域外管轄規則下的代表制度：歐盟GDPR的實踐與啟示

The Representative System under the Extraterritorial Jurisdiction Rules: Practices and Enlightenment of the EU GDPR

制定個人數據保護法的域外管轄規則已成為各國立法的共識，而代表制度作為域外管轄規則的制度銜接，專門解決未在境內設立實體的境外數據控制者或處理者的法律域外執行問題。歐盟GDPR在全球範圍個人數據保護立法領域具有標杆地位，對其代表制度的研究可為中國提供有益經驗借鑒。不容忽視的是，代表制度存在實踐利用程度低、執法成本高、執法實效缺乏保障等實施困境。對此，可以探索通過培育代表的供需市場、適當增加代表的責任承擔能力予以紓解。中國應當正確認識中歐代表制度的差異，在後續立法中明確代表制度的功能定位，細化代表的職責，通過多種路徑共同保障個人信息保護法律域外執行的實效。

The making of extraterritorial jurisdiction rules of the personal data protection laws are widely accepted by states, and following the extraterritorial jurisdiction rules, the representative system is a key mechanism to address the challenges of enforcing laws on data controllers or processors who have no establishment within the territory. The EU GDPR is a leading model for global personal data protection legislation, and its representative system can offer valuable insights for China. it can not be ignored that the representative system faces some implementation difficulties, such as low rate of utilization, high enforcement cost, and lack of guarantee for the effectiveness of enforcement. These can be mitigated by cultivating the representative’s supply and market demand, increasing the representative’s constructive liability appropriately to unlawful actions of data controller or processor. China shall recognize the differences with the EU’s representative system, clarify the function and obligations of the representative system in future legislation, and cooperate with other approaches to ensure the effectiveness of the extraterritorial enforcement of personal information protection laws.