云计算环境中数据处理行为的法律规制研究

目前很多国家和地区的个人数据保护法都主张其具有域外效力，适用于跨境数据处理行为。而现行冲突规范中有关物权、知识产权的规则无法涵盖所有的数据处理行为，由于数据可能涉及国家安全，也无法适用合同法规则。在涉及数据处理行为的立法中明确其地域适用范围的，只有欧盟指令和即将生效的条例以及欧盟成员国的数据保护立法。欧盟立法主要采用“数据控制者的机构所在地”和“数据处理行为发生地”两种适用标准，而云计算技术的广泛应用给这两项标准带来了新的问题。“数据处理行为发生地”逐渐被淡化，相较之下，“数据控制者的机构所在地”成为更可靠的标准。我国的数据处理立法也应当确立其域外效力，规制跨境数据处理行为。

Legal Regulation of Data Processing in Cloud Computing Context

Many domestic personal data protection laws literally state their exterritorial effect and are applicable to cross-boarder data processing activity.The current choice of law rules governing property and intellectual property cannot cover all data processing activities.Because of some data concerning nation security,in these cases choice of law rules gover-ning contracts cannot be applicable.Now only the European data protection directive and regulation,which are expected to put into effect in the near future,and member states of EU,have clear rules of territorial scope in their data protection laws.The two criterions,“Establishment of data controller”and “place of data processing”,are adopted in EU laws, which are now being challenged by wide use of cloud computing technology.“Place of data processing”becomes less im-portant and “Establishment of data controller”is the more reliable criterion.Chinese data protection law should literally definite its exterritorial effect and applicable to cross-boarder all data processing activities.