论数据携带权在我国的适应性建构

On the Adaptive Construction of Data Portability Right in China

个人数据权利行使的迫切需求、企业数据良性竞争的现实需要及国家数据资源市场化配置的客观要求是我国引入数据携带权的正当性基础,但《个人信息保护法》45条第3款仅对其进行了原则性规定,其有效运行仍有赖于具体规则的本土化建构。基于制度功效的不确定性和数据跨境流动安全性等问题的考量,数据携带权的本土化建构不可能一蹴而就,适宜采取“先行试点、分步推进”的策略。在借鉴欧美经验的基础上,我国数据携带权的具体建构如下:在应用领域上,先在开放银行领域进行试点;在数据范围上,参考《个人金融信息保护技术规范》,先允许C1类及C2类除用户鉴别辅助信息之外的基础数据转移;在实现方式上,采取自己请求和向授权第三方认证机构请求两种方式;在规则框架上,从数据携带权的主体、客体、内容及限制进行设计。在总结试点经验的基础上,未来可以通过行政法规或者部门规章的方式对数据携带权予以详细规定。

The urgent need for exercising personal data rights,the realistic need for healthy data competition,and the objective requirements for the market-oriented allocation of data resources are the justifications for China to introduce the right to data portability,but Article 45,paragraph 3,of the Personal Information Protection Law only enforces it.Although the rules are stipulated in principle,its effective operation still depends on the construction of specific rules.Based on the uncertainty of the effectiveness of the system and the consideration of issues such as the security of cross-border data flows,the localization of the right to data portability cannot be achieved overnight,and it is appropriate to adopt the strategy of“piloting first and advancing step by step”.On the basis of drawing lessons from European and American experience,the specific construction of the right to data portability is as follows:in the application field,first conduct pilot projects in the field of open banking;in terms of data scope,refer to the“Technical Specifications for Personal Financial Information Protection”,and first allow C1 and C2 in addition to user identification auxiliary information,transfer of basic data;in terms of implementation methods,two methods are adopted:self-request and request to authorized third-party certification agencies;In the framework of rules,the subject,object,content and restriction of the right to carry data are designed.In the future,China may provide detailed regulations on the right to data portability through administrative regulations or departmental rules.