論我國因應GDPR施行之措施──以個人資料之跨境傳輸為核心議題

On Government’s Responses to the Implementation of the GDPR: From Perspectives of Personal Data Cross-Border Transfer

歐盟於2016年通過、2018年5月正式施行之歐盟一般資料保護規則（General Data Protection Regulation，以下簡稱GDPR），因其域外效力與提高罰責，故受到產業關注。又，GDPR對於將個人資料之跨境傳輸採取「原則禁止、例外允許」之原則，對於因業務需求，而有需要將歐盟境內居民之個人資料傳輸至我國境內者，將產生一定之影響。本文以個人資料之國際傳輸為核心，探討我國如何因應GDPR之施行。就歐盟、資料接收國與企業之成本分配來看，其於我國政府因應GDPR跨境傳輸規定時，將產生不同的因應策略，而如果我國可以與歐盟洽談，經其認定我國對於個人資料之保護係與其程度相當，則我國企業於將個人資料從歐盟境內傳輸至我國境內時，所必須支付的法令遵循成本相較於其他情形是較低的。是以，本文進一步討論以和歐盟洽談，請其認定我國個人資料保護為有適當程度之保護，使歐盟境內之個人資料得以自由流動至我國，俾利我國產業各類商務行為之進行。此外，並就歐盟為認定個人之資料保護是否達適當程度考量進行說明，同時分析我國個人資料保護現況是否足資因應，最後研提相關建議。

Promulgated in 2016, the EU has officially implemented the General Data Protection Regulation (hereinafter the“GDPR”) in May 2018. Due to its increase of penalty and extraterritorial effect, the business industry has grave concerns over its enforcement. The GDPR adopted the principle of Verbot mit Erlaubnisvorbehalt of personal data cross-border transfer; that is, to prohibit in principle, to permit by exception. So far as business needs is concerned, were personal data of the EU’s residents required to be transferred to our territory through cross-border transfer, which would have certain significant impacts. This paper centered upon the issue of how the government responds to the implementation of the GDPR from the perspectives of cross-border transfer of personal data. Considering the allocation of costs or resources among the EU, the data recipient countries as well as the business enterprises, various strategies could be taken by our government to deal with these cross-border transfer regulations. If our government could further negotiate with the EU on the adequacy decision of our personal data protection, whereupon cross-border transfer of personal data to our territory would have a relatively low compliance cost in contrast to other circumstances, free movement of the EU’s personal data would hence flow into our territory to facilitate the conduct of all sorts of business behaviors or transactions for our industries. This paper also elaborated whether the EU should deem appropriate as to the adequacy decision of our personal data protection, and analyzed our current stand in response to the GDPR’s requirements. Finally, a suggestion and conclusion would be made.