摘要
面对数据安全正在经受的全球性严峻考验,需要精准、实时和动态实现数据安全的风险识别与预警。《数据安全法》的“单独立法”,使数据安全的等保合规不再只是从属于网络安全,而具有区别性的独立研究价值。数据安全的等保制度既要强调对国外科技公司较高级别的等保合规,又要推动数据被更大幅度、更深层次应用,这需要借鉴国际基本规则、国家主权控制、行业自律指引三者之间的公约数平衡,形成高弹性、低耦合、模型化的等保合规体系。构建数据安全的等保合规体系除了基础性法律,还需借助“技术标准”对数据全生命周期加以规定。在此基础上,建立等保数标软法化、等保应用场景化、等保分级类型化的高水平集成数据治理模式。
Faced with the severe global test that data security is undergoing,an accurate,real-time and dynamic identification and early warning of data security risks have become a necessity.With the adoption of the Data Security Law–a new piece of legislation seperate from the cybersecurity realm,classified protection compliance of data security has become a distinctive and independent research subject.The classified protection system for data security should not only emphasize higher-level classified protection compliance by foreign technology companies,but also promote data application more broadly.To this end,one must strike a balance between basic international rules,national sovereignty control measures and industry self-regulation guidelines when establishing a highly flexible,low-coupling and model-based system for classified protection compliance.In addition to basic laws,“technical standards”are badly needed to regulate the entire life cycle of data.On this basis,a high-level and integrated data governance model must be constructed,featuring soft law-oriented classified protection standards for data security,scenario-based application of classified protection and typed classification of classified protection.
出处
《法学》
CSSCI
北大核心
2022年第6期20-30,共11页
Law Science
基金
国家社会科学基金重大项目“数据中国背景下公共数据技术标准的法治体系研究”(21&ZD200)
最高人民法院重大项目“矛盾纠纷源头治理体系化研究”(ZGFYZDKT202117-03)的阶段性成果
关键词
数据安全
等保合规范式
等级保护
数据治理
data security
paradigm of classified protection compliance
classified protection
data governance
