The confusion of EU regulations on crossborder flow of personal data from the perspective of digital sovereignty
Cai Yacen
Law School, Jilin University
Abstract： Guided by digital sovereignty, the European Union has improved the internal mechanism of GDPR and promoted its crossborder rules for personal data through FTA, and expanded privacy exception clauses to enhance the effectiveness of the rules. However, its regulation has led to the localization of "soft" data, which is not conducive to maintaining digital sovereignty. The root of the problem lies in the dual nature of the EU′s digital sovereignty goals—protecting citizens′ privacy while promoting the development of the digital economy, which are inherently conflicting. At the same time, the relativist sovereignty application model adopted by the EU is inconsistent with the digital sovereignty interests of most economies, which can easily trigger resistance and further undermine its sovereignty goals. In view of this, China should firstly improve its concept of digital sovereignty, and secondly, based on the interests of China′s digital sovereignty, improve the interpretation of China′s rules for the cross-border flow of personal data. At the international level, the approach of invoking exception rules can be adjusted, and the EU′s practice of "rights based" sovereignty claims in FTAs can be appropriately drawn on.
Key words : digital sovereignty; cross border flow of personal data; GDPR；data localization
引言
數(shù)據(jù)流動超越實體疆域，導(dǎo)致管轄與領(lǐng)土分離。如何在維護本國數(shù)據(jù)利益的同時遏制他國數(shù)據(jù)管轄權(quán)擴張，成為跨境數(shù)據(jù)治理核心挑戰(zhàn)。歐盟是該領(lǐng)域重要且獨特的存在。其2018年頒布的《通用數(shù)據(jù)保護條例》（General Data Protection Regulation, GDPR），以保護歐盟視為基本權(quán)利的“個人數(shù)據(jù)安全”為核心，為個人數(shù)據(jù)跨境流動設(shè)定了高標(biāo)準(zhǔn)保護。此后，歐盟進一步提出“數(shù)字主權(quán)”概念，旨在回應(yīng)其數(shù)字發(fā)展落后于中美、市場受制于美企的現(xiàn)狀，并追求兩大目標(biāo)：保護公民數(shù)據(jù)隱私權(quán)和發(fā)展自身數(shù)字經(jīng)濟。基于此，歐盟對內(nèi)完善GDPR跨境機制，對外通過自由貿(mào)易協(xié)定（Free Trade Agreement, FTA）推廣其規(guī)則并擴張隱私例外，以增強其治理規(guī)則的合法性與效力。
