《通用数据保护条例》域外效力的规制逻辑、实践反思与立法启示  

Regulatory Logic, Practical Reflection and Legislative Enlightenment on the Extraterritorial Effect of GDPR

作　　者：俞胜杰 林燕萍[1] Yu Shengjie;Lin Yanping(East China University of Political Science and Law,Shanghai,200042)

机构地区：[1]华东政法大学国际法学院,上海200042

出　　处：《重庆社会科学》2020年第6期62-79,共18页Chongqing Social Sciences

基　　金：国家社会科学基金项目“数字贸易国际规则的新发展及中国法律对策研究”(17BFX216);司法部国家法治与法学理论研究项目重点课题“美国经济制裁法律的域外适用与中国对策研究”(19SFB1009);华东政法大学优秀博士论文培育项目“个人数据保护法的域外适用研究”(2019-1-013)。

摘　　要：《通用数据保护条例》(简称GDPR)在立法上扩张地域适用范围。根据"经营场所标准",如果欧盟境外数据控制者或处理者的数据处理行为被认定与欧盟境内经营场所开展的业务存在"无法割裂的联系",GDPR有权管辖该行为;"目标指向标准"适用于欧盟境外的数据控制者或处理者开展针对欧盟境内数据主体的个人数据处理行为。实践中,"经营场所标准"客观上引起不同法域间法律价值冲突,应当运用比例原则进行协调,与"目标指向标准"相配套的"代表制度"存在明显的适用困境。我国应该借鉴GDPR的立法经验,吸收"经营场所标准",将"双重违反原则"引入"目标指向标准",并以此建立双边执法合作机制,充分保护我国公民的个人信息。GDPR expands its territorial scope in legislation.According to the"establishment criterion",if the data processing behavior of data controllers or processors outside EU is found to have"inextricable link"with the activities carried out in the context of the eatablishment within EU,GDPR has the right to govern the behavior;"targeting criterion"is applicable to the personal data processing behavior of data controllers or processors outside EU for data subjects within EU.In practice,the"establishment criterion"objectively caused conflicts of legal values between different jurisdictions,which should be coordinated by using the principle of proportion,and the"representative system"matching with the"targeting criterion"has obvious difficulties in application.China should learn from the legislative experience of GDPR,absorb the"establishment criterion",introduce the"double violation principle"into the"targeting criterion",and establish a bilateral law enforcement cooperation mechanism to fully protect the personal information of Chinese citizens.

关 键 词：地域适用范围 域外效力 云计算 个人信息保护法 立法管辖权 

分 类 号：DF96[政治法律—国际法学]