Abstract: Criminal law should regulate the behavior of abusing citizens' personal information. The inadequate protection of personal information in department law is related to the misunderstanding of the concept of the right to privacy. Therefore, it is necessary to clarify the boundary of "secrecy" of the right to privacy and define the limits of the protection of criminal law, so that the criminal law can get out of the regulatory logic of "restricting the transfer" of personal information privacy, and overcome the lag of "source control" in the traditional times. Starting from the reconstruction of the right to privacy, the paper confirms that the legal interest of the crime of infringing on citizens' personal information is the right to privacy and its attribute is the personal legal interest. Criminal law should focus on the protection of the right to control personal information. On this basis, this paper further clarifies the specific regulation mode of criminal law to the abuse behavior. The scope of application of the crime of infringing on citizens' personal information needs to be extended to the stage of use. The discretion of the liability for legal acquisition and illegal abuse should be in accordance with the provisions of the first paragraph of the crime and adhere to the modesty principle of criminal law to strictly restrict the criminalization of the abuse behavior.