“数据控制者标准”取证模式及中国因应

The"Data Controller Standard"Forensics Model and Its Response in China

“数据控制者标准”取证模式是以“数据的实际控制者”为属人连结点来确定跨境数据管辖权的模式,其指向的是跨境网络服务提供者控制的能够作为证据的各类境外数据。该模式正将跨境数据取证由以“数据本地化”为表现形式的属地原则转向以“数据控制者”为核心管辖要素的属人原则。基于“数据控制者标准”取证模式直接向数据控制者调取境外数据的特点,该模式极易引发其与包括我国在内的采用“数据本地化标准”国家之间的数据主权冲突。“数据控制者标准”取证模式与我国相关程序法和数据保护法相抵牾,而我国阻断法在应对境外数据强制调取时发挥的制约作用有限。我国可尝试采用“以数据本地化标准为主,以数据控制者标准为辅”的策略,在尊重主权差异与国际礼让的基础上,实行对等原则基础上有限度的数据出境。同时,充分发挥阻断法的作用,以消减“数据控制者标准”取证模式对我国的不利影响。

The"data controller standard"forensic model uses the""actual controller of the data"as the personal link to determine the jurisdiction over cross-border data,which points to various types of offshore data controlled by cross-border network service providers that can be used as evidence.This model is shifting cross-border data forensics from the principle of territoriality,which is expressed in the form of"data localization",to personalism,which takes"data controller"as the core jurisdictional element.Based on the characteristics of the"data controller standard"forensic model,which is based on the mandatory access to data outside the country directly from the data controller,this model is very likely to trigger a conflict of data sovereignty between it and the"data localization standard"countries,including China.In addition,the"data controller standard"forensic model contradicts China's relevant procedural law and data protection law,while China's blocking law is not enough to deal with compulsory access to foreign data.Therefore,China can try to adopt the strategy of"mainly based on data localization standard,supplemented by data controller standard",and based on respecting sovereignty difference and international comity,implement the principle of reciprocity based on a limited number of data out of the country.At the same time,the blocking law should be brought into full play to neutralize the adverse impact of the"data controller standard"forensics model on China.