第二名/連浩鈞/論我國跨境資料傳輸法制與個人資料保護委員會因應GDPR之建構
| 姓 名 | 連浩鈞 |
| 獎 項 | 第二名 |
| 學、經歷 | 國立政治大學法研所公法乙組 |
| 作 品 | 論我國跨境資料傳輸法制與個人資料保護委員會因應GDPR之建構 ─從歐盟法院Schrems I、II兩起判決談起 |
| 作品摘要 | 2016年歐盟制定GDPR並於2018年生效，因第3條「域外效力」所造成的「布魯塞爾效應」，各國開始重視調和其國內法與GDPR的標準，以期待盡早獲得歐盟執委會依第45條之「適足性認定」（Adequacy Decisions），在保護隱私權與跨境資料自由流通之間取得平衡，然而歐盟法院卻於2016年Schrems I與2020年Schrems II兩起判決中，對第三國的「適足性認定」依《歐盟基本權利憲章》設下非常高的隱私權保護門檻，造成全球資料治理法制的動盪。 我國因與歐盟之間的貿易依存與中小企業的產業結構，不能忽視上述國際標準趨勢。因此，本文將以Schrems I、II兩起歐盟法院判決為契機，觀察判決做成後歐盟對韓國與美國「適足性認定」新發展，用以評論行政院於2025年3月27日所提出的《個人資料保護委員會組織法草案》與《個資法》部分條文修正草案，期待能盡早獲得歐盟執委會之「適足性認定」，減少企業之法遵成本。 Abstract The EU adopted GDPR in 2016, which has entered into force in 2018. Because of its extraterritorial effects under Article 3, many states were beginning to focus on harmonizing their domestic laws with GDPR standard, for the expectation of obtaining the “Adequacy Decisions” based on Article 45 from the EU Commission. The ultimate purpose is to maintain the balance between the protection of the right to privacy and the demands of cross-border data transfer. However, the CJEU has delivered 2 judgements, Schrems I in 2016 and Schrems II in 2020, which set up the high legal review standards of granting the “Adequacy Decisions” to the third states, caused the shockwaves to the law of the data governance globally.
For the reason of the interdependence of the trade between Taiwan and the EU, and the industrial structure of small and medium-sized enterprises, there is no space for us to ignore the above-mentioned trends. Therefore, this article will use Schrems I, II judgements as the starting points, observing the new development of the “Adequacy Decisions” granted by the EU to South Korea and the US. The observations will lead this article to comment the “Draft of Organizational Act of the Personal Data Protection Commission” and “Draft of the Amendment of the Personal Data Protection Act” issued by the Executive Yuan on March 27, 2025. This article is expecting that Taiwan can obtain “Adequacy Decisions” from the EU early in order to decrease the cost of the legal compliance for the enterprises. |
| 關鍵字 |
歐盟、GDPR、適足性認定、歐盟法院、隱私權、個人資料保護委員會、個人資料保護法 |