个人数据携带权与企业数据获取“三重授权原则”的冲突与调适

The Conflicts between Right to Data Portability and “the Principle of Triple Authorization” for Enterprises to Acquire Data and the Solution

个人数据携带权与《欧盟基本权利宪章》中的个人数据受保护权一脉相承,试图从基本权利的高度强化数据主体对信息隐私和数据流转的绝对控制。在我国,其与以数据持有企业合法数据权益保护为本位的企业数据获取“三重授权原则”,在企业间的数据争夺案件中屡屡出现价值理念和数据流通规则方面的冲突,成为数据司法乃至整个数据法治必须回答的时代之问。这种冲突本质上是个人数据权利、数据持有企业的数据权益、数据市场竞争秩序保护三种法益之间的共时性矛盾。立法和司法不能简单偏废其一,而应当基于立体的法律价值博弈系统达成不同主体利益的纳什均衡。就个人数据携带权来说,可从适用领域、适用对象、通过“数据盗用理论”的反向限制、原位数据权的引入等方面予以限定、补充和调适;对企业数据获取“三重授权原则”而言,需要细分不同的数据类型和适用场景,建立合理的数据流通授权规则,以达成数据私权保护和数据公共利益的协调。

The right to data portability,sharing the same spirit with the right to protect personal data in the EU Charter of Fundamental Rights,tries to strengthen the absolute control of the data subjects over information privacy and data flow from the important perspective of fundamental rights.In China,its conflicts with the"principle of triple authorization"for enterprises to acquire data centered on the protection of legitimate data interests of data-holding enterprises in terms of values and data flow rules in data competition cases among enterprises has become a question of the times that must be answered in data-related judicial practice and even the whole rule of law on the data.This conflict is essentially a synchronic contradiction among three legal interests,i.e.personal data rights,data interests of dataholding enterprises and the protection of competition order in data market.None of them should be ignored in the legislation or judicial practice,and efforts should be made to achieve the Nash equilibrium of the interests of different subjects on basis of the dimensional legal value game system.As for the right to data portability,it may be limited,supplemented and adjusted from aspects of application area,application object,reverse restriction through"the theory of unauthorized use of data"and the introduction of in-situ data right;For the"doctrine of triple authorization"for enterprises to acquire data,it is necessary to subdivide different types of data and application scenarios,and establish reasonable rules on the authorization of data circulation,so as to achieve the coordinated balance between datarelated private rights protection and public interests.