我国跨境数据流通的合规困境与机制完善

Compliance Predicaments and Institutional Improvement of Cross-Border Data Flows in China

摘要: 数字经济时代，跨境数据流通成为数字贸易、跨国经营、国际科研合作的重要方式。我国已经建成由《网络安全法》《数据安全法》《个人信息保护法》为基础，配套部门规章共同构成的数据出境规范体系，确立安全评估、个人信息出境标准合同、个人信息保护认证三类并行合规路径，《促进和规范数据跨境流动规定》进一步细化豁免情形，力图实现安全前提下的数据有序流动。但从已公开司法裁判、网信与公安网安部门行政处罚案例观察，现行机制在合规路径边界识别、市场主体合规负担、个人信息主体跨境权利救济、国际规则对接层面，仍然存在机制落地的现实障碍。本文以已公开可溯源的司法、监管案例为实证样本，运用规范分析、案例实证、比较法研究方法，梳理机制运行中的真实矛盾，结合域外成熟治理经验，提出细化规则解释、实施分层分类监管、完善权利救济机制、参与全球数字规则对话等完善路径，谋求国家安全、个人信息权益保护与数字经济发展多重法益的动态平衡。

Abstract: In the era of the digital economy, cross-border data flows serve as a vital vehicle for digital trade, transnational operations and international scientific research cooperation. China has established a data outbound regulatory system grounded in the Cybersecurity Law, Data Security Law and Personal Information Protection Law, supplemented by supporting ministerial rules. Three parallel compliance routes have been formulated, namely security assessment, standard contracts for outbound transfer of personal information, and personal information protection certification. The Provisions on Promoting and Regulating Cross-border Data Flows further elaborates exemption scenarios to pursue orderly data flows under security premises. Nevertheless, an examination of publicly available judicial judgments and administrative penalty cases issued by cyberspace and public security network security authorities reveals practical obstacles in institutional implementation, including ambiguity over the boundaries of compliance routes, heavy compliance burdens on market entities, inadequate cross-border remedy mechanisms for personal information subjects, and poor alignment with international rules. Taking publicly traceable judicial and regulatory cases as empirical samples, this paper adopts normative analysis, case-based empirical research and comparative law approaches to sort out real conflicts arising from institutional operation. Drawing on mature governance experience overseas, it proposes improvement measures such as refining rule interpretation, implementing tiered and classified regulation, perfecting right remedy mechanisms, and engaging in dialogue on global digital rules, so as to achieve a dynamic balance among multiple legal interests: national security, protection of personal information rights and interests, and development of the digital economy.