論資料在地化立法

Legal Study on Data Localization

在網路重要性與日俱增下，各國出於內國執法、公民保護、經濟發展或防制境外監測等因素而推動不一的資料在地化立法。資料在地化泛指要求特定實體須將資料儲存於特定地理區域內之任何法律、標準或政策，若以有無造成在地化效果之現實作用觀點為度，則資料跨境傳輸限制措施亦被視為資料在地化之可能作法。各國執政者推動資料在地化立法的目的與考量因素往往不盡相同，無論是數位主權的維護抑或民眾福祉的保障均有其正當性，惟資料在地化措施可能變相地影響內國、國際經貿發展同時造成網路的割裂現象卻也是不爭之事實。面對資料在地化造成的網路割裂等問題，受關注者包括立於WTO體系架構與自由貿易協定框架所進行全球性共通規範討論，近期已有國際多邊協定明文禁止資料在地化措施，亦有論者倡議以「跨境傳輸合理限制」取代強制性或立場偏頗的資料在地化規範。現階段國內並無廣泛針對特定資料要求應儲存於境內或限制其跨境傳輸之專門立法；就部門立法而言，涉及在地化要求者亦堪稱罕見。考量資料在地化本身是一個複雜且多層次的現象，本文建議國內於推動任何在地化立法時，應對於所欲達成之目的及潛在之負面效有著充分的認識與評估，並應納入「形式選擇」、「對象選擇」及「效果選擇」三個不同面向的評估事項，以避免不當在地化情形之出現。

"The borderless nature of the Internet has enabled the development of the digital economy and revolutionary technical innovations. The free flow of data is essential to the growth of the digital economy and to unlocking the full potential of data driven industries. As data is seen as a valuable resource and considering the needs of digital sovereignty, the pursuit of economic benefits and the protection of civil liberties, Governments may decide to promote data localization laws. Data localization laws that may require companies to physically store personal data or limit cross-border data flows already exist in various forms and degrees in several developed and developing countries. Though data localization has some benefits, there are even more disadvantages that might affect the industries on a large scale and highly likely to fragment the internet resulting in inefficiencies and greater costs. The strongest criticism of data localization laws is that they use the mask of enhanced cyber security or citizens’ privacy concerns to conceal the real motivation of national protectionism. The recent researches show the prospects for broad and binding international rules on data flow are dim and the need to find an alternative to data localization. This article will first discuss the nature, benefits and models of data localization requirements, then analysis the current situation of main countries’ related laws and regulations. On the basis of above, this article will try to point out the possible solutions solving related issues raised by data localization laws and avoiding the balkanisation of the internet and finally puts forward suggestions toward domestic legislation."