GDPR下法國與比利時的個人數據保護監管實踐與啓示──基於信息生態系統理論

Regulatory Practices of Personal Data Protection in France and Belgium under the GDPR and Their Implications: Based on Information Ecosystem Theory

歐盟《通用數據保護條例》（GDPR）作為個人數據保護領域最具影響力的法律文本之一，目前已正式生效近四年，對歐盟各國的個人數據保護監管産生了深遠影響。在此過程中所産生的問題與解决措施對我國具有很强的借鑒意義，特別是在《個人信息保護法》全面實施之際。本文以採取“先行先試，兼容並行”與“全面借鑒，毫分縷析”兩種不同策略的法國與比利時為研究對象，從個人數據保護法律法規與監管體系兩個方面分別對兩國在GDPR實施後的個人數據保護監管的實踐進行分析；隨後借助信息生態系統理論對兩國的個人數據保護生態進行建構與比較，發現在相同的GDPR框架下，基於不同的監管策略與實踐，法國形成了大監管、並行制度、重處罰的個人數據保護生態，而比利時則形成了小監管、單一制度、輕處罰的個人數據保護生態；最後，基於兩國監管發展中提煉出的有益經驗，並結合我國的個人數據保護監管現狀，提出相應的政策建議，以期為優化我國個人數據保護監管提供指導。

As one of the most influential legal texts in the field of personal data protection, the General Data Protection Regulation (GDPR) of the European Union has been officially in force for nearly four years, exerting a profound influence on the regulatory practice of personal data protection in EU countries. The problems and solutions emerging in this process can be good references for China, especially when the Personal Information Protection Law is now in full operation. France and Belgium herein are picked out to study, which adopted two different strategies in accordance with their own situation, and the regulatory practices of personal data protection of the two countries are analyzed under the implementation of GDPR from two aspects: personal data protection laws and supervision system. Then with the help of information ecosystem theory, the two countries' personal data protection ecology are constructed and compared, and the fact is found out in the same GDPR framework, that based on the different regulatory policies and practices, France has formed a ecology of big regulation, parallel institution, heavy punishment, while Belgium formed a ecology of small regulation, single institution, light punishment. Finally, based on the useful experience extracted from the regulatory practices of the two countries, and combined with the present situation of personal data protection in China, corresponding policy suggestions are put forward, in order to provide guidance for optimizing the regulatory practices of personal data protection in China.