歐盟個人資料保護治理之變遷：從《資料保護指令》到《一般資料保護規則》

個人資料保護治理為這幾年來炙手可熱的議題之一，其在歐盟境內以歷經有逾廿年治理進程。本研究探討自1995年《資料保護指令》通過後，歐盟個人資料保護治理之變遷，相關資安事件之挑戰，與2016年立法通過的《一般資料保護規則（以下簡稱：GDPR 法）》。本研究欲先進行兩個法規的比較，觀察出歐盟對於個人資料保護的基本想像，再以《GDPR 法》為例。並將資料保護治理置於「多層次治理」框架的方式進行解釋，試圖區分出不同的治理行為者。本研究好奇，《資料保護指令》制定後，歐盟個人資料保護法令進一步整合，促進整合的倡議來源，已不似過去由次級行為者以及跨國倡議團體為主力，反倒是執委會具有政策資源與建立管制網絡的能力，方得《GDPR 法》起草。另一方面，歐洲議會由隨著歐洲整合，獲得更多的立法權力外，其日漸扮演積極保護個資的角色。最後，從跨國遊說團體積極對於超國家組織——執委會與議會進行立法遊說，資料保護治理已躍升成為聯盟間的議題，跳脫國家層級，個資保障議題在歐盟境內成為傳統左派與右派——基本權保障與經濟整合的議題，而非會員國與超國家機構對於治理管轄權界定的議題。也因為歐盟的體制建構，使得各層級不同的行為者皆參與著個人資料保護治理過程，使得新法得已出台，個資保護概念亦有新的意義。

關鍵字

一般資料保護規則；個人資料保護治理；多層次治理；歐盟；執委會；歐洲議會

並列摘要

The governance of data protection is the topic of the day; especially, in the European Union, there has been nearly 20-year of history of governing personal data. In this thesis, it is intended to get into the nitty-gritty of the aftermaths the legislation of 1995’s Data Protection Directive, including the challenges that EU faced in such course of data protection, and the beginning of the legislative process of 2016’s General Data Protection Regulation, or GDPR, which was later served as the replacement of 1995’s Data Protection Directive. The thesis is separated into two parts; in the first part, we lays out the difference of the outgoing and incoming data protection of the EU. In the second part of the research, we are intended to narrow down these differences by observing the legislative process of GDPR. By the help of the approach of Multi-level governance, it also grants clear picture of the identification of different actors from different levels in the EU. After the enacting of Data Protection Directive, following the integration of the EU, sub-national actor, such as Data Protection Agencies, gradually lost their say on such issue. On the other hand, supra-national actors, such as the EU Commission and the European Parliament are gaining their authority and power over the topic of data protection. The interest groups, which can easily transcend the traditional national borders, were also teamed up with each other in the EU level for getting involved in the legislative process of GDPR. Data Protection Issue in EU is becoming an issue of left-right ideology spat instead of fully national concerns. Most importantly, the systemic design of the EU allows all actors to chip in either the governance of data protection or the legislative progress of the new data protection law—GDPR.