use it as a basis for discussion to prove the human rights attribute of the right to information in criminal procedures. Even from the empirical observation of comparative law, the view that European countries establish the right to personal information as a human right in criminal procedures is still open to question. Although European countries have raised the protection of personal information to the level of basic rights or human rights protection, according to the Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data of the Council of Europe, it is not about a comprehensive and absolute right to control personal information, but a “right to control and process the data,” i.e., the right to protection of personal data. In this regard, Professor Gao Fuping has emphasized: “When studying and drawing lessons from the European personal data protection system, we must respect a basic fact, which is the right to protection of personal information must be restricted by other basic rights. It must be exercised within a framework in which other fundamental rights are fully guaranteed. The right to personal data protection is essentially embodied in a set of broad principles and detailed codes of conduct.”³⁵ This is fundamentally different from the concept of human rights in criminal procedures.

 

In fact, basic constitutional rights and human rights are not entirely consistent concepts in criminal procedures. Although human rights in the criminal procedure are derived from the provisions of the basic rights in the Constitution, there are still differences between the object and specific scope of human rights protection and the basic rights. Firstly, human rights in the criminal procedure should be negative rather than positive.³⁶ In criminal procedures, the reason why the protection of human rights and the control of crime can become the same level of value pursuit lies in the minimum and universality of human rights. The above two attributes determine that human rights have the same meaning and status in any country, any type of case, and any stage of criminal procedure, so as to effectively play its negative role in resisting state power. Therefore, the positive power of personal information based on informed consent cannot be compatible with the negativity of human rights in criminal procedures. Second, criminal suspects and defendants enjoy human rights, especially the right to due process. Constitutional human rights generally have three forms: Substantive rights, procedural rights, and compound rights.³⁷ In criminal procedures, substantive rights should be expressed as the rights of life, freedom, property, and privacy that cannot be arbitrarily violated by state organs, i.e., the rights to due process. Therefore, a citizen who has been convicted or wrongly convicted is not a criminal suspect or defendant in criminal procedure, and the right to be forgotten and the right to rectification advocated by the criminal justice organs are not human rights in criminal procedure even if they are negative. If we examine the right to personal information from the concept of human rights in the criminal procedure, only the negative rights of criminal suspects and defendants can be protected as human rights, but it is difficult to completely separate the right to personal information from the right to privacy in terms of negative human rights, which leads to the fact that even if there are some human right attributes of criminal procedures in the right of personal information, it does not have the status independent of privacy.

 

 

According to the independent rights theory, it is not reasonable to claim that the right to personal information belongs to the human rights in criminal procedures from the content and nature of the right. In light of this view, some researchers demonstrate its independence by moving the right to personal information down the rights hierarchy. First, the right to personal information is interpreted as a procedural and waivable litigation right, so as to avoid the conflict between the right to personal information and the concept of human rights. Second, according to interest hierarchy analysis, the right to personal information is classified into the third level of rights related to the personality interests of litigation participants except for life, freedom, and health. On the one hand, the right to personal information needs to give way to the first level rights of life, freedom, and health, and is also at a disadvantage in the balancing of public interests; on the other hand, its subject extends from criminal suspects and defendants to all participants in the proceedings. Finally, the necessity of the right to personal information as an independent litigation right lies in the fact that the specific rights it covers have a normative foundation, such as the rights to access data and case files, the right to be forgotten, and sealing criminal records.³⁸ However, the author believes that the right to personal information is difficult to be included in the Criminal Procedure Law with low-level litigation rights.

 

First, there is no corresponding relationship between the right to access data and case files, the right to be forgotten, and the sealing of criminal records. As far as the right to access data is concerned, Article 15 of the EU General Data Protection Regulation (GDPR) states: “The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the information such as the purpose of the processing, the categories of personal data concerned, the envisaged period for which the personal data will be stored, the relevant rights of the data subject, etc.” It can be seen that the right to access data is the right of the data subject to his personal information, which is embodied in the “right to know about activities related to personal information.”However, according to Article 40 of the Criminal Procedure Law, a defense lawyer may consult, extract, and duplicate all the case materials, including the confessions of criminal suspects and defendants, as well as the prosecution evidence collected by investigators. From the perspective of the conceptual attributes of personal information, it is obviously difficult for the prosecution evidence to be classified as the object of the right to access data. Therefore, the idea proposed by advocates, “the right to access data is greater than the right to access case files in the scope and object of application,” is simply not true.³⁹ If we look at the behaviors of accessing electronic or online case files, they do not have independent right attributes. The provisions of the Information Protection Law about data access only focus on “preventing unauthorized access” rather than establishing the access rights of personal information holders.

 

Second, the right to be forgotten is innovative because this right makes it possible for the information that has been made public to be withdrawn and put back into the privacy domain.⁴⁰ The right to be forgotten in its nature is not a value orientation. It plays a role in interest balancing and conflict resolution through the introduction of the interest claim “to be forgotten.” In criminal procedures, the subjects of the right to be forgotten include the convicted person, the victim, the innocent person, the witness, and other participants in the proceedings, and the object is the news media and criminal justice organs.⁴¹ However, it is difficult to use the claim for the interest of the above subjects to justify the right to be forgotten in criminal procedures. For the victim, the witnesses, and other participants in the proceedings, what they enjoy is not the right to be forgotten for the information that has been made public, but the right to give informed consent or apply for non-disclosure before the information is made public. The innocent person can apply for deleting the information of wrongful conviction, not the information disclosed by consent, so the information supposed to be deleted is not the object of interest balancing of the right to be forgotten. Although it is a right to be forgotten for a convicted person to request the news media to delete relevant information, the news media is not a criminal justice organ, and this right naturally does not belong to the right to be forgotten in criminal procedures. When the convicted person applies to the criminal justice organ for deleting the relevant conviction information, that person is looking for the expected interests of the information subject returning to society and the public interests based on social management. In this case, criminal justice organs store or disclose criminal records not for prosecuting crimes, but for social management purposes such as realizing the public right to know and crime prevention. Therefore, the right to be forgotten does not have the attributes of an independent right in the criminal procedure.

 

More important, the third level of rights cannot highlight the interest claim of the information subject. In the process of balancing different interests, the right to personal information at a lower level of the hierarchy is often excessively restricted by public interests. However, as mentioned above, in criminal procedures, only when the protection of personal information has the attribute of public interest can we balance homogeneous interests. When personal information is protected as a right, the personal interests it carries and the national and social interests of prosecuting crimes are two heterogeneous kinds of interests on the same level, and the legitimacy of interest balancing lies in whether the procedure is legitimate rather than whether the result is appropriate.

 

 

For personal information with values of both private interest and public circulation, public law plays an irreplaceable role in building orderly circulation of personal information to balance commercial value and private interest, and establishing a power protection model based on the right to protect personal information and the obligation of state protection. Whether the criminal procedure, as department law with public law attributes and procedural law to ensure the accurate implementation of substantive law and maintain procedural justice, should also actively adapt to the theoretical trend of comprehensive and basic protection of personal information has naturally become a theoretical issue worthy of discussion. Public security and justice organs can achieve the purpose of relieving victims and deterring potential criminal acts to protect personal information by prosecuting crimes related to the infringement of citizens’ personal information. Meanwhile, the practical needs of collecting, analyzing, and disclosing personal information also exist in criminal prosecution. In this case, the public security and justice organs with public power are against the subject of personal information with personal information interests, and naturally, the state organs will pose a risk if they take the prosecution of crimes as their responsibility and transform into the subject of infringement of personal information interests. It should be noted that when the public security and justice organs go beyond the reasonable scope of the duty of cooperation, the identities of victims, witnesses, and other participants in the proceedings have changed substantially. They have become the objects of public power intervention and enjoy the same protection as criminal suspects and defendants do. 

The interest theory of personal information shows that it is necessary to protect personal information in criminal procedures, but unlike the case in civil and commercial fields and administrative law enforcement, such protection should be restricted by the interests of prosecuting crimes. The ownership theory of personal information shows that the right to personal information does not have the attributes of human rights in criminal procedures, and resorting to low-level litigation rights cannot justify its independence as a litigation right. The question then is how to deal with the challenges brought by personal information protection in criminal procedures.

 

 

In criminal procedure, the right to personal information should protect the information subject and prevent the excessive collection of information. Personal information is generally divided into sensitive information and general information. The former is usually considered to constitute personal privacy, while the latter refers to information that does not constitute privacy. Therefore, only from the perspective of information content, the conceptual denotation of personal information is greater than that of privacy information. In criminal procedures, the right to privacy as a basic constitutional right is usually converted into a human right that is “free from arbitrary search and seizure” and therefore real-time monitoring such as communication monitoring should be regulated under the principle of due process. Therefore, the privacy of information is supposed to be protected as privacy in criminal procedures and there is no impact from an emerging idea.

 

However, with the updating and iteration of data collection and analysis technology, the boundaries between general information and sensitive information are becoming increasingly obscure. Criminal justice organs can often obtain sensitive information related to the privacy of criminal suspects and defendants by collecting a large number of general information of the same or different types. In this case, the importance of the right to personal information should be highlighted. How to regulate the long-term and extensive collection of non-private information has become a difficult problem in the field of traditional privacy. Meanwhile, the automatic analysis of different kinds of personal information by criminal justice organs through algorithms also poses the risk of confusing the boundaries between administrative law enforcement and criminal investigation. Therefore, this paper argues that the essence of the right to personal information in criminal procedures is to ensure the right of the information subject to be protected against excessive information collection.

 

Non-regional countries also protect personal information on this basis. In the 2018 Carpenter v. United States case, for example, the US Supreme Court of the United States pointed out that the historical information of mobile phone base stations is different from conventional third-party business information such as bank accounts and mobile phone numbers, and has the attributes of concealment, continuity, and traceability. Therefore, the Fourth Amendment of the Federal Constitution should also be extended to protect mobile phone location information. It is unconstitutional for investigators to collect mobile phone base station information without a search warrant.⁴² In the Carpenter case, investigators collected information from 12,898 mobile phone base stations associated with the suspect from a third-party organization. According to the traditional investigation theory, third-party information is commercial information, which should be an exception to the right of reasonable expectation of privacy based on third-party standards. But the major opinion in the Carpenter case was that the base station location information records provided an easy way to look into other people’s lives, and the five-year data retention period also gave police access to previously unknown information.⁴³ Therefore, the unknown information that investigators collected by excessively accessing personal information can no longer be regarded as “commercial information”, so the principle of third-party exception is not applicable.

 

There should be certain limitations for the information to be collected by investigators. For example, the Supreme Court of Japan pointed out in the judgment of the a 2017 GPS investigation case: “The implementation of GPS investigation will inevitably come with a continuous and comprehensive exploration of personal activities, which may infringe on the right to privacy. Besides, secretly installing equipment that may cause the above-mentioned infringement on private property is different from the method of visual observation or photography by investigators on public roads and should be considered an investigative act of using public power to intrude into the private field.”⁴⁴ Therefore, Japanese researchers believe that although activities in the public field usually involve the exception of privacy protection in criminal procedures, when investigators continuously and comprehensively collect location information and rely on information analysis to map out “profiles,” there is a risk of infringement on the privacy of citizens. Specifically, we should start from the legislative doctrine of compulsory investigation and through legislation restrict the time and scope of investigators’ collection of location information.⁴⁵

 

Compared with “the right of information not to be excessively collected,” the right of information not to be analyzed is not central to personal information protection in criminal procedures. The reason is that personal information protection in criminal procedures focuses on the possible risk of information abuse and privacy intrusion. In the traditional investigation, it is still possible for investigators to extract private information after case analysis through various kinds of consent investigation such as on-site exploration, survey visits, and background checks. The development of information technology only improves the possibility of the analysis behavior but does not change the nature of the behavior itself. In order to prevent this “compulsory investigation” in the name of “consent investigation,” the Criminal Procedure Law should regulate the excessive collection, rather than the subsequent analysis behavior.

 

In summary, in criminal procedures, the right to personal information is mainly manifested in the right of information not to be excessively collected. The extensive collection of “general information” by criminal justice organs may give certain attributes of private information to the relevant conclusions, thus impacting the criminal procedure rules based on the traditional right to privacy. This impact essentially calls for personal information protection in criminal procedures.

 

 

In modern society, we remain vigilant against “excessive collection” of personal information to prevent the risk of privacy interference behind the large-scale collection of personal information. The impact of the right to personal information on the criminal procedure lies in the conversion of “the actual infringement on the right to privacy” into “the risk of interference with the right to privacy.” But the right of information not to be excessively collected is applied to “the general information,” not the sensitive information protected by traditional privacy. So, the protection of this emerging right involves its path of being included in the Criminal Procedure Law.

 

In an era that respects rights, the emergence of a new right is a solid manifestation of the public awareness of rights. The emergence of a new right means that the claim of rights has changed from an idea of the minority to the consensus of the majority, providing the social basis for legal protection. The path of an emerging right being included in the law reflects the attitude of the law toward civil rights claims. In the practice of the rule of law, according to whether the emerging right can directly and quickly be included in the law, we can divide the paths into two categories: One is the radical path, meaning that the emerging right is directly written into the legal provisions; the other is the gradual path, meaning that the emerging right is included in the rule of law system peacefully and slowly through natural evolution.⁴⁶ As far as criminal procedure is concerned, the radical path usually applies to procedural rights, such as the right to choose the summary procedure, the right to access case files, the right to appeal, etc.. The reason is that most of the above procedural rights are positive rights. The cost of directly introducing them into the Criminal Procedure Law is relatively low. And the positive and negative obligations of the state organs can be maintained in balance. For example, the defendant and the defense lawyer can apply for summary procedure, and the court can conduct a formal review. In terms of application, when the defendant chooses or goes back on the summary procedure, there will be limitations in the scope, conditions, and procedures of application. Therefore, when it comes to positive procedural rights, we can establish their status through legislation and at the same time impose proper restrictions to achieve the dual purpose of “protecting rights” and “preventing abuse of rights.”

 

However, it is difficult for the negative right of information not to be excessively collected to be included in the Criminal Procedure Law through direct legislation. That is because negative rights have the attributes of human rights in the criminal procedure and should be the minimum guarantee enjoyed by criminal suspects and defendants. For such rights, criminal justice organs need to fulfill the negative obligation of not violating these rights arbitrarily and perform the positive obligation of providing relief for the violation of these rights in criminal procedure. In terms of feasibility, the cost of introducing a right into the law is extremely high. From the traditional normative foundation, the right to information privacy is an individual standard right on the three dimensions of space, things, and subject.⁴⁷ Informational privacy protects the right to individual solitude and tranquility concerning space, intimacy and sensitivity concerning things, and the right of control concerning the information subject. The right of personal information not to be excessively collected can be classified into the subject dimension of information privacy and thereby has the human rights status of privacy. Therefore, the negative right can be interpreted as the right to information privacy in the criminal procedure by means of gradual introduction into the law.

 

 

Personal information protection in the criminal procedure should take “the right of information not to be excessively collected” as the object of regulation, and the right to information privacy as the object of protection, so that the excessive collection of general information by public power can be the object of regulation of the Criminal Procedure Law. On this basis, the fundamental principles of the Information Protection Law should be introduced into the criminal procedure appropriately to seriously restrict general evidence collection, which involves too many objects.

 

 

First, the principle of informed consent to be applied in different ways. Article 14 of the Information Protection Law stipulates: “Where the processing of personal information is based on the consent of the individual concerned, such consent shall be given by the individual concerned in a voluntary and explicit manner in the condition of full knowledge. Where laws and administrative regulations provide that the processing of personal information shall be subject to the separate consent or written consent of the individual concerned, such provisions shall prevail. Where the purpose or method of processing personal information or the type of personal information to be processed changes, the consent of the individual concerned shall be obtained again.” Informed consent is one of the preconditions for the collection, storage, use, processing, and disclosure of personal information. As far as the criminal procedure is concerned, the principle of secret investigation and the performance of legal duties or obligations often make criminal justice an exception in applying the principle of informed consent. However, this paper argues that the applicable conditions of the principle of informed consent should be distinguished for different subjects. The first step is to look at “informed” and “consent” separately. In criminal procedure, the right to know is the basic right of criminal suspects and defendants, and the obligation of public security and judicial organs to inform can only be postponed but not exempted in principle unless it involves state secrets and endangers national security. Consent contains the meaning of authorization or waiver of rights. It mainly exists to assist the public security and justice organs in dealing with personal information. Second, in the process of collecting, storing, and using personal information, the informed consent of criminal suspects and defendants varies according to the nature of the acts carried out by the investigative organs. When investigators collect personal information through compulsory investigation, due to the high degree of interference in civil rights, they should try their best to obtain the consent of criminal suspects and defendants by informing them so as to transform compulsory investigation into consent investigation. Only when the notification may seriously affect the efficiency of the investigation or violate the principle of investigation secrecy can it be delivered afterward. In terms of personal information disclosure, criminal suspects and defendants should know the content to be disclosed, but whether to obtain their voluntary consent has no decisive impact on judicial transparency. Other participants in the procedure have the right to informed consent about judicial transparency and the content to be disclosed.

 

Secondly, strict examination under the principle of purposiveness. In criminal procedures, the principle of purposiveness is the basic requirement of the principle of proportionality and the guiding ideology of personal information protection inside and outside the criminal procedure. Article 6 of the Information Protection Law stipulates: “The processing of personal information shall be for a definite and reasonable purpose, be directly related to the purpose of processing, and shall be conducted in a way that minimizes the impact on personal rights and interests. The collection of personal information shall be restricted to the minimum scope for achieving the purpose of processing and it is not allowed to excessively collect personal information.” In criminal procedures, dealing with personal information is mainly for the purpose of crime prevention based on national security, the purpose of prosecution of crime, and the purpose of judicial transparency, which are increasingly related to the principle of purposiveness of personal information. Firstly, for the purpose of crime prevention based on national security, criminal justice organs can collect, compare and use personal information in advance. In this case, the correlation between personal information and the purpose of processing should be interpreted in a broader way, but the personal information collected is only for the prevention of crimes threatening national security, not for other purposes. Secondly, for the purpose of the prosecution of crime, criminal justice organs can collect personal information through due process. In this case, personal information is specific, i.e., it is the personal information of criminal suspects. Therefore, criminal justice organs should not collect personal information of unspecified persons for the purpose of crime prevention, and they should be restricted by the condition of “minimum scope.” Finally, when criminal justice deals with personal information for the purpose of judicial transparency, “because judicial transparency is in essence about disclosing the information of specific subjects in a limited time and space, it can neither affect the independent and impartial exercise of judicial power by judges nor expose too much privacy and personal information of the litigants.”⁴⁸ Therefore, when criminal justice organs disclose personal information for the purpose of judicial transparency, they should try their best to protect the personal information of criminal litigants. When deciding whether it is “related” to their purpose, they should adopt more stringent criteria.

 

 

In criminal procedures, personal information protection is mostly manifested in the pre-protection against risks, such as preventing investigators from collecting a large amount of general information through consent investigation to obtain private information. Therefore, in criminal procedures, we should the focus should be on the collection and use of personal information. Ideally, we should restrict the general collection of personal information by investigators and limit the use of personal information by investigators for analysis. However, the reality is that the data analysis and processing behaviors of public security and justice organs are considered internal activities in the forms of case analysis, conference discussion, free evaluation of evidence, and so on. This process of analyzing existing evidence or intelligence is bound to be not disclosed, just like “algorithms.” In fact, even non-regional countries do not regard the process of case analysis as the focus of personal information protection. As far as the criminal procedure is concerned, the focus of personal information protection is on how to restrict general collection rather than analysis. Firstly, when it comes to investigation, excessive collection of personal information goes beyond the scope of investigation and evidence collection and may lead to new risks of infringement on citizens’ privacy and property rights. “Especially, the search and seizure of electronic data have an impact of general evidence collection on the principle of specificity of the investigation object.”⁴⁹ Therefore, we should try to limit the scope of personal information collected by investigators. Improvements can be made by guaranteeing the criminal suspect’s right to know and clarifying the relevance of investigation and evidence collection. When investigators collect personal information through consent investigation, they do not need the consent of the data subject at the time of collection because of the low degree of intervention of such investigation measures. However, in view of the right of information “not to be excessively collected,,” investigators still have to inform suspects afterward. When it comes to victims and other participants in the proceedings, the collection, storage, and use of their personal information by criminal justice organs must be based on informed consent. When investigators collect personal information, in principle, identifiable personal information must be clearly correlated with the facts of the case. Investigators should not collect personal information in a general way based on the purpose of crime prediction or due to inadequate technical ability to collect evidence. Second, when it comes to the criminal trial, “China has been exploring and practicing the remote criminal trial for more than ten years, and has initially realized the external transformation of litigation form, expanding the room for the court to operate with network and information technology.”⁵⁰ The reform to change offline trials to a combination of online and offline trials will inevitably expand the scope and depth of personal information collected by judicial organs, which should therefore be restricted. Specifically, when it comes to identity authentication in remote trials, investigators should only collect the information necessary to confirm the true identity of the subject of litigation, and should not excessively collect biological information such as fingerprints, face recognition data, and so on. Evidence should be examined according to the types of evidence stipulated in the Criminal Procedure Law to avoid evidence unrelated to the case or evidence with character orientation being included in the court trial through electronic data. During the trial, the personal information collected and disclosed by the justice organs should also be limited to the personal information involved in identity examination, evidence materials, and legal documents.⁵¹

 

(Translated by SU Yilong)

 

* WU Tong ( 吴桐 ), Ph. D. candidate in Procedural Law, Peking University Law School.

 

1. Kong Qingjiang and Yu Huayi, “The Extraterritorial Application of Data Law and China’s Countermeasures”, Law Science Magazine 8 (2020): 76-81.

 

2. He Yuan, Data Law (Beijing: Peking University Press, 2020), 3-4.

 

3. Pei Wei, “Segregation and Integration of Criminal Justice and Personal Information Protection Law”, Journal of CUPL 5 (2020): 150.

 

4. Cheng Lei, “Protection of Citizens’ Personal Information in Criminal Justice”, Journal of Renmin University of China 1 (2019): 105.

 

5. Zhou Hanhua, “Exploring an Incentive-compatible Personal Information Protection Regime”, Chinese Journal of Law 2 (2018): 6.

 

6. Wang Liming, “Harmony and Difference: Demarcation and Application of Privacy and Personal Information Rules”, Law Review 2 (2021): 19-21.

 

7. Wang Yuan, “Personal Information Protection from Perspective of Data Power — Based on the Separation of Personal Information Protection and Privacy Protection”, Journal of Beijing University of Aeronautics and Astronautics (Social Sciences Edition) 1 (2022): 54.

 

8. Qi Aimin and Li Yi, “On the System of Personal Right to Information from the Perspective of Interest Balance”, Law Review 3 (2011): 42.

 

9. Jin Yao, “Reflection on the Private Law Approach to Regulation of Personal Information and Its Transformation”, ECUPL Journal 5 (2020): 88.

 

10. Ding Xiaodong, Personal Information Protection: Principles and Practice (Beijing: Law Press · China, 2021), 26.

 

11. Zhou Hanhua, “The Legal Position of Personal Information Protection”, Studies in Law and Business 3 (2020): 53.

 

12. Wang Xixin, “State’s Obligation of Personal Information Protection”, China Legal Science 1 (2021): 150-152.

 

13. Wang Xixin and Peng Li, “The Constitutional Basis of the Legal System of Personal Information Protection”, Tsinghua University Law Journal 3 (2021): 15.

 

14. Song Yinghui, “On the Principle of Balance in the Criminal Procedure”, Chinese Journal of Law 5 (1993): 61.

 

15. Wang Jiancheng, Conflict and Balance: A New Perspective of the Criminal Procedure Theory (Beijing: Peking University Press, 2006), 104.

 

16. Zhou Hanhua, Personal Information Protection Act and the Legislative Study (Beijing: Law Press · China, 2006), 57.

 

17. Lin Yushun, “Research on Legalization of GPS Investigation”, Court Case Times 2 (2018): 14.

 

18. Hu Ming, “Trial Center Doctrine and Interest Conflict of Victim’s Right Protection”, Tribune of Political Science and Law 1 (2018): 65.

 

19. Guo Song, “Right Disposition of the Accused: Basic Norms and Institutional Construction”, Chinese Journal of Law 1 (2019): 168.

 

20. Liu Jingkun, Logic of Rights in Criminal Procedures (Beijing: Law Press · China, 2021), 172.

 

21. Wang Xixin, State’s Obligation of Personal Information Protection, China Legal Science 1 (2021): 151.

 

22. Chen Ruihua, Criminal Procedure Law (Beijing: Peking University Press, 2021), 4.

 

23. Wang Xixin, “State’s Obligation of Personal Information Protection”, China Legal Science 1 (2021): 155.

 

24. Cheng Guansong, “The Right Discourse of Personal Information Protection in China”, The Jurist 5 (2019): 23.

 

25. Wang Zhongyang, “Personal Information Protection in Criminal Litigation — From the Perspective of Technology Positioning Investigation”, Theory Monthly 12 (2020): 112-113.

 

26. Jiang Yong, “The Implantation of Personal Information Right in Investigation Procedure in the Era of Big Data”, Journal of Wuhan University 3 (2019): 156-158.

 

27. Zheng Xi, “Personal Information Right as a Litigation Right in Criminal Procedures”, Tribune of Political Science and Law 5 (2020): 136-141.

 

28. Li Xiaolu, “The Theoretical Justification and Systematic Construction of the Introduction of Personal Information Right into Criminal Procedures”, Hebei Law Science 12 (2021): 148-149.

 

29. Fu Xinhua, “On the Justification of the Right to Personal Information”, Law and Social Development 5 (2021): 130.

 

30. Zhang Yonghe, “Comprehensively and Correctly Understanding the Concept of Human Rights, Human Rights Discourse and Discourse System”, HongQi WenGao 14 (2017): 7.

 

31. Ye Mingyi, “On the Basic Categories of the Right to Personal Information”, Tsinghua University Law Journal 5 (2018): 152-158.

 

32. Ye Chuanxing, “Analysis of the Disputes of Human Rights Concept”, The Jurist 6 (2005): 43.

 

33. Ma Changshan, “‘The Fourth Generation of Human Rights’ under the Background of Smart Society and Its Protection”, China Legal Science 5 (2019): 9-13.

 

34. Liu Zhiqiang, “‘Digital Human Rights’ Do Not Constitute the Fourth Generation of Human Rights”, Chinese Journal of Law 1 (2021): 20.

 

35. Gao Fuping, “Protection of Personal Information: From Individual Control to Social Control”, Chinese Journal of Law 3 (2018): 89.

 

36. Yi Yanyou, “The Basic Standpoint of Protection of Human Rights in Criminal Procedures”, Tribune of Political Science and Law 4 (2015): 24.

 

37. Chen Yongsheng, Constitutional Foundation of Criminal Procedures (Beijing: Peking University Press, 2010), 170-185.

 

38. Zheng Xi, “Personal Information Right as a Litigation Right in Criminal Procedures”, Tribune of Political Science and Law 5 (2020): 136-138.

 

39. Zheng Xi, “Beyond Reading Case Files: Research on Criminal Defendants’ Data Access Right under the Background of Judicial Informationization”, Journal of Henan University 2 (2020): 63.

 

40. Cai Peiru, “The Reflection and Reconstruction of the Right to be Forgotten”, Tsinghua University Law Journal 5 (2019): 185.

 

41. Zheng Xi, “The Right to Be Forgotten: The Application of the Right to Be Forgotten from the Perspective of Criminal Justice”, Study and Exploration 4 (2016): 62-64.

 

42. Carpenter v. U.S. 138S. Ct2206, 2206-2272(2018).

 

43. Zhu Jiajun, “Lines Between Privacy Protection and Criminal Investigation in the Digital Era: Taking the Carpenter Case as the Entry Point”, Global Law Review 3 (2020): 43.

 

44. Judgment of the Supreme Court of Japan on March 15, 2017, No.3, 13, Vol. 71, the Supreme Court’s Criminal Case Collection.

 

45. Wu Tong, “The Institutional Challenges and Legal Regulation of Technological Positioning Investigation — A Case Study of GPS Investigation in Japan”, Criminal Science 6 (2020): 73-78.

 

46. Wang Qingyan, “An Inquiry on the Path of Emerging Rights Gradually Being Included in the Law”, Studies in Law and Business 1 (2018): 31.

 

47. Yu Chengfeng, “The Constitutional Moment of the Right to Informational Privacy Normative Foundation and System Reconstruction”, Peking University Law Journal 1 (2021): 33.

 

48. Zuo Weimin, “Reflecting on Live Broadcast of Court Hearing — From the Perspective of Judicial Transparency”, Political Science and Law 9 (2020): 98.

 

49. Wu Tong, “Research on the Relevance of Electronic Data Search and Seizure”, Journal of People’s Public Security University of China 5 (2021): 64.

 

50. Chen Weidong and Cui Yongcun, “On the Practices and Theories of Remote Criminal Trial”, Peking University Law Journal 6 (2021): 1495.

 

51. Xie Dengke, “On the Protection of Personal Information in Online Litigation”, Journal of CUPL 1 (2022): 132.