台灣跨境資料傳輸—聚焦以契約方式作為隱私權保障工具

Cross Border Data Transfer —Focus on Contractual Clauses as a Transfer Tool for Privacy Protection

董芃旻(Tung Peng-Min)

指導教授 ： 劉定基

國立政治大學/法學院/法律學系/碩士(2022年)

https://doi.org/10.6814/NCCU202201509

摘要

資料的自由流動是國際貿易的基石，跨境傳輸所分享的資料構築了商業交易的基礎，也藉此促進國際之間的合作，一旦國際資料傳輸機制發生任何變化，都將帶來重大的影響，因為這意味著具有新的合規要求，複雜之餘，有時甚至採取和先前完全不同的模式。除此之外，正因發展程度和隱私概念的不同，各個國家和區域間對於國際資料傳輸也都採取不同的治理模式，企業們也因而需要不斷關注個資領域中具有指標性意義法規範的變化。
歐洲聯盟法院在2020年針對歐美跨境資料傳輸做出了一個具有里程碑意義的決定，其雖然將隱私盾決定宣告無效，但仍然認定歐盟執委會所做出有關標準契約條款的決定是有效的，歐美之間將可以繼續使用契約方式進行跨境資料傳輸；在這樣的前提下，此份判決提出了關於資料保護標準的補充措施要求，也開始關注資料輸出者、資料輸入者在面臨當地法律和政府近用要求影響遵守契約時的相關責任。除此之外，判決也延伸出有關資料保護的補充性措施和GDPR第3條域外效力與第5章國際傳輸間適用關係的討論。歐盟既然身為台灣重要的政經夥伴之一，本論文也將為做為資料輸入者的台灣企業分析此份最新SCCs設計內容及契約遵守上需注意的議題。
本論文除關注台灣做為歐盟資料輸入者的腳色外，也同樣關心應如何安全且不喪失原先應有保護程度地輸出台灣資料至境外第三國。為了透徹研究如何以契約作為資料保護工具，本論文除歐盟標準契約條款外，也一併研究了東南亞國協和紐西蘭的契約版本，並最終提出台灣自有的國際資料傳輸契約條款。

關鍵字

國際資料傳輸 ； 跨境資料傳輸 ； GDPR第45條 ； GDPR第46條 ； 標準契約條款 ； 個人資料保護 ； 補充措施 ； 當地法律影響合規 ； 當地政府近用資料

並列摘要

The free flow of data is the cornerstone of international business. Through cross border data transfer, data sharing underpins business transactions and supports international cooperation. Any change to the scheme of international data transfer will have far-reaching impacts, as they usually bring up new compliance requirements, which can be complex and sometimes even totally different than before. Furthermore, with different levels of development and mindset of privacy, countries are taking diverging approaches to govern international data transfers. Hence, companies must keep tracks of the change of leading legislations.
In 2020, the European Court of Justice, again, delivered a landmark decision, which deals with international data transfers between the European Union and the United States. The so-called Schrems II judgment, on the one hand, invalidates the Privacy Shield agreement, while, on the other hand, upholds the commission’s decision on standard contractual clauses (SCCs) for the transfer of personal data to a third country. Data transfer from the EU to the US after Schrems II could keep using SCCs as a compliance tool. The judgment, however, has significant implications for the data protection requirements and the responsibility of data exporters and data importers, especially when local laws and government access requests affect the compliance with the SCCs. In addition, the application of SCCs also raises further discussions about new data protection supplementary measures and the relation between article 3 and chapter 5 of the GDPR. As EU is one of Taiwan’s important economic and political partners, this study, therefore, analyzes the latest developments of SCCs and relevant compliance issues for the company as a data importer in Taiwan.
This study has focused on not only how to import personal data from the EU but also how to export Taiwan’s personal data safely and maintain the same level of protection to other third countries. In order to thoroughly understand how to adopt contractual clauses as a compliance tool for data protection, in addition to EU’s SCCs, this study further analyzes Model Contractual Clauses from The Association of Southern Asian Nations and the Model Contract from New Zealand. In the end, this study will propose Taiwan’s own standard contractual clauses for international data transfer.

並列關鍵字

International data transfer ； Cross border data transfer ； Article 45 and 46 of GDPR ； Standard contractual clauses ； Personal data protection ； Supplementary measures ； Local laws affecting compliance ； Obligation in case of local government access requests

參考文獻

一、 中文文獻

（一） 專書

李惠宗（2015），憲法要義，7版，台北：元照。

法治斌、董保城（2020），憲法新論，7版，台北：元照。

Brad Smith，Carol Ann Browne著，孔令新譯（2020），未來科技的15道難題，台北：商周。[Brad Smith, Carol Ann Browne. 2020. Tools and Weapons: The Problem and the Peril of the Digital Age. London: Hachette UK.]