欧盟非个人数据自由流动制度及其中国本土化

The Free Flow of Non-personal Data in EU and its Localization in China

[目的/意义]针对我国数字经济发展中的法制缺位问题,从欧盟非个人数据自由流动制度中探求规范性经验。[方法/过程]运用网络调研方法对域外法律政策涉及的非个人数据制度进行梳理,并使用归纳法和演绎法展开解构,得出欧盟非个人数据自由流动制度形成的根本原因在于数字单一市场战略的内在需求和已具备数据自由流动的制度基础。[结果/结论]欧盟非个人数据自由流动制度主要内容包括废止数据本地化要求,鼓励制定数据迁移自律行为准则,允许有权机构因履行法定职责访问数据,评估《非个人数据自由流动条例》实施情况以及制定其与《通用数据保护条例》协调适用指南等方面。于我国而言,应该将构建非个人数据有序流动规则体系列入立法规划,并在《个人信息保护法》和《数据安全法》的起草中设定个人信息可携权和非个人数据迁移权。

[Purpose/significance] Aiming at the absence of legal system in the development of digital economy in China, the paper explores the normative experience from the free flow system of non-personal data in EU.[Method/process] Using the network investigation method to sort out the non-personal data system involved in foreign legal and policy, and inductive method and deductive approach to deconstruct, it is concluded that the fundamental reason for the formation of the free flow system of non-personal data in the EU lies in the inherent demand of the digital single market strategy and the institutional basis for the free flow of data.[Result/conclusion] The main elements of the EU free flow system for non-personal data include abolition of data localisation requirements, encouraging and facilitating the development of self-regulatory codes of conduct of porting of data at Union level, allowing authorized institutions to request, or obtain, access to data for the performance of their official duties in accordance with Union or national law, evaluating the implementation of the Regulation (EU) 2018/1807, and publishing informative guidance on the interaction of the Regulation (EU) 2018/1807 and Regulation (EU) 2016/679. In China, the construction of an orderly flow rule system for non-personal data should be included in the legislative plan, and the rights of personal information portability and the rights of porting of non-personal data should be set separately in the drafting of the Personal Information Protection Law and the Data Security Law.