国际贸易法视阈下数据本地化措施的法律问题研究

【作者】 张明；

【导师】 杨剑；

【作者基本信息】 上海财经大学 ， 国际法学， 2022， 博士

【摘要】 数字互联网技术驱动国际贸易的数字化变革。数据正在成为一种关键的新兴生产要素并在国际贸易中扮演着日渐重要的角色。数据跨境自由流动是全球数字贸易发展的自发过程与必然诉求。然而,与之相伴随,数据本地化措施等限制数据跨境自由流动的国内监管措施正在全球范围内日趋广泛存在。数据本地化措施是各国强制网络内容层中的数据和网络物理层中的数字基础设施存置于其司法和行政管辖范围内或限制数据和数字基础设施向管辖范围外流动的国内监管措施。数据本地化措施的纷繁复杂引发数据本地化国际规则的兴起。回溯数字贸易规则的发展进程,数据本地化国际规则传承于传统国际贸易规则并同时衍生出一系列新的争议与分歧。深刻挖掘各国间理论与实践分歧,数据本地化措施是数字贸易发展进程中一系列贸易自由化利益与非贸易利益冲突的客观表象与现实体现。第一,数据本地化措施体现出贸易自由化与国内监管自主权之间的冲突。贸易自由化与国内监管自主权之间的矛盾是国际贸易中的固有矛盾。而数据本地化措施即是这一固有矛盾在数字贸易时代的全新体现。尽管国内监管措施潜在抑制了贸易自由化的实现,但无论WTO抑或其他自由贸易协定均承认国内监管措施存在的必要性。中立技术的无序使用与自由贸易的非理性无疑凸显出数字贸易时代国内监管措施的迫切需要。在此背景下,数字贸易的良性发展有赖于国内监管措施与贸易自由化之间的相互制衡,也有赖于两者之间的适当协调。置于国际贸易法视阈下,数据本地化措施的合理边界在于不构成不必要的贸易限制。基于“比例原则”的要求,参照“要素权衡分析”路径予以判断,数据本地化措施的必要性标准测试应当具体考量成员方所追求的利益或价值的重要程度、争议措施对政策目标达成的贡献程度、争议措施的贸易限制程度以及成员方对公共利益和价值保护的程度和更少贸易限制性替代措施五项基本要素。基于此,以中国《网络安全法》和《数据安全法》等法律法规中的数据本地化措施为范本考察,中国所执行的数据本地化措施是为了实现国家安全和个人数据隐私保护所必要,相关措施的实施具有合理性,并未构成不必要的贸易限制。基于发展的视角看,作为国内监管措施之数据本地化措施的纷繁复杂亟待全球层面的协调,而实现“监管一致性”则是其发展的应然目标。迈向“一致性”的数据本地化措施,在国内层面应当探索良好监管实践,提升数据本地化措施制定全流程的透明度,完善数据本地化措施的监管影响评估并关注国内相关监管措施的整体协调与平衡。而在国际层面,为实现数据本地化措施的协调一致,各国应当综合各方之间的利益探索以实现数据本地化措施的监管趋同。第二,数据本地化措施体现出贸易自由化与国家基本安全利益之间的冲突。国家基本安全利益是各国在国际贸易中的核心考量因素。而安全例外条款即是国际贸易试图实现贸易自由化与国家基本安全利益平衡的制度安排。进入数字互联网时代,网络安全和数据安全成为了各国在国家基本安全利益考量中的重中之重。在此背景下,数据本地化措施日趋成为数字贸易时代各国维护其本国网络安全和数据安全的实践举措。然而,晚近的实践表明,国家安全的概念正在被越来越多的国家所泛化适用进而对国际贸易的自由化发展产生了负面影响。同时,由于安全例外条款的模糊性以及数据本地化措施的新颖性,数据本地化措施能否以及如何适用安全例外条款仍然存在不确定性。对此,从条约解释的角度看,沿循演化解释的理念并综合条约解释的方式而展开,网络安全和数据安全可被解释为是一国的“基本安全利益”。而就条约的适用而言,数据本地化措施援引安全例外条款具有合法性和可行性。尽管依据安全例外条款,国家对其基本安全利益享有自决权。但是,对国家安全自决权的尊重具有客观的容忍限度。为了避免安全例外条款的滥用而有悖于贸易自由化发展的基本宗旨与理念,实施数据本地化措施在援引安全例外条款时应当遵循善意原则的要求。以此为标准进一步反思美国政府在Tik Tok事件中所采取的一系列实践措施,美国政府在Tik Tok事件中所采取的措施尚存诸多的现实问题且无法满足安全例外条款中所明确规定的一系列要件。第三,数据本地化措施体现出贸易自由化与数据隐私保护之间的冲突。学界研究和既有实践表明,美欧双方在数据跨境自由流动和数据隐私保护之间的重要性和优先性问题上存在分歧进而形成了差异化的监管路径选择。这种迥异的监管路径凸显出贸易(贸易自由化)与人权(数据隐私权)这一贸易联结议题在数字贸易时代的全新体现。而数据本地化措施即是这一贸易联结议题的现实体现和矛盾焦点,也是实现贸易自由化与数据隐私权协调发展的重要平衡点。数字贸易时代,数字贸易自由化与数据隐私权的关系互动与路径选择是实现数据本地化措施理性发展的理论前提。从两者关系互动看,数据隐私权的权利理念为平衡贸易利益和隐私权益提供了指引、评价功能,亦为数据本地化措施的发展提供了一定的理论支持,有利于数字贸易的良性健康发展和数字贸易规则的优化完善。理性看待两者间的关系互动,在现行条件下试图将贸易与人权议题置于同一框架体系存在其固有难度。因此,贸易自由化与数据隐私权的互动仍然适宜分置于两个独立的体系之内。通过两个独立体系内的互动发展,有利于实现贸易自由化规则与数据隐私保护规则的相互磨合,进而有助于共同推动两者之间的发展。回归贸易法视阈下,有鉴于数据隐私保护在数字贸易发展中的关键地位,无论在双边、区域抑或诸边层面,致力于实现两者间平衡与协调的努力始终在推进当中。国际贸易规则中的一般例外条款仍然是适用于基于数据隐私保护目的而实施数据本地化措施的最直接规定。而这一条款在晚近的诸多自由贸易协定中也得到了继承和发展。对标GATS一般例外条款,以欧盟GDPR为样本分析,GDPR中的相关措施能够符合GATS一般例外的法律内涵,其本身不会对数字贸易造成变相的限制和歧视。作为全球冉冉升起的数字贸易大国,面向数据本地化措施,中国既应当优化自身的数据本地化国内规则,也应当更有建设性的推动数据本地化国际规则的完善。这既是数字贸易时代中国维护自身核心利益的现实需要,也是中国参与全球数字贸易的客观要求。从国内层面看,中国优化数据本地化国内规则应当妥善平衡好贸易自由化利益与国内监管自主权、国家基本安全利益和数据隐私保护三组非贸易利益之间的关系。就国内监管而言,在坚守国内监管自主权之底线的基础上,中国应当以贸易自由化为引领优化数据本地化国内规则。就国家基本安全利益而言,中国应当转变过度防范的价值取向,厘清数字贸易环境下国家安全的基本考量,并以此为准照完善国内规则的构建。就数据隐私保护而言,中国的数据隐私保护立法应当基于贸易自由化理念,参照数据隐私国际保护标准以优化自身的数据隐私保护规则。而从国际规则层面看,中国应当以尊重监管自主权和推动贸易自由化为根本立场,以实现贸易自由化利益与非贸易利益的平衡为目标倡导构建附条件的数据本地化国际规则,并通过推动传统贸易规则在数字贸易时代的精准解释和正确适用而逐步推动数据本地化措施在全球范围内的有效平衡。如此,中国才能更具建设性和更为有效地参与全球数字贸易治理。更多还原

【Abstract】 The vigorous and incremental development of digital technology drives the digital transformation of international trade.As an emerging factor of production,data is playing an important and even indispensable role in international trade.In this context,the free flow of data across borders is the spontaneous process and inevitable demand for the development of global digital trade.Meanwhile,the measures which restrict the free flow of data across borders are becoming widespread around the world increasingly.Some of them are the data localization measures.Data localization measures are measures implemented by the countries to force data in the cyber content layer and digital infrastructure in the cyber physical layer to reside in their jurisdictions,as well as measures to restrict the flow of data and digital infrastructure outside their jurisdictions.The complexity of data localization measures has led to the rise of international rules for data localization measures.Examining the development process of digital trade rules,the international rules for data localization measures are inherited from the traditional international trade rules.At the same time,these new rules also derive a series of new contradictions and arguments to be discussed further.Exploring the differences between the countries,data localization measures are the objective and realistic manifestations of a series of conflicts between trade liberalization interests and non-trade interests(domestic regulatory autonomy,essential security interests and data privacy protection).Based on the idea mentioned above,the article takes the relationship and conflict between trade liberalization interests and non-trade interests as the clue.Firstly,data localization measures reflect the conflict of interest between trade liberalization and domestic regulatory autonomy.Frankly speaking,the conflict between them is an inherent contradiction in international trade.Data localization measures are the new manifestation of this inherent contradiction in the era of digital trade.Although domestic regulatory measures inhibit the realization of trade liberalization potentially,both the WTO and other Free Trade Agreements(FTAs)recognize the necessity of domestic regulation.For digital trade,the disorderly use of neutral technology and the irrationality of free trade undoubtedly highlight the urgent demand of domestic regulatory measures in the digital trade era.In this context,the benign development of digital trade depends on the mutual checks and balances between domestic regulation and trade liberalization,as well as on the appropriate coordination between them.This is essential for the development of digital trade.Under the vision of international trade law,the reasonable boundary of data localization measures is the measures that do not constitute unnecessary trade restrictions.Based on the requirement of the "proportionality principle" and judged along with the path of " weighing and balancing" test,the necessity test of data localization measures should specifically consider the following basic elements: “relative importance of the common interests or values that the measures to be enforced is intended to protect”,“the extent to which the measure contributes to the realization of the policy objective pursued”,“the extent to which the measure produces restrictive effects on international commerce”,“the relative importance of the common interests or values that the measures to be enforced is intended to protect”,and “whether there is an alternative measure that would achieve the same objective and that is less restrictive of trade than a prohibition”.Based on this,selecting the data localization measures in China "Cyber Security Law" and "Data Security Law" as a model,the data localization measures implemented by Chinese government are necessary to achieve national security and personal data privacy protection.The implementation of relevant measures is reasonable and does not constitute unnecessary trade restrictions.From a development perspective,the complexity of data localization measures requires coordination globally.At domestic level,in order to achieve the “coherence” of data localization measures,it is necessary to explore good regulatory practices,enhance the transparency of the data localization measures,improve the regulatory impact assessment of data localization measures,and focus on the overall coordination and balance of relevant domestic regulatory measures.At the international level,it is necessary for the countries to integrate the interests of various parties.The Countries should integrate the interests of each other to explore the coordination and convergence of data localization measures.Secondly,data localization measures reflect the conflict of interest between trade liberalization and the essential security interests.All countries attach great importance to essential security interests in international trade.The security exception clause is the institutional arrangement in which international trade attempts to balance trade liberalization and the essential security interests.In the digital era,network security and data security have become the top priority of all countries in considering the essential security interests.Therefore,data localization measures are becoming practical measures for countries to maintain their own network security and data security in the digital trade era.However,the recent practice shows that the concept of national security is being abused by more and more countries.This has had a negative effect on the liberalization of international trade.Moreover,due to the ambiguity of security exception clauses and the novelty of data localization measures,there is still uncertainty about whether and how data localization measures can be applied to security exception clause.This issue is crucial.From the perspective of treaty interpretation,following the concept of evolutionary interpretation and integrating treaty interpretation method,network security and data security can be interpreted as a country’s “essential security interests”.From the perspective of the application of the treaty,it is legitimacy to invoke security exception clauses in data localization measures.In accordance with the security exception clause,each country enjoys the right to selfdetermination in its basic security interests.However,the exercise of the right also has an objective tolerance limit.In order to avoid the abuse of security exception clauses that goes against the basic purpose and philosophy of trade liberalization,the implementation of data localization measures should follow the requirements of the principle of good faith.The Tik Tok case is closely related to the issue of essential security interests.In the Tik Tok case,the measures taken by the U.S.Trump Administration are still problematic and fail to meet the requirements of the security exceptions clause which stipulated in international trade law.The series of measures taken by the US administration undoubtedly requires further reflection and review prudently.Thirdly,data localization measures reflect the conflict of interest between trade liberalization and data privacy protection.The practice shows that the U.S.and Europe are holding nearly opposite opinion on the priority between the free flow of data across borders and data privacy protection.This has also led to a differentiated choice of regulatory paths between them.The academic community has also paid attention to this issue.This article argues that such divergent regulatory paths are the new portrayal of the “trade and…” between trade(trade liberalization)and human rights(data privacy)in the digital trade era.However,data localization measures are not only the realistic manifestation of this “trade and…” but also an important balance point to realize the harmony of trade liberalization and data privacy.In the era of digital trade,the interaction between digital trade liberalization and data privacy is a theoretical premise for the development of data localization measures.Data privacy provides guidance and evaluation functions for balancing trade interests and privacy rights,as well as provides certain theoretical support for the development of data localization measures which is conducive to the healthy development of digital trade and the optimal formulation of digital trade rules.As far as the interaction is concerned,there are inherent difficulties in attempting to place trade and human rights issues in the same framework system.Therefore,the interaction between trade liberalization and data privacy is still appropriate to be separated into two independent systems.Through the interaction within these two independent systems,it is conducive to the mutual integration of trade liberalization rules and data privacy protection rules,which in turn helps to jointly promote the development of both.Returning to the perspective of international trade law,in view of the key position of data privacy protection,the trade arrangement is paying attention to achieve the balance and coordination between these two are always in progress.The general exception clauses in international trade rules are still the most direct provisions applicable to the implementation of data localization measures for the purpose of data privacy protection.This clause has also been inherited and developed in many recent FTAs and undoubtedly has an important guiding role in practice.A series of measures under GDPR are aimed at realizing data privacy protection.Based on the GATS general exception clauses,the relevant measures stipulated in the GDPR can comply with the legal connotation of GATS general exceptions and will not impose disguised restrictions and discrimination on digital trade.As a rising country in the world,facing data localization measures,China should optimize its own domestic rules for data localization measures and promote the improvement of international rules for data localization measures more constructively.It is not only a practical demand for China to safeguard its core interests in the era of digital trade but also an objective requirement for China to participate in global digital trade.This issue is complex and needs to be considered specifically at both the domestic and international levels.At the domestic level,China should properly balance the interests of trade liberalization with the autonomy of domestic regulation,the essential security interests and the protection of data privacy.In terms of domestic regulation,based on the concept of trade liberalization,China should improve its domestic rules on data localization based on the bottom line of domestic regulatory autonomy.The concept of trade liberalization is of vital importance to China.In terms of essential security interests,China should change the value orientation of excessive prevention,clarify the basic considerations of national security in the digital trade as a reference to construct domestic rules.As far as data privacy protection is concerned,China’s data privacy protection legislation should be based on the concept of trade liberalization and optimize its own data privacy protection rules by referring to international data privacy protection standards.In this way,China’s domestic rules for data localization measures will be more sustainable and responsive to the trend of digital trade.From the perspective of international rules,China should emphasize respecting regulatory autonomy and promoting trade liberalization as the fundamental position to improve the construction of rules.On this basis,China may consider advocating the construction of conditional international rules on data localization with the goal of achieving a balance between the interests of trade liberalization and non-trade interests.Furthermore,China should gradually promote the effective coordination of data localization measures globally by promoting the precise interpretation and correct application of traditional trade rules in the digital trade era.In this way,China can participate in the global governance of digital trade more constructively and more effectively.更多还原