数据跨境流动的法理反思与制度重构——兼评《数据出境安全评估办法》

The Jurisprudential Reflection and Institutional Reconstruction of Cross-boarder Data Transfer:With a Comment on Measures of Out bound Data Transfer Security Assessment

数据跨境流动需要在法理层面反思。从理论与实践出发,可以提炼数据无国界、数据主权、数据自由贸易、数据人权保护四种基础法理。这些法理存在部分合理性,但也存在重大困境。作为替代,应将数据安全主权作为数据跨境流动的法理基础。数据安全主权秉持安全不可分割与人类命运共同体原则,既平等回应各国对数据安全的合理关切,又反对单边主义与霸权主义,可以成为国际数据跨境流动的重叠共识。我国的《数据出境安全评估办法》等数据出境制度整体上与数据安全主权的法理高度吻合。但在风险认知上,需要采取合理、开放、动态的安全观。在具体法律工具上,需要针对个人信息、重要数据与关键信息基础设施采纳不同的风险评估方式。

The rules of data cross-border transfer need to be reconsidered at the jurisprudential level.From the perspective of theory and practice,we can refine four basic legal principles:data without borders,data sovereignty,data free trade,and data human rights protection.These legal principles are partially reasonable,but they also face major difficulties.As an alternative,data security sovereignty should be taken as the legal basis of data cross-border transfer.Data security sovereignty upholds the principle of indivisibility of security and a community with a shared future for mankind.It not only responds to the legitimate concerns of all countries about data security on an equal footing,but also opposes unilateralism and hegemonism.It can become an overlapping consensus of international data cross-border flows.China’s Measures of Outbound Data Transfer Security Assessment and other outbound data rules are highly consistent with the legal principle of data security sovereignty.However,in terms of risk cognition,we need to adopt a reasonable,open and dynamic security concept.In terms of specific legal tools,different risk assessment methods need to be adopted for personal information,important data and critical information infrastructure.