欧盟《通用数据保护条例》框架下我国跨境旅游企业合规路径

Compliance Approaches to EU General Data Protection Regulations for Chinese Cross-border Tourism Enterprises

国际旅游服务贸易和旅游投资快速发展中,大数据的运用带来旅游服务模式改革和经济价值提升,但侵犯消费者个人资讯隐私权的数据处理行为比比皆是。欧盟《通用数据保护条例》的域外适用使得面向欧盟市场的中国跨境旅游企业有必要在该条例框架下处理欧盟境内消费者的个人数据,从而避免合规风险。应从设计着手对产品和服务进行隐私设计,始终以消费者同意为中心,履行实现数据主体权利的义务,规范数据处理行为,主动采取技术和组织措施防控风险。

The use of big data in the fast developing international trade of tourism service and tourism investment pushes reformation of tourism service mode and increases economic value of tourism enterprises,as well as tortuous data processing conduct to consumers’personal information privacy.EU General Data Protection Regulations,as the latest legislative development,should be complied by Chinese cross-border tourism enterprises,in order to avoid compliance risks in processing personal information of consumers in EU member states.Cross-border tourism enterprises should protect privacy by design of products and services,based on the content of consumers at all times,be obliged to fulfill the rights of data owners,regulate conduct of data processing,and take technologic and institutional proactive measures to avoid risk.