Abstract: With the rapid advancement of biometric and digital technologies, the excessive collection, processing, and use of biometric information not only infringe upon individuals' fundamental rights but also pose substantial security threats to society and the state. The traditional rights-based approach to personal information governance proves inadequate in addressing the challenges of information risk management. It is therefore essential to establish a risk-oriented regulatory framework grounded in the precautionary principle - one that extends the scope of regulation from the mere protection of biometric data to the prevention of potential harms. The focus of governance should shift from safeguarding individual rights alone to regulating and supervising the powers exercised by both public and private data controllers. It is imperative to establish differentiated criminal law intervention standards tailored to varying risk levels by deconstructing the intrinsic logic of legal interest infringement across diverse risk scenarios, thereby achieving an organic integration of risk-classified supervision and scenario-based governance. Concurrently, through interpretation and amendment of existing offenses, both direct and indirect regulations governing the infringement on biometric information should be implemented. This approach enables a balanced integration of personal information protection, national public governance demands, and the state's duty to protect personal data within a risk-sensitive framework. It seeks to harmonize the restraining of criminal law with the efficacy of social governance, ultimately providing a pragmatic criminal law framework for the governance of biometric information in a risk-oriented society.

Keywords: Biometric Information; Precautionary Principle; Risk Classification Supervision; Crime of Infringing upon Citizens' Personal Information

Author: Jia Yuan, associate senior editor, CASS Institute of Law;

Source: 1 (2026) Peking University Law Review.