淺談GDPR的國際衝擊及其可能因應之道

A Brief Discussion on the International Impact of GDPR and Possible Responses

本文針對歐盟2018年5月正式生效的GDPR主要規定內容，予以分析，並且以日本為例，說明各國和歐盟之間如何洽商關於遵守GDPR的程序與相關事務，希望藉此對似乎長期忽略此一國際規範趨勢，但在其正式生效時宣示希望取得適足性認定的臺灣政府，提供參考，以便能有效處理歐盟強化個資保護的現實所帶來的規範衝擊。本文建議，臺灣政府在面對歐盟GDPR所創造的強化個資保護管制架構此一國際規範趨勢時，若想達成獲得歐盟個資保護「適足性認定」的目標，除了針對GDPR相關規定的重點和特色予以徹底掌握之外，應該理解各國如何因應歐盟GDPR所帶來的衝擊，並且觀察其對於國際規範趨勢的影響。如此不僅有助於臺灣獲得歐盟的GDPR適足性認定，對於臺灣應該如何重新整備自己既有的個人資料保護法制與實務，或許也有助益。

This article analyzed the main content of the GDPR, which took effect as of May 2018, and took Japan for example to illustrate how each country may discuss its compliance with GDPR’s procedure and related affairs with the EU. In this way, the foregoing can serve as a reference to our government, which has neglected the said international regulatory trend for a long term with the intent to obtain an adequacy decision after the GDPR entered into force. This article suggested that, to get the adequacy decision while facing the strengthened regulatory framework for personal data created by the EU, Taiwanese government shall familiarize itself with the said Regulation’s features and main issues, understand how other countries respond to the subsequent impact and observe its influence on international regulatory trend. This will not only benefit Taiwan’s endeavor to obtain such decision but may also be helpful for Taiwan to reconsider its current legislations and practice regarding personal data protection.