Study On Privacy Protection Issues In Cross-border Transmission Of Personal Data

The cross-border transmission of personal data is closely related to privacy,as on the one hand,due to the intersection of the scopes of personal data and privacy,in some cases,the cross-border transmission of personal data is equivalent to the cross-border transmission of personal privacy information;on the other hand,it is due to the fact that the cross-border transmission of personal data has objectively enlarged the privacy risk.As the scale of cross-border transmission of personal data continues to expand,the theoretical and practical circles have become increasingly concerned about the issues related to privacy rules in cross-border transmission of personal data.The existing rules on cross-border transmission of personal data cover a long passage when it comes to the purpose,the measures etc.for privacy protection,and the personal data and privacy protection laws of various countries,together with the General Agreement on Trade in Services(GATS)under the framework of WTO,as well as the Free Trade Agreements(FTAs)and specialized Digital Trade Agreements(DTAs)among countries,covering the regulation of digital trade or e-commerce,have also been regarded as an important source of the rules on cross-border transmission of personal data.However,as new digital trade rules have not yet been generated under the WTO framework,and the application of the General Agreement on Trade in Services(GATS)on digital trade issues lacks clear rules,pointing to the fact that countries have output their viewpoints on the privacy regulation path of cross-border transmission of personal data for the purpose of maximizing their own national interests in the establishment of their domestic legal regimes for the protection of personal data and privacy,as well as in the process of trade negotiation,so that the privacy protection issue for the cross-border transmission of personal data is concentrated in the uncertainty of the scale of the rules on the protection of privacy.First of all,at the level of conceptual definition,there are disagreements on the scope of what is covered by privacy in cross-border transmissions of personal data and the path to the realization of such right.There is an inherent ambiguity in the term,privacy,in the context of private law.The current rules on cross-border transmission of personal data explicitly include privacy protection as one of the regulatory purposes,but the object of the specific regulations on privacy is focused on personal data.The models of the protection of the right to privacy and the right to personal data under the domestic laws of various countries vary,with countries represented by the United States adopting a monistic protection model,which defines personal data as private data and places it under a paradigm for the protection of the right to privacy,and countries represented by the European Union adopting a dualistic protection model,which acknowledges the right to personal data as being independent of privacy.China prefers the EU route in its legislation,with the Civil Code distinguishing between the right to privacy and the protection of personal information,and specific legislation for the protection of personal information.Secondly,At the level of specific measures,the specific measures adopted in the rules on cross-border transmission of personal data,which is set for the purpose of privacy protection,have the problem of inappropriate intervention of public power,which is not only reflected in the controversial provisions on impeding cross-border transmission of personal data,requiring the localized storage of personal data,and anti-monopoly regulation of privacy protection,but also in the provisions ignoring the reality of cross-border transmission of personal data and legitimizing the monitoring of personal data of non-nationals in the territory,and in the objective reality of being unable to realize effective regulation in the face of multiple privacy risks brought about by the rapid development of digital technology.Thirdly,at the level of institutional structure,the privacy protection rules of the different mechanisms for cross-border transmission of personal data vary widely,and the privacy protection rules of the different mechanisms for cross-border transmission of personal data are closely related to the degree of the freedom of cross-border transmission of personal data,so that the current competition for legislation on the privacy protection rules for cross-border transmission of personal data actually insinuates the global competition in the digital marketplace.The reason for the uncertainty of the scale of privacy protection rules for cross-border transmission of personal data is mainly due to the lack of one set of legal rules for cross-border transmissions of personal data under the multilateral system in the previous period,but there are differences in the inherent logic of the privacy protection by private laws across countries.Although most civil law countries,such as the European Union,have defined general personality rights in their Constitutions,usually the right to privacy can only be considered as a specific personality right under general personality rights.The structure and content of such rights are relatively fixed and it is not appropriate to expand their interpretation.The United States and other common law countries define privacy right as a civil right,so the right structure is more flat,and the Constitution only provides the principle basis for the right to privacy,and does not specify the scope of the interests protected by the right to privacy and the nature of the right to privacy,and then based on the right to privacy related precedents,it gradually refines and expands the scope of the protection of the right to privacy.This distinction,if reflected in the rules for cross-border transmission of personal data,also shows the differences from country to country in terms of the ordering of the value of the laws on privacy in the context of cross-border transmission of personal data.The rules on cross-border transmission of personal data constructed by the European Union and other civil law countries take privacy protection as a prerequisite and promote the free cross-border transmission of data on the basis of fully safeguarding the privacy rights and interests of individuals.The rules for cross-border transmission of personal data constructed by the United States and other common law countries,on the other hand,take the freedom of data as a prerequisite,and try hard to break down the barriers to digital trade caused by the purpose of privacy protection.Due to deviations in the value and legal status of privacy identified in different jurisdictions,the construction of privacy protection systems,as led by different values,has also resulted in a pattern of cross-border personal data transfers with quite different privacy protection rules.In order to balance the value scales of privacy protection,data security and data freedom in cross-border transmission of personal data,there is an urgent need to clarify the scale of privacy protection rules for cross-border transmission of personal data.Firstly,at the level of conceptual definition,it is necessary to clearly delineate between privacy and personal data,the right to privacy and the right to personal data in the cross-border transmission of personal data,so as to more accurately define the scope of legal protection of privacy in the cross-border transmission of personal data and the path of privacy protection in the legislation.According to existing legal theories and laws,there is an intersection between personal data and privacy,but personal data is not exclusively a subset of privacy,and even in the United States,where there is a broader right to privacy,still there is a growing evident trend to disassociate the right to personal data from the right to privacy.Secondly,at the level of specific measures,we need to pursue the legitimacy of the public power to intervene in the protection of privacy in cross-border transmission of personal data,and on the basis that a new balance between the privacy protection in the rules on cross-border transmission of personal data and other regulatory purposes is re-sought in light of the new situation and new dynamics,we can refine and adjust the path of the public power to intervene respectively,so as to achieve more effective protection of privacy and more sustainable data interactions.Thirdly,at the level of institutional structure,there is a need to eliminate differences in privacy protection rules and to lead the convergence of all national rules on cross-border transmission of personal data and privacy protection.Harmonizing privacy protection rules of different cross-border personal data transfer mechanisms needs to be grounded in reality and promote fairness and mutual benefit while preserving fundamental interests.China’s huge volume of personal data and scientific and technological innovation featured pivotal drive have placed China among the leading countries in the world’s race for the development of the digital economy,allowing more Chinese digital enterprises to "go out" and "talk" to the international market.However,subject to the privacy protection in cross-border personal data transfer,many digital businesses have also suffered frequent setbacks in their offshore development.At present,China’s legislation in the field of cross-border transmission of personal data and privacy protection is still relatively lagging behind compared to that of the United States and Europe.We need to be based on our own national conditions to study the cross-border transmission of personal data and privacy regulations in the United States and the European Union,learn from the legislative experience of the United States and the European Union in related areas,continuously improve the level of privacy protection for cross-border transmission of personal data in our country,and build and improve the cross-border transmission of personal data system that is adapted to the current situation of our country’s development.