数据法域外适用及其冲突与应对——以欧盟《通用数据保护条例》与美国《澄清域外合法使用数据法》为例

The Extraterritorial Application of Data Regulation:Conflicts and Solutions as Exemplified by GDPR and CLOUD Act

欧美个人数据保护及境外数据获取的最新立法均体现出强烈的域外适用倾向。前者以欧盟《通用数据保护条例》为代表扩大属人主义原则的运用,并将“目标指向”或“消极人格”标准引入数据法规;后者以美国《澄清域外合法使用数据法》为典型,通过扩张本国对数据控制者的联系进行数据执法。这两类立法以本区域或本国与数据主体和数据控制者的联系为连接点进行域外适用,对数据流动分别产生限制移动或强制转移效果,必然会在彼此之间形成法律冲突,并对企业的数据合规及国家的双边关系产生负面影响。为减少冲突,国家在制定具有明显域外效力的个人数据保护或境外数据获取法律法规时,应与数据往来频密的国家尽可能达成具有可执行性的数据交换协议,或改进双边司法协助协议中的数据交换机制,在执法及司法中基于礼让原则对本国域外执法利益和外国冲突利益和价值进行平衡,采取与其目标相称的执法和司法措施。

The regulations on personal data protection or digital evidence in the European Union and US have displayed a strong tendency of extraterritorial reach.In the EU,the GDPR expands its personal jurisdiction,by incorporating the target principle or the passive personality principle into its rules;in the U.S.,the CLOUD Act extends the US’s connection with the data controllers in the data law enforcement.Extending their exterritorial reach based on their connection with data subjects and data controllers respectively,the two territories either restrict the overseas data flow or force the data submission,thus causing legal conflicts among themselves and producing negative impacts on the enterprises’data compliance and on the foreign relations.Thereby,when developing personal data protection laws and digital evidence rules with extraterritorial effects,to reduce legal conflicts,a country shall endeavor to reach effective and enforceable agreements on data exchange with the countries that they have frequent data exchanges with,or improve the data exchange procedure in the Mutual Legal Assistance Agreements.Furthermore,it shall balance the exterritorial law enforcement interest with the conflicting foreign interests and values on the ground of the comity principle,and adopt measures that match with their objectives in the law enforcement and judicial interpretation.