关键词: 通用数据保护条例, 数字贸易, 个人信息保护, 个人信息跨境传输, 第三方认证

Abstract: Achieving secure, orderly, and free crossborder data transfer is a significant policy issue for countries worldwide. Article 38 of the “Personal Information Protection Law of the People’s Republic of China” explicitly stipulates a certification system for crossborder transfer of personal information. However, this system is still in its nascent stage and faces fundamental and implementation challenges, such as determining the objects of certification. The European Union, as the progenitor of data protection certification systems, offers a reference for the perfection of China’s certification system through its institutional framework and distinctive features. This paper takes the EU’s data protection certification system and China’s personal information crossborder transfer certification system as its research subjects, compares with the differences in their institutional designs, and proposes five improvement suggestions, including clarifying the objects of certification, to address the systemic challenges in the construction of China’s certification system. These suggestions aim to provide valuable support for the improvement and innovation of the personal information crossborder transfer certification system.

Key words: general data protection regulation, digital trade, personal information protection, crossborder transmission of personal information, thirdparty certification