The civil law framework of legislation on the protection of personal information in Russia and China
The article discusses the issues of civil law regulation of the protection of personal information (personal data). The author points out that the use of personal information has increased significantly, and personal data has de facto become a commodity. Due to the emergence of new threats to human subjectivity, social order, and national security, more attention has been paid to issues of legal protection of personal information. The approaches of the Russian and Chinese legislators to the civil law regulation of personal information and its protection are considered.
The author emphasizes that by paying attention to the protection of fundamental human rights and values, it is possible to coordinate the relationship between the protection of his rights to personal information and the dissemination of information. The Russian legislator should pay more attention to the issue of granting individuals the rights to control the processing of their personal information. The Civil Code of the Russian Federation should enshrine the right to familiarize oneself with one's own personal information, and if errors are found in the information, the right to demand their correction or deletion should arise.
Keywords: protection of law, institute for the protection of civil rights, protection of personal information, protection of personal data, civil law regulation of personal information.
A couple of decades ago, it was difficult to imagine such a rapid development of digital technologies, affecting many aspects of personal and public life. During this time, the use of personal information has increased significantly, and personal data, i.e. information related directly or indirectly to a specific or identifiable individual, without being the object of civil relations, has de facto become a commodity. Personal information may include the following information about an individual: surname and first name, date of birth, identity document number, biometric personalized information, residential address, phone number, email address, health information, location information, etc. This information may, separately or in combination with other data, identify a certain individual.
Due to the emergence of new threats to human subjectivity, social order, as well as national security, more attention has been paid to issues of legal protection of personal information. Thus, the Labor Code of the Russian Federation contains Chapter 14 "Protection of personal data", and in 2006 the Federal Law "On Personal Data" was adopted. Serious demands have been placed on the processing of personal data.
The Civil Code of the Russian Federation does not directly regulate the protection of personal information, but contains norms providing protection of honor, dignity, business reputation, protection of the image and private life of a citizen. If losses are caused as a result of violation of the rules for processing personal data, you can use Article 15 of the Civil Code of the Russian Federation and demand their compensation. If moral harm has been caused as a result of violation of the rules for processing personal data, the court may impose on the violator, according to Article 151 of the Civil Code of the Russian Federation, the obligation of monetary compensation for the specified harm.
The requirements for the processing of personal data are legally defined. The civil protection of the rights of a personal data subject may be related to the processing or dissemination of personal data without his consent. Violations may look like this:
- information about a person is posted in his profile on the employer's Internet resource;
- calls are made to the person's phone number and SMS messages are sent with various requirements, for example, to repay non-existent debts;
- the activity of the Internet resource is carried out in violation of the legislation of the Russian Federation in the field of personal data protection, since the rights and legitimate interests of an indefinite circle of citizens as subjects of personal data are violated by providing free Internet access to their personal data without obtaining their proper consent.
It is worth noting that such violations lead to significant inconveniences, entail moral suffering, and the subject of personal data has the right to protect their rights and legitimate interests. A personal data subject has the right to appeal against actions or omissions to the authorized body for the protection of the rights of personal data subjects or in court. An example of judicial protection is the case considered by the Moscow District Court of Ryazan, in which the claim of K.A.N., Ch.V.Yu. was considered. to the autonomous non-profit organization "Editorial Office of the newspaper "Mirror of Events" (editorial office and publisher of the newspaper "Novaya Gazeta", weekly Ryazan issue) on the protection of honor, dignity, business reputation and compensation for moral harm. In the article, without the consent of the plaintiffs, their personal data were distributed, namely: home address, place of work, place of work, marital status and information about the property of Ch.V.Yu. The plaintiffs indicated that the editorial office of the weekly Ryazan issue of Novaya Gazeta caused moral damage in the form of moral experiences. For Ch.V.Yu., this was expressed in physical suffering. Ch.V.Yu. was on sick leave, was in the hospital with an exacerbation of chronic diseases on a nervous basis. The claims were satisfied by the district court, and the regional court left the decision unchanged <1>. It is worth agreeing that the development of the media cannot bypass the problems that are inextricably linked to the mass dissemination of information, the problem of protecting personal information in various messengers and social networks is also more than relevant <2>.
--------------------------------
<1> Definition of the Ryazan Regional Court of April 25, 2012 N 33-686.
<2> Ivliev P.V., Ananyeva E.O. Activity of mass media as legal entities in Russia: problems and solutions // Lawyer. 2020. N 2. P. 57.
The Chinese legislator's approach to the civil law regulation of personal information and its protection seems very logical, including the issue of excluding the civil liability of a person who processes personal information. Article 1036 of the Civil Code of the People's Republic of China establishes a list of such circumstances. China's experience is also interesting because, like Russia, it is actively looking for opportunities to create regulatory mechanisms for the growing and constantly moving field of digital technologies <3>. The Chinese civil law regulation of personal rights is currently very progressive and should be of some interest to study. On May 28, 2020, the third session of the National People's Congress of the Thirteenth convocation voted to adopt the long-awaited Civil Code of the People's Republic of China. This landmark legislative act came into force on January 1, 2021. It is the first Civil Code in the history of China, formed through the systematic integration, compilation and revision of private law norms in force in China. For the first time, the Civil Code of the People's Republic of China establishes the right to privacy and the principles of personal data protection, defines the concept of personal data, establishes the legal basis for personal data processing, and regulates the duties of persons processing personal data, the rights of individuals to their personal information. Although there are many issues to be resolved in future laws on the protection of personal information, the Civil Code of the People's Republic of China lays the foundation for future legislation in this area.
--------------------------------
<3> Kharitonova Y.S., Sun Qi. Digitalization of public relations and the rule of law: the experience of rethinking in Russia and China // Civil Law. 2022. N 2. p. 3.
According to the provisions of the Civil Code of the People's Republic of China, personal rights refer to the rights that people enjoy on the basis of their personal freedom and dignity. Historically, Chinese civil law has not explicitly recognized the right to privacy as a personal right. Neither the Constitution nor the General Principles of Civil Law contained provisions on the right to privacy. Although the Tort law protected the right to privacy, it did not define the right to privacy and did not establish the right to privacy. With regard to personal information, the Cybersecurity Law, promulgated in 2016, became the first national-level law on the protection of personal information on the Internet, but its provisions on the obligations of relevant entities concerned only network operators and information collected through the network. Future legislation on the protection of personal information depended on whether the basic principles of personal information protection could be established in Chinese law. The Civil Code of the People's Republic of China has defined and consolidated the right to privacy as a personal right in parallel with other basic rights such as the right to life, the right to health and the right to reputation, and establishes the basic principles of personal information protection in China. For the first time, he provided broad protection of personal information in civil law, removing the protection of personal information from the narrow scope of the Cybersecurity Law and extending it to all aspects of private life. The Civil Code of the People's Republic of China in Chapter 5 laid the foundation for future legislation on the protection of personal information. He consolidated the provision that the personal data of an individual is protected by law, and if any individuals or organizations require the personal data of other persons, they are obliged to receive them in accordance with the requirements of the law and guarantee the safety of this data. The Civil Code of the People's Republic of China has established a ban on the illegal collection, use, processing and transfer of personal data of others. It defines that illegal trade, provision or publication of personal data of other persons is not allowed. Thus, guarantees of civil rights in the area under consideration were laid down. It is worth noting that the Civil Code of the Russian Federation does not contain such guarantees.
Individuals in the People's Republic of China enjoy only the economic benefits of exercising the right to protect personal information, and not personal rights to their personal information. That is, when it can be proven that there is actual damage, an individual can only file a civil claim for violation of private personal information and claim damages. If an individual enjoys personal rights with respect to personal information that is not private, he has the opportunity to demand restoration of reputation or an apology. The section "Personal Rights" of the Civil Code of the People's Republic of China grants individuals certain rights to control the processing of their personal information (such as the right of access and the right to request the deletion or correction of personal information). However, the legal nature of such rights has not yet been clarified. If an individual is deprived of the aforementioned rights to personal information, it is unclear what legal remedies they can use. Can it file a claim for infringement or should it file a complaint with the relevant data protection authority? In China (as well as in Russia) there are questions that continue to remain unanswered. An example is the scope of application of the provisions of the Civil Code of the People's Republic of China on the protection of personal information.
The analysis of the legislation of foreign countries, the search for positive solutions to the issue of regulating the protection of personal data can be useful in improving the current Russian legislation. Despite the fact that the protection of personal data should take into account the development of technology and trade, economic development should serve the development of a person, it cannot be carried out at the expense of freedom, dignity, security and his property. The relevant rule is that "pollution first, and then purification" in environmental matters should not take place in cases where human freedom, dignity, security and property are at stake. It is only by paying attention to the protection of fundamental human rights and values that it is possible to coordinate the relationship between the protection of his rights to personal information and the dissemination of information. The Russian legislator should pay more attention to the issue of granting individuals the rights to control the processing of their personal information. The Civil Code of the Russian Federation should enshrine the right to familiarize oneself with one's own personal information, and if errors are found in the information, the right to demand their correction or deletion should arise.