The confusion of EU regulations on crossborder flow of personal data from the perspective of digital sovereignty
Cai Yacen
Law School, Jilin University
Abstract： Guided by digital sovereignty, the European Union has improved the internal mechanism of GDPR and promoted its crossborder rules for personal data through FTA, and expanded privacy exception clauses to enhance the effectiveness of the rules. However, its regulation has led to the localization of "soft" data, which is not conducive to maintaining digital sovereignty. The root of the problem lies in the dual nature of the EU′s digital sovereignty goals—protecting citizens′ privacy while promoting the development of the digital economy, which are inherently conflicting. At the same time, the relativist sovereignty application model adopted by the EU is inconsistent with the digital sovereignty interests of most economies, which can easily trigger resistance and further undermine its sovereignty goals. In view of this, China should firstly improve its concept of digital sovereignty, and secondly, based on the interests of China′s digital sovereignty, improve the interpretation of China′s rules for the cross-border flow of personal data. At the international level, the approach of invoking exception rules can be adjusted, and the EU′s practice of "rights based" sovereignty claims in FTAs can be appropriately drawn on.
Key words : digital sovereignty; cross border flow of personal data; GDPR；data localization
引言
數(shù)據流動超越實體疆域，導致管轄與領土分離。如何在維護本國數(shù)據利益的同時遏制他國數(shù)據管轄權擴張，成為跨境數(shù)據治理核心挑戰(zhàn)。歐盟是該領域重要且獨特的存在。其2018年頒布的《通用數(shù)據保護條例》（General Data Protection Regulation, GDPR），以保護歐盟視為基本權利的“個人數(shù)據安全”為核心，為個人數(shù)據跨境流動設定了高標準保護。此后，歐盟進一步提出“數(shù)字主權”概念，旨在回應其數(shù)字發(fā)展落后于中美、市場受制于美企的現(xiàn)狀，并追求兩大目標：保護公民數(shù)據隱私權和發(fā)展自身數(shù)字經濟?；诖?，歐盟對內完善GDPR跨境機制，對外通過自由貿易協(xié)定（Free Trade Agreement, FTA）推廣其規(guī)則并擴張隱私例外，以增強其治理規(guī)則的合法性與效力。
