研究论文

数据跨境流动风险要素识别及评估研究

  • 陈媛媛 ,
  • 张莉 ,
  • 马海群
展开
  • 黑龙江大学信息管理学院 哈尔滨 150080
陈媛媛,教授,博士,硕士生导师,E-mail:skyyuanyuan0451@126.com;张莉,硕士研究生;马海群,教授,博士,博士生导师。

收稿日期: 2025-01-13

  修回日期: 2025-03-11

  网络出版日期: 2025-08-20

基金资助

本文系国家社会科学基金项目“数据要素市场利益相关主体的价值共创路径研究”(项目编号:23BTQ091)和黑龙江大学学位与研究生教育教学改革项目“数智赋能下面向研究生创新培养的高校智慧图书馆建设”(项目编号:JGXM_YJS_2022036)研究成果之一。

Identification and Assessment of Risk Factors in Cross-Border Data Flows

  • Chen Yuanyuan ,
  • Zhang Li ,
  • Ma Haiqun
Expand
  • School of Information Management, Heilongjiang University, Harbin 150080
Chen Yuanyuan, Professor, PhD, Master’s Supervisor, E-mail: skyyuanyuan0451@126.com; Zhang Li, Master’s Candidate; Ma Haiqun, Professor, PhD, Doctoral Supervisor.

Received date: 2025-01-13

  Revised date: 2025-03-11

  Online published: 2025-08-20

Supported by

This paper is one of the research outcomes of the National Social Science Foundation of China project “Value Co-creation Paths among Stakeholders in the Data-Factor Market” (Grant No. 23BTQ091), and of the Heilongjiang University Graduate Education Teaching-Reform project “Smart University Library Construction Empowered by Digital Intelligence for Innovative Postgraduate Training” (Grant No. JGXM_YJS_2022036).

摘要

[目的/意义] 立足发展与安全,推动中国特色数据跨境流动管理制度体系建设。研究数据跨境流动风险要素及其置信度,能够进一步加强数据安全管理,确保数据能够在安全前提下实现有序自由流动。[方法/过程] 融合政策文本分析(覆盖《数据安全法》等6部法规)、理论框架解构与德尔菲专家共识验证,构建包含35项风险要素的自适应领结模型(ABT),并将其转化为Petri网进行动态风险评估。为保障评估过程中专家判断的准确性及降低评价的主观性,将三角隶属函数和改进的区域中心法相结合,计算隶属函数曲线包围的区域中心横坐标,把置信区间转换为置信度。[结果/结论] 分析结果表明:数据处理者所提交的材料不真实、故意提交虚假材料和出境数据的规模、种类、敏感程度不合理是威胁和预防屏障中发生概率较高的要素;责任追究制度不严格和惩罚力度较弱是检测措施失效和控制措施失效中最为显著的造成缓解屏障失效的主因。基于评估结果,构建数据跨境风险规避策略体系,包括:推动数据跨境流动的规范化建设与国际协作;强化数据分级分类管理,并建立跨境数据监督机构;完善评估机制,明确监管与惩戒措施。

本文引用格式

陈媛媛 , 张莉 , 马海群 . 数据跨境流动风险要素识别及评估研究[J]. 图书情报工作, 2025 , 69(17) : 84 -104 . DOI: 10.13266/j.issn.0252-3116.2025.17.008

Abstract

[Purpose/Significance] Based on development and security, this study aims to promote the construction of a Chinese data cross-border flow management system. By examining the risk factors and confidence levels of data cross-border flow, it seeks to strengthen data security management and ensure the orderly and free flow of data under safe conditions. [Method/Process] This study integrated policy text analysis (covering six regulations including the Data Security Law), theoretical framework deconstruction, and Delphi expert consensus validation to construct an adaptive bow-tie (ABT) model comprising 35 risk elements. The model was subsequently transformed into a Petri net for dynamic risk assessment. To ensure the accuracy of expert judgments and reduce subjectivity during evaluation, a triangular membership function was combined with an improved regional center method. This approach calculated the horizontal coordinate of the regional center enclosed by membership function curves, converting confidence intervals into quantifiable confidence levels. [Result/Conclusion] The study finds that the submission of false or incomplete materials by data processors, as well as unreasonable scale, type, and sensitivity of data being exported, are factors with a higher probability of occurrence in the threat and prevention barriers. In the detection and control measures, weak accountability mechanisms and insufficient punishment are the main causes of the failure of mitigation barriers. Finally, based on the assessment results, a risk avoidance strategy system for data cross-border flow is proposed, including: promoting the standardization of data cross-border flow and international cooperation, strengthening graded and classified data management, establishing cross-border data supervision agencies, and improving the assessment mechanism with clear regulatory and punitive measures.

参考文献

[1] 谢谦, 金才淇.跨境数据流动的共同关切、面临挑战与中国应对[J]. 学习与探索, 2024(8): 114-125. (XIE Q, JIN C Q. Common concerns, challenges and China’s responses in cross-border data flow[J]. Study & exploration, 2024(8): 114-125.)
[2] 丁晟春, 秦天允, 王艺霖. 基于知识图谱的专利侵权风险预警研究[J]. 情报学报, 2024, 43(8): 992-1002. (DING S C, QIN T Y, WANG Y L. Research on patent infringement risk early warning based on knowledge graph[J]. Journal of information science, 2024, 43(8): 992-1002.)
[3] TREVERTON G F, ESFANDIARI P. Data: governance and geopolitics[EB/OL]. [2025-04-11]. https://www.csis.org/analysis/data-governance-and-geopolitics.
[4] 臧国全, 肖洋, 张凯亮. 政府数据的隐私风险计量与分级保护机制研究[J/OL]. 中国图书馆学报. [2025-03-19]. http://kns.cnki.net/kcms/detail/11.2746.G2.20241118.1338.002.html. (ZANG G Q, XIAO Y, ZHANG K L. Measurement and hierarchical protection mechanism of privacy risks in government data[J/OL]. Journal of library science in China. [2025-03-19]. http://kns.cnki.net/kcms/detail/11.2746.G2.20241118.1338.002.html.)
[5] 姚天, 王宇.数据主权视阈下的数据跨境流动及中国因应[J]. 国际商务(对外经济贸易大学学报), 2025(2): 141-156. (YAO T, WANG Y. Cross-border data flow under the perspective of data sovereignty and China’s response[J]. International business (Journal of University of International Business and Economics), 2025(2): 141-156.)
[6] 陈嘉鑫, 李宝诚. 风险社会理论视域下生成式人工智能安全风险检视与应对[J]. 情报杂志, 2025, 44(1): 128-135, 171. (CHEN J X, LI B C. Examination and response to security risks of generative AI from the perspective of risk society theory[J]. Journal of intelligence, 2025, 44(1): 128-135, 171.)
[7] WRIGHT V. The data odyssey: navigating cross-border data transfers[EB/OL]. [2025-02-13]. https://bigid.com/blog/navigating-cross-border-data-transfers/.
[8] 谢贤君, 郁俊莉. 跨境资本流动与商业银行系统性风险[J]. 当代经济科学, 2024, 46(1): 1-15. (XIE X J, YU J L. Cross-border capital flow and systemic risk of commercial banks[J]. Modern economic science, 2024, 46(1): 1-15.)
[9] RAWDING M, SACKS S. The balkanization of the cloud is bad for everyone[EB/OL]. [2025-06-17]. https://www.technologyreview.com/2020/12/17/1014967/balkanization-cloud-computing-bad-everyone/.
[10] 任鹏飞. 美国数据战略及其全球影响[J]. 当代世界社会主义问题, 2024(3): 126-141, 168. (REN P F. U.S. Data strategy and its global impact[J]. Contemporary world socialism issues, 2024(3): 126-141, 168.)
[11] 王京仔. 这一年, 网络法治化进程稳步推进[N]. 法治周末, 2025-01-02(7). (WANG J Z. This year, the process of internet legalization steadily advances [N]. Rule of law weekend, 2025-01-02(7).)
[12] 刘宏松, 李知蔓. 美国与欧盟差异性网络安全合作探析[J]. 同济大学学报(社会科学版), 2025, 36(2): 21-35, 118. (LIU H S, LI Z M. Analysis of differentiated cybersecurity cooperation between the U.S. and the EU [J]. Journal of Tongji university (social science section), 2025, 36(2): 21-35, 118.)
[13] 苏君华, 宋雯琪. 数据交易市场流转机制的系统动力学分析[J]. 图书情报工作, 2025, 69(9): 3-14. (SU J H, SONG W Q. System dynamics analysis of data trading market circulation mechanisms [J]. Library and information service, 2025, 69(9): 3-14.)
[14] LIAO D Y, ZHUO X L, TAO J. A dynamic fire risk assessment method for compact historic villages based on the improved frame[J]. International journal of disaster risk reduction, 2024, 114: 104935.
[15] 张利. 跨境电子商务[M]. 重庆: 重庆大学出版社, 2020. (ZHANG L. Cross-border e-commerce[M]. Chongqing: Chongqing University Press, 2020.)
[16] 全雄伟, 左高山. 基于随机Petri网的邻避冲突演化过程模型及情景仿真分析——以垃圾焚烧发电厂为例[J]. 运筹与管理, 2022, 31(1): 135-141. (QUAN X W, ZUO G S. Evolutionary process model and scenario simulation of NIMBY conflict based on stochastic Petri net: a case study of waste incineration power plants[J]. Operations research and management science, 2022, 31(1): 135-141.)
[17] 邓崧, 字学凤. PISEL博弈模型分析框架下的中美跨境数据流动研究[J]. 情报杂志, 2020, 39(1): 167-173. (DENG S, ZI X F. Research on Sino-U.S. cross-border data flow under the analytical framework of PISEL game model[J]. Journal of intelligence, 2020, 39(1): 167-173.)
[18] PIPE G R. International information policy: evolution of transborder data flow issues[J]. Telematics and informatics, 1984, 1(4): 409-418.
[19] CONCERNING O R. Guidelines governing the protection of privacy and transborder flows of personal data[R]. Paris: OECD, 1980: C(80)58(FINAL).
[20] 王梦颖. 国际投资协定中数据保护的路径研究——以“Einarsson v. Canada”案为视角[J]. 国际经济法学刊, 2024(3): 47-63. (WANG M Y. Research on data protection paths in international investment agreements: from the perspective of “Einarsson v. Canada”[J]. International economic law review, 2024(3): 47-63.)
[21] 李卓卓, 刘子轶. 从分野到融合:多学科视角下的数据跨境研究综述[J]. 情报杂志, 2024, 43(12): 198-207. (LI Z Z, LIU Z Y. From division to integration: a review of cross-border data research from multidisciplinary perspectives[J]. Journal of intelligence, 2024, 43(12): 198-207.)
[22] CHEN M. Developing China’s approaches to regulate cross-border data transfer: relaxation and integration[J]. Computer law & security review, 2024, 54: 105997.
[23] 文铭, 李星熠. “自由-规制”框架下跨境数据流动治理及中国方案[J]. 中国科技论坛, 2024(4): 106-116. (WEN M, LI X Y. Governance of cross-border data flow under the “freedom-regulation” framework and China’s approach[J]. Forum on China science and technology, 2024(4): 106-116.)
[24] MANDEL M. Data, trade and growth[EB/OL]. [2025-06-01]. https://www.upjohn.org/MEG/Presentations/Mandel.pdf.
[25] 沈伟, 苏可桢. 变局之下国际法与国内法互动的转向[J]. 探索与争鸣, 2024(4): 96-108, 179. (SHEN W, SU K Z. The shift of interaction between international law and domestic law in a changing world[J]. Exploration and free views, 2024(4): 96-108, 179.)
[26] 郭海玲, 刘仲山, 卫金金. 我国数据跨境流动协同治理现实困境及纾解路径研究[J]. 现代情报, 2024, 44(9): 142-153. (GUO H L, LIU Z S, WEI J J. Research on realistic dilemmas and solutions for collaborative governance of cross-border data flow in China[J]. Modern information, 2024, 44(9): 142-153.)
[27] 吴玄. 海南自由贸易港数据跨境规则创新路径研究[J]. 海南大学学报(人文社会科学版), 2025, 43(4): 140-148. (WU X. Research on innovative pathways for cross-border data rules in Hainan free trade port[J]. Hainan University journal (humanities and social sciences), 2025, 43(4): 140-148.)
[28] KUNER C. The general data protection regulation: a commentary[M]. Oxford: Oxford University Press, 2017.
[29] 武琼.科技向善:中国全球人工智能治理倡议的核心要义与理论价值[J]. 和平与发展, 2024(5): 25-49, 179-180. (WU Q. Technology for good: core principles and theoretical value of China’s global AI governance initiative[J]. Peace and development, 2024(5): 25-49, 179-180.)
[30] 陈颖, 薛澜.全球跨境数据流动治理的演进与趋势[J]. 国际经济合作, 2024, 40(2): 55-66, 93. (CHEN Y, XUE L. Evolution and trends in global cross-border data flow governance[J]. International economic cooperation, 2024, 40(2): 55-66, 93.)
[31] KUNER C, BYGRAVE L, DOCKSEY C, et al. The EU general data protection regulation: a commentary[M]. Oxford: Oxford university press, 2020.
[32] GREENLEAF G. Global data privacy laws 2021: fifty-four percent of the world’s population covered[J]. Privacy laws & business international report, 2021, 165: 10-13.
[33] 陈可翔.政务数据应用领域行政法的治理逻辑转换[J]. 法学, 2024(11): 54-74. (CHEN K X. Transformation of governance logic in administrative law for government data applications[J]. Law science, 2024(11): 54-74.)
[34] 陈兵.数字企业数据跨境流动合规治理法治化进路[J]. 法治研究, 2023(2): 34-44. (CHEN B. Legalization path for compliance governance of cross-border data flow in digital enterprises[J]. Rule of law research, 2023(2): 34-44.)
[35] 陈景善.人工智能协同公司风险治理的规范化进路[J]. 比较法研究, 2024(6): 163-175. (CHEN J S. Normative approach to AI-enhanced corporate risk governance[J]. Chinese journal of comparative law, 2024(6): 163-175.)
[36] ELOFF J H P, ELOFF M M. Information security architecture[J]. Computer fraud & security, 2005(11): 10-16.
[37] SALEH M S, ALFANTOOKH A. A new comprehensive framework for enterprise information security risk management[J]. Applied computing and informatics, 2011, 9(2): 107-118.
[38] LI J, DONG W, ZHANG C, et al. Development of a risk index for cross-border data movement[J]. Data science and management, 2022, 5(3): 97-104.
[39] JING Y, YANG P. Research on the risk prevention of cross-border e-commerce logistics in China by applying big data technology[J]. Procedia computer science, 2022, 208: 407-413.
[40] 阙天舒, 王子玥. 数字经济时代的全球数据安全治理与中国策略[J]. 国际安全研究, 2022, 40(1): 130-154, 158. (QUE T S, WANG Z Y. Global data security governance and China’s strategy in the era of digital economy[J]. Journal of international security studies, 2022, 40(1): 130-154, 158.)
[41] 孔文豪, 陈玲. 重新理解跨境数据流动治理模式的驱动因素——基于跨国比较的组态分析[J]. 电子政务, 2025(4): 85-97. (KONG W H, CHEN L. Reunderstanding the driving factors of cross-border data flow governance models: a configuration analysis based on cross-national comparison[J]. E-government, 2025(4): 85-97.)
[42] 邓灵斌.数据治理的法律规制:欧盟立法与“中国方案”——基于欧盟《数据治理法》(DGA)的分析与思考[J/OL]. 图书馆杂志. [2025-05-11]. http://kns.cnki.net/kcms/detail/31.1108.G2.20241031.1415.004.html. (DENG L B. Legal regulation of data governance: EU legislation and “China’s approach”——analysis and reflections based on the EU data governance act (DGA)[J/OL]. Library journal. [2025-05-11]. http://kns.cnki.net/kcms/detail/31.1108.G2.20241031.1415.004.html.)
[43] 李金, 李建平, 孙晓蕾, 等. 我国数据跨境传输的风险分析及应对策略[M]. 北京: 科学出版社, 2021. (LI J, LI J P, SUN X L, et al. Risk analysis and response strategies for cross-border data transmission in China[M]. Beijing: Science Press, 2021.)
[44] 杨东, 文诚公.互联网金融风险与安全治理[M]. 北京: 机械工业出版社, 2016. (YANG D, WEN C G. Internet financial risk and security governance[M]. Beijing: Mechanical Industry Press, 2016.)
[45] 罗云开.数据跨境流动的欧美政策演进及启示——基于数据保护与数字经济发展权衡视角[J]. 当代经济管理, 2024, 46(10): 27-37. (LUO Y K. Evolution and implications of EU-US policies on cross-border data flow: balancing data protection and digital economy development[J]. Contemporary economic management, 2024, 46(10): 27-37.)
[46] 王宏.电子系统可靠性工程技术[M]. 南京: 南京大学出版社, 2021. (WANG H. Reliability engineering technology for electronic systems[M]. Nanjing: Nanjing University Press, 2021.)
[47] TALEB-BERROUANE M, KHAN F, HAWBOLDT K. Corrosion risk assessment using adaptive bow-tie (ABT) analysis[J]. Reliability engineering & system safety, 2021, 214: 107731.
[48] 高智勇. 基于Petri网的智慧农业管理流程仿真方法研究[J]. 山东农业大学学报(自然科学版), 2024, 55(3): 413-421. (GAO Z Y. Simulation method for smart agriculture management processes based on Petri net[J]. Journal of Shandong Agricultural University (natural science edition), 2024, 55(3): 413-421.)
[49] BERTOLINI M, BEVILACQUA M, MASON G. Reliability design of industrial plants using Petri nets[J]. Journal of quality in maintenance engineering, 2006, 12(4): 397-411.
[50] LI W, SUN Q, ZHANG J, et al. Quantitative risk assessment of industrial hot work using adaptive bow tie and Petri nets[J]. Reliability engineering & system safety, 2024, 242: 109784.
[51] KAPTAN M. Risk assessment of ship anchorage handling operations using the fuzzy bow-tie method[J]. Ocean engineering, 2021, 236: 109500.
[52] 数据出境安全评估办法[EB/OL]. [2025-01-19]. https://www.cac.gov.cn/2022-07/07/c_1658811536396503.htm. (Measures for security assessment of data exports[EB/OL]. [2025-01-19]. https://www.cac.gov.cn/2022-07/07/c_1658811536396503.htm.)
[53] 促进和规范数据跨境流动规定[EB/OL]. [2025-01-28]. https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm. (Provisions on facilitating and regulating cross-border data flow[EB/OL]. [2025-01-28]. https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm.)
[54] 中华人民共和国网络安全法[EB/OL]. [2025-04-07]. https://flk.npc.gov.cn/detail2.html?MmM5MDlmZGQ2NzhiZjE3OTAxNjc4YmY4Mjc2ZjA5M2Q%3D. (Cybersecurity law of the people’s republic of China [EB/OL]. [2025-04-07]. https://flk.npc.gov.cn/detail2.html?MmM5MDlmZGQ2NzhiZjE3OTAxNjc4YmY4Mjc2ZjA5M2Q%3D.)
[55] 中华人民共和国个人信息保护法[EB/OL]. [2025-03-20]. https://flk.npc.gov.cn/detail2.html?ZmY4MDgxODE3YjY0NzJhMzAxN2I2NTZjYzIwNDAwNDQ%3D. (Personal information protection law of the people’s republic of China [EB/OL]. [2025-03-20]. https://flk.npc.gov.cn/detail2.html?ZmY4MDgxODE3YjY0NzJhMzAxN2I2NTZjYzIwNDAwNDQ%3D.)
[56] 刘金瑞.迈向数据跨境流动的全球规制:基本关切与中国方案[J]. 行政法学研究, 2022(4): 73-88. (LIU J R. Toward global regulation of cross-border data flow: core concerns and China’s approach[J]. Administrative law review, 2022(4): 73-88.)
[57] 董淳锷.市场事前监管向事中事后监管转变的经济法阐释[J]. 当代法学, 2021, 35(2): 69-81. (DONG C E. Economic law interpretation of the shift from ex-ante to in-process and ex-post market regulation[J]. Contemporary law review, 2021, 35(2): 69-81.)
[58] 杨慧妍.国家安全视域下的数据出境合规体系研究——以国内首例涉案数据被鉴定为情报案为例[J]. 情报杂志, 2023, 42(6): 201-207. (YANG H Y. Research on data export compliance system from the perspective of national security: a case study of China’s first data-related case identified as involving intelligence[J]. Journal of intelligence, 2023, 42(6): 201-207.)
[59] 中华人民共和国数据安全法[EB/OL]. [2025-05-10]. https://flk.npc.gov.cn/detail2.html?ZmY4MDgxODE3OWY1ZTA4MDAxNzlmODg1YzdlNzAzOTI%3D. (Data security law of the people’s republic of China [EB/OL]. [2025-05-10]. https://flk.npc.gov.cn/detail2.html?ZmY4MDgxODE3OWY1ZTA4MDAxNzlmODg1YzdlNzAzOTI%3D.)
[60] 个人信息出境标准合同办法[EB/OL]. [2025-01-25]. https://www.cac.gov.cn/2023-02/24/c_1678884830036813.htm. (Measures for standard contracts for personal information exports[EB/OL]. [2025-01-25]. https://www.cac.gov.cn/2023-02/24/c_1678884830036813.htm.)
[61] 梅傲, 陈子文.总体国家安全观视域下我国数据安全监管的制度构建[J]. 电子政务, 2023(11): 104-115. (MEI A, CHEN Z W. Institutional construction of data security supervision in China from the perspective of holistic national security[J]. E-Government, 2023(11): 104-115.)
[62] 刘东阁, 庞瑞芝.金融关联对企业数字化创新的影响研究[J]. 管理学报, 2025, 22(2): 316-325. (LIU D G, PANG R Z. Research on the impact of financial connections on enterprise digital innovation[J]. Chinese journal of management, 2025, 22(2): 316-325.)
[63] 马其家, 刘飞虎.数据出境中的国家安全治理探讨[J]. 理论探索, 2022, (2): 105-113. (MA Q J, LIU F H. Exploration of national security governance in data exports[J]. Theoretical exploration, 2022(2): 105-113.)
[64] 熊光清, 张素敏.总体国家安全观视角下我国数据出境安全管理制度的完善[J]. 哈尔滨工业大学学报(社会科学版), 2023, 25(5): 32-40. (XIONG G Q, ZHANG S M. Improving China’s data export security management system from the perspective of holistic national security[J]. Journal of Harbin Institute of Technology (social sciences edition), 2023, 25(5): 32-40.)
[65] 姚怡帆, 胡峰.生命体免疫视角下数据安全免疫模型构建及应用研究[J]. 情报理论与实践, 2025, 48(2): 92-101. (YAO Y F, HU F. Construction and application of data security immune model from the perspective of biological immunity[J]. Information studies: theory & application, 2025, 48(2): 92-101.)
[66] 董伟玮, 秦音.基于“技术—制度”框架的超大城市政务数据共享体系建构与优化策略[J]. 现代情报, 2025, 45(6): 140-152. (DONG W W, QIN Y. Construction and optimization of government data sharing systems in megacities based on a “technology-institution” framework[J]. Modern information, 2025, 45(6): 140-152.)
[67] 董克, 吴佳纯, 马廷灿.我国数据出境安全风险要素体系研究[J]. 情报理论与实践, 2024, 47(6): 49-59. (DONG K, WU J C, MA T C. Research on the framework of security risk elements in China’s data exports[J]. Information studies: theory & application, 2024, 47(6): 49-59.)
[68] 包柠榛.中概股赴美上市的数据安全审视:风险来源、中美监管与应对[J]. 东北师大学报(哲学社会科学版), 2023(4): 145-155. (BAO N Z. Data security scrutiny of Chinese companies listed in the U.S.: risk sources, Sino-U.S. regulation, and responses[J]. Journal of Northeast Normal University (philosophy and social sciences), 2023(4): 145-155.)
[69] 中共中央办公厅国务院办公厅印发《关于依法从严打击证券违法活动的意见》[EB/OL]. [2025-05-11]. https://www.gov.cn/xinwen/2021-07/06/content_5622763.htm. (General office of the CPC central committee and general office of the state council print and issue the opinions on law-based severe crackdown on illegal securities activities [EB/OL]. [2025-05-11]. https://www.gov.cn/xinwen/2021-07/06/content_5622763.htm.)
[70] 李海英, 马民虎.我国数据跨境流动的治理框架与实践方案[J]. 图书与情报, 2022(6): 50-57. (LI H Y, MA M H. Governance framework and practical solutions for cross-border data flow in China[J]. Library and information, 2022(6): 50-57.)
文章导航

/

〈 〉