数据跨境双轨制下个人信息出境监管豁免制度的适用与完善

Application and Improvement of Exemption System from Supervision on Outbound Transfer of Personal Information under the Dual-track System for Cross-border Data

数据跨境新规确立了个人信息出境监管豁免制度,既豁免了申报数据出境安全评估,也豁免了订立个人信息出境标准合同、通过个人信息保护认证。但从我国数据跨境管理双轨制体系来看,这些豁免规则在理解适用上仍存在一系列困惑:符合场景豁免的个人信息是否必然豁免安全评估,一定数量个人信息为何可以豁免同等保护要求出境,过境个人信息豁免、负面清单外豁免的合理限度何在,实践需要与安全关切双重压力下应如何完善豁免。破解这些困惑,就应该明确特定豁免只是豁免保护个人权益的监管机制,厘清个人信息与重要数据关系以明确豁免边界,系统把握过境个人信息豁免和负面清单外豁免,增强数据跨境制度协同性以缓解豁免规则压力。

The new regulations for cross-border data establish an exemption system from supervision on outbound transfer of personal information,which provides exemptions from the requirements to apply for the outbound data transfer security assessment,to conclude a standard contract for the outbound transfer of personal information,and to obtain the personal information protection certification.However,from the perspective of the dual-track management system for cross-border data in China,these exemption rules still face a series of application confusions:whether personal information that meets the scenario exemption is necessarily exempted from security assessment,why a certain amount of personal information transfer abroad can be exempted from the same protection requirements,what are the reasonable limits of exemptions of personal information in transit and data outside the negative list,and how to improve exemptions under the dual pressure of practical needs and safety concerns.To resolve these confusions,we should make it clear that specific exemptions are only exemptions from the regulatory mechanism to protect personal rights and interests,clarify the relationship between personal information and important data to clarify the boundaries of exemptions,systematically grasp exemptions of personal information in transit and data outside the negative list,and enhance the synergy of systems for cross-border data flows to ease pressure on exemption rules.