论欧盟《通用数据保护条例》的域外效力

On the Extraterritorial Effects of the EU's General Data Protection Regulations

2018年欧盟《通用数据保护条例》的实施被视为“数字人权”项下个人数据权保护的“典范”,其重要原因在于其以条例的域外效力契合数据跨境治理的现实需要。条例第三条通过两个维度的设计去搭建个人数据保护的域外适用框架:第一,“经营场所标准”:倘若欧盟境外数据控制、处理、使用等主体采取的数据行为与欧盟境内经营场所具有不可分割的某种联系,那么就要受到条例的规制;第二,“目标指向标准”:若境外数据控制者、处理者等所展开的数据行为是针对欧盟境内的数据主体,那么其亦受到条例的约束。虽然两个标准相互补充,但条例的域外效力仍然面临着考验。条例域外效力的经验和考验,也为我国提供了宝贵的经验和启示。

The implementation of the 2018 EU General Data Protection Regulations is regarded as a"model"for the protection of personal data rights under the"digital human rights"category,and its important reason is that its extraterritorial effectiveness meets the practical needs of cross-border data governance.Article 3 of the Regulation establishes an extraterritorial application framework for personal data protection through two dimensions of design:firstly,"workplace standards",if the data actions taken by entities controlling,processing,and using data outside the EU have an inseparable connection with the EUs domestic business premises,they must be regulated by the Regulation;Secondly,“target targeting standards”,if the data actions carried out by overseas data controllers,processors,etc.are directed against data subjects within the EU,they are also subject to regulations.Although the two standards complement each other,the extraterritorial effectiveness of the regulations still faces a test.The experience and test of extraterritorial effectiveness of regulations have also provided valuable experience and inspiration for China.