个人信息“可携带权”在电商领域的实施困境与法律保障路径——以跨平台用户数据迁移为例

The Implementation Predicament and Legal Protection Path of the “Right to Data Portability” of Personal Information in the E-Commerce Field—Taking Cross-Platform User Data Migration as an Example

摘要: 《个人信息保护法》第四十五条给予了个人信息可携带权的原则性规定，该条款加强了数据主体对其个人信息的控制力度，使得数据跟随主体自由流动拥有了法律基础。但在现实中，该原则性规定的落实在电商行业这种数据高度集中且竞争残酷的环境中显得困难重重。本文尝试以跨平台用户的数据迁移情形为重点进行讨论，从整体来分析影响可携带权在电商行业实施效果的因素。首先，在技术层面，数据格式的标准与接口并不统一使得操作困难，最终造成较高的迁移成本；其次，在法律层面，“个人信息”与“衍生数据”的划分困难导致权利边界模糊，以及有可能造成对第三方知识产权、商业秘密等权益侵害；最后，在商业层面，平台缺乏合作动力，担忧因迁移导致数据资产流失。为解决上述困难，本文提出建立系统化的法律保障通道：首先，出台行业细则以明确可携带的数据范围与格式标准，与此同时引入“数据受托人”模式，建立安全且高效的中介迁移平台。其次，以“合理、有限、诚信”为原则建立能够平衡数据主体权益、平台利益和市场竞争秩序的多元治理模式，最终希望能够使得纸面上的可携带权变成现实中的权利。

Abstract: Article 45 of The Personal Information Protection Law provides a principle-based provision on the right to carry personal information. This clause strengthens the control of data subjects over their personal information, providing a legal basis for the free flow of data along with the subjects. However, in reality, the implementation of this principle-based regulation is fraught with difficulties in the e-commerce industry, where data is highly concentrated and competition is fierce. This article attempts to focus on the data migration situation of cross-platform users for discussion, and analyze the factors influencing the implementation effect of portability rights in the e-commerce industry as a whole. Firstly, at the technical level, the lack of uniformity in data format standards and interfaces makes operation difficult and ultimately leads to high migration costs. Secondly, at the legal level, the difficulty in distinguishing between “personal information” and “derivative data” leads to blurred boundaries of rights and may cause infringement of the intellectual property rights, trade secrets and other rights and interests of third parties. Finally, at the business level, the platform lacks the motivation to cooperate and is worried about the loss of data assets due to migration. To address the aforementioned difficulties, this paper proposes to establish a systematic legal protection channel: Firstly, industry regulations should be issued to clarify the scope and format standards of portable data. At the same time, the “data trustee” model should be introduced to build a secure and efficient intermediary migration platform. Secondly, a multi-governance model that can balance the rights and interests of data subjects, the interests of platforms and the market competition order should be established based on the principles of “reasonableness, limitation and good faith”. Ultimately, it is hoped that the portable rights on paper can be turned into real rights.