论我国个人信息保护法域外效力制度的构建

On the construction of extraterritorial effect system of personal information protection law in China

个人信息保护法域外效力制度是指一国对某一法域外处理个人信息的人、物或行为实施管辖,从而将其管辖范围扩展至该国领土之外的一种法律制度,其不仅是建立在各方参与主体切实利益需求之上的制度创新,在更宏观的意义上,也是一国实现政治、经济等多元目的的法律武器。从《欧盟数据保护指令》到《欧盟通用数据保护条例》,欧盟进一步扩大法律域外效力范围,确立了以属地原则为主、效果原则为补充的管辖原则,并为多数国家所效仿,这种做法的实质是以整个欧洲市场作为筹码参与国际博弈。《美国云法案》以技术和市场占优的美国企业对全球数据的控制为筹码,通过美国企业在全球的分布将法律武器延伸至世界各地,输出美国式隐私保护标准,以最大化维护其国家利益。在尚未形成国际惯例和条约的现状下,通过国内立法进行域外效力扩张是多数国家维护数据主权并参与网络空间国际治理的共通做法。面对这一国际立法主流,我国应构建域外立法管辖和域外执法管辖并存的法律制度,进一步提升个人信息保护法域外效力制度的适用性和体系性,积极参与并主导个人信息保护法国际条约的制定,推动互联网全球治理体系变革中国方案的实现。

The system of extraterritorial effect of personal information protection law refers to a legal system in which a country exercises jurisdiction over a person, object or behavior that processes personal information extraterritorially, thus extending its jurisdiction beyond the territory of the country. It is not only a system innovation based on the practical interests of all participants, but also a legal weapon for a country to achieve political, economic and other purposes in a more macroscopic sense. From Data Protection Directive 95/46/EC to GDPR, the European Union further expanded the extraterritorial effect scope of the law, establishing the principle of jurisdiction with the principle of territoriality as the main principle and the effects principle as the complementary principle, and became a model for most countries. The essence of this approach is to take the whole European market as a bargaining chip to participate in the international game. Depending on the advantage of technology and market-dominant of U.S. companies and their control of global data, the U.S. CLOUD Act extends its legal weapon to all parts of the world through the global distribution of American companies, exporting American-style privacy standards to maximize their national interests. In the current situation where international conventions and treaties have not been formed, expanding the extraterritorial effect scope through domestic legislation is a common practice for most countries to safeguard data sovereignty and participate in international cyberspace governance. Facing the international mainstream, China should establish an legal system in which extraterritorial legislative jurisdiction and extraterritorial law enforcement jurisdiction coexist, enhance the applicability and systemic nature of the system of extraterritorial effects of personal information protection law, actively participate in and lead the development of international treaties on personal information protection law, and promote the realization of China’s plan for the reform of the global internet governance system.