Abstract: The right to privacy and the right to personal information protection are totally different kind of rights: communicative action draws the boundary of private and public, while information processing behavior is the core of regulating personal information. The former is based on civility rules and requires participants to be equal and voluntary, while the latter relies on fair information practice principles, which aims at the power imbalance between the processors and the information subjects. However, there is a long-term interconnection between these two concepts. That is why the first version of fair information practice principles follows the right protection mode. The right protection path defaults that information processing behavior is legal and legitimate as long as it meets the fair practice standards, which avoids the debate on the good and evil of information processing itself. In order to achieve substantive justice, we should abandon the right-based protection mechanism such as privacy protection, which focuses on giving more rights to information subjects, and replace it with the protection mechanism centered on restricting the data power and algorithm power of information processors. The effect of power constraints can be achieved through three mechanisms: power restriction, power confrontation and integrity guidance.