企业数据刑事合规的建构路径及其具体展开——以数据安全法益为切入

The Construction Path and Concrete Development of Enterprise Data Criminal Compliance——With the legal interests of data security as a cut-in point

实现企业数据刑事合规的关键是厘清数据安全法益。通过透析《数据安全法》的规范目的,梳理出我国数据安全法益应当包含国家、公共以及个人法益三个维度,进而可搭建以三维数据安全法益为保护对象的企业数据合规路径。其前提在于需明确以预防、事前和专项合规为主;以报应、事后、全面合规为辅的内在逻辑,方能排除以个人法益为中心的解释困境。基于此,企业数据刑事合规的具体路径应展开如下,即明确以三维法益为合规对象的基础性规则、确立以保护和利用并重为合规目标的制度性规则、同时秉持以自我规制和外部监管为核心的程序性规则,进而为企业数据刑事合规的建构提供全方位规范要素。

The key to realizing corporate data criminal compliance is to clarify the legal interests of data security.By analyzing the normative purpose of the Data Security Law,it was sorted out that the legal interests of data security in China should include three dimensions,namely,national,public and personal legal interests.In turn,a corporate data compliance path can be paved that takes the three-dimensional data security legal benefits as the object of protection.Its premise rests upon clearly establishing an inherent logic that prioritizes prevention,anticipation,and specialized compliance measures as the primary approach,while taking retribution,post-event actions,and comprehensive compliance as secondary means,before the interpretive dilemmas centered around individual legal interests can alleviated.Based on this,the specific path of corporate data criminal compliance should be developed as follows:to clarify the basic rules with three-dimensional legal interests as the object of compliance,to establish the systemic rules with the protection and utilization as the goal of compliance,and to uphold the procedural rules with self-regulation and external supervision as the core,so as to provide a full set of normative elements for the construction of corporate data criminal compliance.