随着互联网的飞速发展、信息流转次数的爆发，非法使用个人信息行为的危害性日益凸显，篡改高考志愿、身份盗窃等行为给公民的生活安宁、人身和财产安全带来了极大威胁，也对社会秩序造成了一定的危害。我国现行刑法第253条之一规定的侵犯公民个人信息罪对非法获取个人信息和非法提供个人信息等个人信息不法流转行为进行规制，并未直接介入惩治非法使用个人信息行为。这意味着非法使用个人信息行为的治理主要依靠《个人信息保护法》《网络安全法》等前置法。然而前置法中的大量规范均为私法规范，且由于个人信息处理者与公众间的技术鸿沟等原因，依靠公民个人力量难以实现维权；同时，个人信息行政规制存在法律规范不成体系、监管部门职责模糊、法律责任威慑力极低的短板，使得前置法对非法使用个人信息行为的防治作用甚微。

       虽然刑法并未直接将非法使用个人信息行为规定为犯罪，但非法使用个人信息行为在事实上存在着一定的入刑路径，包括通过下游犯罪入刑、通过部分涉个人信息罪名入刑，以及通过破坏计算机信息系统罪、侵犯公民个人信息罪入刑的路径。然而非法使用个人信息行为的实然入刑路径中所涉及的大部分罪名所保护法益并非个人信息权益，因此对个人信息的保护具有间接性和偶然性，不仅无法全面惩治非法使用个人信息行为，还常常产生司法类推现象，违反罪刑法定原则。

       基于以上情况，非法使用个人信息作为一种行为类型直接入刑不仅是全面打击非法使用个人信息行为、防止处罚漏洞的最佳路径，也是发挥刑法保障法作用、健全个人信息保护法律体系的必经之路。即便学界对非法使用个人信息行为应当入刑达成了一定的共识，在入刑的应然路径选择上仍存在较大争议。其中，部分学者所持的解释论的观点可能打破刑法的可预测性，而采取立法方式实现对非法使用个人信息行为入刑，不仅有利于精准评价和全面打击，也符合我国的刑法和国际上的立法实践。就立法入刑路径的具体展开而言，非法使用个人信息行为适宜加入侵犯公民个人信息罪，但无法直接并列入其中一款，据此，应当在刑法第253条之一新增一款专门规定非法使用个人信息行为。同时，相对于非法流转行为而言，非法使用个人信息行为具有更加严重的危害性，因此应当设置更重的法定刑。

     With the explosion of information circulation and the rapid development of the Internet, the harmfulness of illegal use of personal information has become increasingly prominent, and tampering with college entrance examination volunteers, identity theft and other behaviors have brought great threats to the peace and security of citizens' lives and even personal and property safety, and have also caused certain damage to social order. However, Article 253-1 of the current Criminal Law of the People's Republic of China stipulates the crime of infringing on citizens' personal information which only include illegal acquisition or provision of personal information,  and does not directly intervene in and comprehensively regulate the illegal use of personal information. This means that the governance of illegal use of mainly relies on the precedent laws of criminal law such as the Personal Information Protection Law,  the Cybersecurity Law, and the Civil Code. The deterrent effect of legal liabilities such as fines is extremely low, and because most of the provisions of these laws are regulated by private law, and illegal acts involving personal information are difficult to achieve rights protection by relying on private force, the pre-existing law of the criminal law has little effect on the prevention and control of such violations.

    Although Article 253-1 does not stipulate the illegal use of personal information, in practice, there are actual criminalization paths through downstream crimes, criminalization through some crimes involving personal information, and other paths. However, the actual criminalization paths are indirect and accidental, which do not comprehensively punish illegal use, and may even violate the principle of legality.

     Based on the above situation, it is necessary to comprehensively criminalize the illegal use. Even though the academic community has reached a certain consensus on the criminalization of illegal use of personal information, there is considerable controversy on the path of criminalization. The interpretation viewpoint held by some scholars may break the predictability of the criminal law, and the adoption of legislation to criminalize the illegal use is not only conducive to accurate evaluation and comprehensive crackdown, but also conforms to China's criminal law and international legislative practice. As far as the specific methods, illegal use of personal information is appropriate to be included in the Article 253-1, but it cannot be directly included in one of the paragraphs,  and accordingly, a new paragraph should be added to article 253-1 of the Criminal Law to specifically provide for the illegal use. At the same time,  this crime is more harmful than the illegal provision and illegal acquisition of personal information, so heavier statutory penalties should be set for it.