美国《云计算法案》引发的个人数据法律管辖权思考

Reflection on the Legal Jurisdiction of Personal Data Caused by the American “Cloud Act”

美国《云计算法案》于2018年3月23日出台,规定美国执法机构可以向美国企业(包括为美国市场提供数字服务的境外企业)索取存储在外国的犯罪嫌疑人相关数据,其核心是个人数据境外管辖权的问题。个人数据法律管辖权通常基于属地原则和属人原则,美国的《云计算法案》与欧盟的《通用数据保护条例》均采用了属人原则,而且都把管辖权拓展到了境外企业。个人数据境外管辖权的拓展势必引发国家间的法律主权冲突,对境外数字企业产生直接影响,也会使处于夹缝中的跨国数字企业无所适从。我国应关注欧美数据隐私规则,并且加强多边与双边法律合作。

The American“Cloud Computing Act”was introduced in March23,2018,stipulating that U.S.law enforcement agencies can obtain data about suspects stored in foreign countries from U.S.companies,including those overseas that provide digital services to the U.S.market,its core is the issue of jurisdiction over personal data overseas.The legal jurisdiction of personal data is usually based on territorial principles and personal principles.The American“Cloud Computing Act”and the European Union“General Data Protection Ordinance”are all adopted personal principles and extended jurisdiction to overseas enterprises.The extension of extraterritorial jurisdiction of personal data is bound to trigger conflicts of legal sovereignty among nations,thus directly impact on overseas digital enterprises,and will make the transnational digital enterprises in the cracks not know what to do.China should pay attention to data privacy rules in Europe and America and strengthen multilateral and bilateral legal cooperation.