RESEARCH PAPERS

Identification and Assessment of Risk Factors in Cross-Border Data Flows

  • Chen Yuanyuan ,
  • Zhang Li ,
  • Ma Haiqun
Expand
  • School of Information Management, Heilongjiang University, Harbin 150080
Chen Yuanyuan, Professor, PhD, Master’s Supervisor, E-mail: skyyuanyuan0451@126.com; Zhang Li, Master’s Candidate; Ma Haiqun, Professor, PhD, Doctoral Supervisor.

Received date: 2025-01-13

  Revised date: 2025-03-11

  Online published: 2025-08-20

Supported by

This paper is one of the research outcomes of the National Social Science Foundation of China project “Value Co-creation Paths among Stakeholders in the Data-Factor Market” (Grant No. 23BTQ091), and of the Heilongjiang University Graduate Education Teaching-Reform project “Smart University Library Construction Empowered by Digital Intelligence for Innovative Postgraduate Training” (Grant No. JGXM_YJS_2022036).

Abstract

[Purpose/Significance] Based on development and security, this study aims to promote the construction of a Chinese data cross-border flow management system. By examining the risk factors and confidence levels of data cross-border flow, it seeks to strengthen data security management and ensure the orderly and free flow of data under safe conditions. [Method/Process] This study integrated policy text analysis (covering six regulations including the Data Security Law), theoretical framework deconstruction, and Delphi expert consensus validation to construct an adaptive bow-tie (ABT) model comprising 35 risk elements. The model was subsequently transformed into a Petri net for dynamic risk assessment. To ensure the accuracy of expert judgments and reduce subjectivity during evaluation, a triangular membership function was combined with an improved regional center method. This approach calculated the horizontal coordinate of the regional center enclosed by membership function curves, converting confidence intervals into quantifiable confidence levels. [Result/Conclusion] The study finds that the submission of false or incomplete materials by data processors, as well as unreasonable scale, type, and sensitivity of data being exported, are factors with a higher probability of occurrence in the threat and prevention barriers. In the detection and control measures, weak accountability mechanisms and insufficient punishment are the main causes of the failure of mitigation barriers. Finally, based on the assessment results, a risk avoidance strategy system for data cross-border flow is proposed, including: promoting the standardization of data cross-border flow and international cooperation, strengthening graded and classified data management, establishing cross-border data supervision agencies, and improving the assessment mechanism with clear regulatory and punitive measures.

Cite this article

Chen Yuanyuan , Zhang Li , Ma Haiqun . Identification and Assessment of Risk Factors in Cross-Border Data Flows[J]. Library and Information Service, 2025 , 69(17) : 84 -104 . DOI: 10.13266/j.issn.0252-3116.2025.17.008

References

[1] 谢谦, 金才淇.跨境数据流动的共同关切、面临挑战与中国应对[J]. 学习与探索, 2024(8): 114-125. (XIE Q, JIN C Q. Common concerns, challenges and China’s responses in cross-border data flow[J]. Study & exploration, 2024(8): 114-125.)
[2] 丁晟春, 秦天允, 王艺霖. 基于知识图谱的专利侵权风险预警研究[J]. 情报学报, 2024, 43(8): 992-1002. (DING S C, QIN T Y, WANG Y L. Research on patent infringement risk early warning based on knowledge graph[J]. Journal of information science, 2024, 43(8): 992-1002.)
[3] TREVERTON G F, ESFANDIARI P. Data: governance and geopolitics[EB/OL]. [2025-04-11]. https://www.csis.org/analysis/data-governance-and-geopolitics.
[4] 臧国全, 肖洋, 张凯亮. 政府数据的隐私风险计量与分级保护机制研究[J/OL]. 中国图书馆学报. [2025-03-19]. http://kns.cnki.net/kcms/detail/11.2746.G2.20241118.1338.002.html. (ZANG G Q, XIAO Y, ZHANG K L. Measurement and hierarchical protection mechanism of privacy risks in government data[J/OL]. Journal of library science in China. [2025-03-19]. http://kns.cnki.net/kcms/detail/11.2746.G2.20241118.1338.002.html.)
[5] 姚天, 王宇.数据主权视阈下的数据跨境流动及中国因应[J]. 国际商务(对外经济贸易大学学报), 2025(2): 141-156. (YAO T, WANG Y. Cross-border data flow under the perspective of data sovereignty and China’s response[J]. International business (Journal of University of International Business and Economics), 2025(2): 141-156.)
[6] 陈嘉鑫, 李宝诚. 风险社会理论视域下生成式人工智能安全风险检视与应对[J]. 情报杂志, 2025, 44(1): 128-135, 171. (CHEN J X, LI B C. Examination and response to security risks of generative AI from the perspective of risk society theory[J]. Journal of intelligence, 2025, 44(1): 128-135, 171.)
[7] WRIGHT V. The data odyssey: navigating cross-border data transfers[EB/OL]. [2025-02-13]. https://bigid.com/blog/navigating-cross-border-data-transfers/.
[8] 谢贤君, 郁俊莉. 跨境资本流动与商业银行系统性风险[J]. 当代经济科学, 2024, 46(1): 1-15. (XIE X J, YU J L. Cross-border capital flow and systemic risk of commercial banks[J]. Modern economic science, 2024, 46(1): 1-15.)
[9] RAWDING M, SACKS S. The balkanization of the cloud is bad for everyone[EB/OL]. [2025-06-17]. https://www.technologyreview.com/2020/12/17/1014967/balkanization-cloud-computing-bad-everyone/.
[10] 任鹏飞. 美国数据战略及其全球影响[J]. 当代世界社会主义问题, 2024(3): 126-141, 168. (REN P F. U.S. Data strategy and its global impact[J]. Contemporary world socialism issues, 2024(3): 126-141, 168.)
[11] 王京仔. 这一年, 网络法治化进程稳步推进[N]. 法治周末, 2025-01-02(7). (WANG J Z. This year, the process of internet legalization steadily advances [N]. Rule of law weekend, 2025-01-02(7).)
[12] 刘宏松, 李知蔓. 美国与欧盟差异性网络安全合作探析[J]. 同济大学学报(社会科学版), 2025, 36(2): 21-35, 118. (LIU H S, LI Z M. Analysis of differentiated cybersecurity cooperation between the U.S. and the EU [J]. Journal of Tongji university (social science section), 2025, 36(2): 21-35, 118.)
[13] 苏君华, 宋雯琪. 数据交易市场流转机制的系统动力学分析[J]. 图书情报工作, 2025, 69(9): 3-14. (SU J H, SONG W Q. System dynamics analysis of data trading market circulation mechanisms [J]. Library and information service, 2025, 69(9): 3-14.)
[14] LIAO D Y, ZHUO X L, TAO J. A dynamic fire risk assessment method for compact historic villages based on the improved frame[J]. International journal of disaster risk reduction, 2024, 114: 104935.
[15] 张利. 跨境电子商务[M]. 重庆: 重庆大学出版社, 2020. (ZHANG L. Cross-border e-commerce[M]. Chongqing: Chongqing University Press, 2020.)
[16] 全雄伟, 左高山. 基于随机Petri网的邻避冲突演化过程模型及情景仿真分析——以垃圾焚烧发电厂为例[J]. 运筹与管理, 2022, 31(1): 135-141. (QUAN X W, ZUO G S. Evolutionary process model and scenario simulation of NIMBY conflict based on stochastic Petri net: a case study of waste incineration power plants[J]. Operations research and management science, 2022, 31(1): 135-141.)
[17] 邓崧, 字学凤. PISEL博弈模型分析框架下的中美跨境数据流动研究[J]. 情报杂志, 2020, 39(1): 167-173. (DENG S, ZI X F. Research on Sino-U.S. cross-border data flow under the analytical framework of PISEL game model[J]. Journal of intelligence, 2020, 39(1): 167-173.)
[18] PIPE G R. International information policy: evolution of transborder data flow issues[J]. Telematics and informatics, 1984, 1(4): 409-418.
[19] CONCERNING O R. Guidelines governing the protection of privacy and transborder flows of personal data[R]. Paris: OECD, 1980: C(80)58(FINAL).
[20] 王梦颖. 国际投资协定中数据保护的路径研究——以“Einarsson v. Canada”案为视角[J]. 国际经济法学刊, 2024(3): 47-63. (WANG M Y. Research on data protection paths in international investment agreements: from the perspective of “Einarsson v. Canada”[J]. International economic law review, 2024(3): 47-63.)
[21] 李卓卓, 刘子轶. 从分野到融合:多学科视角下的数据跨境研究综述[J]. 情报杂志, 2024, 43(12): 198-207. (LI Z Z, LIU Z Y. From division to integration: a review of cross-border data research from multidisciplinary perspectives[J]. Journal of intelligence, 2024, 43(12): 198-207.)
[22] CHEN M. Developing China’s approaches to regulate cross-border data transfer: relaxation and integration[J]. Computer law & security review, 2024, 54: 105997.
[23] 文铭, 李星熠. “自由-规制”框架下跨境数据流动治理及中国方案[J]. 中国科技论坛, 2024(4): 106-116. (WEN M, LI X Y. Governance of cross-border data flow under the “freedom-regulation” framework and China’s approach[J]. Forum on China science and technology, 2024(4): 106-116.)
[24] MANDEL M. Data, trade and growth[EB/OL]. [2025-06-01]. https://www.upjohn.org/MEG/Presentations/Mandel.pdf.
[25] 沈伟, 苏可桢. 变局之下国际法与国内法互动的转向[J]. 探索与争鸣, 2024(4): 96-108, 179. (SHEN W, SU K Z. The shift of interaction between international law and domestic law in a changing world[J]. Exploration and free views, 2024(4): 96-108, 179.)
[26] 郭海玲, 刘仲山, 卫金金. 我国数据跨境流动协同治理现实困境及纾解路径研究[J]. 现代情报, 2024, 44(9): 142-153. (GUO H L, LIU Z S, WEI J J. Research on realistic dilemmas and solutions for collaborative governance of cross-border data flow in China[J]. Modern information, 2024, 44(9): 142-153.)
[27] 吴玄. 海南自由贸易港数据跨境规则创新路径研究[J]. 海南大学学报(人文社会科学版), 2025, 43(4): 140-148. (WU X. Research on innovative pathways for cross-border data rules in Hainan free trade port[J]. Hainan University journal (humanities and social sciences), 2025, 43(4): 140-148.)
[28] KUNER C. The general data protection regulation: a commentary[M]. Oxford: Oxford University Press, 2017.
[29] 武琼.科技向善:中国全球人工智能治理倡议的核心要义与理论价值[J]. 和平与发展, 2024(5): 25-49, 179-180. (WU Q. Technology for good: core principles and theoretical value of China’s global AI governance initiative[J]. Peace and development, 2024(5): 25-49, 179-180.)
[30] 陈颖, 薛澜.全球跨境数据流动治理的演进与趋势[J]. 国际经济合作, 2024, 40(2): 55-66, 93. (CHEN Y, XUE L. Evolution and trends in global cross-border data flow governance[J]. International economic cooperation, 2024, 40(2): 55-66, 93.)
[31] KUNER C, BYGRAVE L, DOCKSEY C, et al. The EU general data protection regulation: a commentary[M]. Oxford: Oxford university press, 2020.
[32] GREENLEAF G. Global data privacy laws 2021: fifty-four percent of the world’s population covered[J]. Privacy laws & business international report, 2021, 165: 10-13.
[33] 陈可翔.政务数据应用领域行政法的治理逻辑转换[J]. 法学, 2024(11): 54-74. (CHEN K X. Transformation of governance logic in administrative law for government data applications[J]. Law science, 2024(11): 54-74.)
[34] 陈兵.数字企业数据跨境流动合规治理法治化进路[J]. 法治研究, 2023(2): 34-44. (CHEN B. Legalization path for compliance governance of cross-border data flow in digital enterprises[J]. Rule of law research, 2023(2): 34-44.)
[35] 陈景善.人工智能协同公司风险治理的规范化进路[J]. 比较法研究, 2024(6): 163-175. (CHEN J S. Normative approach to AI-enhanced corporate risk governance[J]. Chinese journal of comparative law, 2024(6): 163-175.)
[36] ELOFF J H P, ELOFF M M. Information security architecture[J]. Computer fraud & security, 2005(11): 10-16.
[37] SALEH M S, ALFANTOOKH A. A new comprehensive framework for enterprise information security risk management[J]. Applied computing and informatics, 2011, 9(2): 107-118.
[38] LI J, DONG W, ZHANG C, et al. Development of a risk index for cross-border data movement[J]. Data science and management, 2022, 5(3): 97-104.
[39] JING Y, YANG P. Research on the risk prevention of cross-border e-commerce logistics in China by applying big data technology[J]. Procedia computer science, 2022, 208: 407-413.
[40] 阙天舒, 王子玥. 数字经济时代的全球数据安全治理与中国策略[J]. 国际安全研究, 2022, 40(1): 130-154, 158. (QUE T S, WANG Z Y. Global data security governance and China’s strategy in the era of digital economy[J]. Journal of international security studies, 2022, 40(1): 130-154, 158.)
[41] 孔文豪, 陈玲. 重新理解跨境数据流动治理模式的驱动因素——基于跨国比较的组态分析[J]. 电子政务, 2025(4): 85-97. (KONG W H, CHEN L. Reunderstanding the driving factors of cross-border data flow governance models: a configuration analysis based on cross-national comparison[J]. E-government, 2025(4): 85-97.)
[42] 邓灵斌.数据治理的法律规制:欧盟立法与“中国方案”——基于欧盟《数据治理法》(DGA)的分析与思考[J/OL]. 图书馆杂志. [2025-05-11]. http://kns.cnki.net/kcms/detail/31.1108.G2.20241031.1415.004.html. (DENG L B. Legal regulation of data governance: EU legislation and “China’s approach”——analysis and reflections based on the EU data governance act (DGA)[J/OL]. Library journal. [2025-05-11]. http://kns.cnki.net/kcms/detail/31.1108.G2.20241031.1415.004.html.)
[43] 李金, 李建平, 孙晓蕾, 等. 我国数据跨境传输的风险分析及应对策略[M]. 北京: 科学出版社, 2021. (LI J, LI J P, SUN X L, et al. Risk analysis and response strategies for cross-border data transmission in China[M]. Beijing: Science Press, 2021.)
[44] 杨东, 文诚公.互联网金融风险与安全治理[M]. 北京: 机械工业出版社, 2016. (YANG D, WEN C G. Internet financial risk and security governance[M]. Beijing: Mechanical Industry Press, 2016.)
[45] 罗云开.数据跨境流动的欧美政策演进及启示——基于数据保护与数字经济发展权衡视角[J]. 当代经济管理, 2024, 46(10): 27-37. (LUO Y K. Evolution and implications of EU-US policies on cross-border data flow: balancing data protection and digital economy development[J]. Contemporary economic management, 2024, 46(10): 27-37.)
[46] 王宏.电子系统可靠性工程技术[M]. 南京: 南京大学出版社, 2021. (WANG H. Reliability engineering technology for electronic systems[M]. Nanjing: Nanjing University Press, 2021.)
[47] TALEB-BERROUANE M, KHAN F, HAWBOLDT K. Corrosion risk assessment using adaptive bow-tie (ABT) analysis[J]. Reliability engineering & system safety, 2021, 214: 107731.
[48] 高智勇. 基于Petri网的智慧农业管理流程仿真方法研究[J]. 山东农业大学学报(自然科学版), 2024, 55(3): 413-421. (GAO Z Y. Simulation method for smart agriculture management processes based on Petri net[J]. Journal of Shandong Agricultural University (natural science edition), 2024, 55(3): 413-421.)
[49] BERTOLINI M, BEVILACQUA M, MASON G. Reliability design of industrial plants using Petri nets[J]. Journal of quality in maintenance engineering, 2006, 12(4): 397-411.
[50] LI W, SUN Q, ZHANG J, et al. Quantitative risk assessment of industrial hot work using adaptive bow tie and Petri nets[J]. Reliability engineering & system safety, 2024, 242: 109784.
[51] KAPTAN M. Risk assessment of ship anchorage handling operations using the fuzzy bow-tie method[J]. Ocean engineering, 2021, 236: 109500.
[52] 数据出境安全评估办法[EB/OL]. [2025-01-19]. https://www.cac.gov.cn/2022-07/07/c_1658811536396503.htm. (Measures for security assessment of data exports[EB/OL]. [2025-01-19]. https://www.cac.gov.cn/2022-07/07/c_1658811536396503.htm.)
[53] 促进和规范数据跨境流动规定[EB/OL]. [2025-01-28]. https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm. (Provisions on facilitating and regulating cross-border data flow[EB/OL]. [2025-01-28]. https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm.)
[54] 中华人民共和国网络安全法[EB/OL]. [2025-04-07]. https://flk.npc.gov.cn/detail2.html?MmM5MDlmZGQ2NzhiZjE3OTAxNjc4YmY4Mjc2ZjA5M2Q%3D. (Cybersecurity law of the people’s republic of China [EB/OL]. [2025-04-07]. https://flk.npc.gov.cn/detail2.html?MmM5MDlmZGQ2NzhiZjE3OTAxNjc4YmY4Mjc2ZjA5M2Q%3D.)
[55] 中华人民共和国个人信息保护法[EB/OL]. [2025-03-20]. https://flk.npc.gov.cn/detail2.html?ZmY4MDgxODE3YjY0NzJhMzAxN2I2NTZjYzIwNDAwNDQ%3D. (Personal information protection law of the people’s republic of China [EB/OL]. [2025-03-20]. https://flk.npc.gov.cn/detail2.html?ZmY4MDgxODE3YjY0NzJhMzAxN2I2NTZjYzIwNDAwNDQ%3D.)
[56] 刘金瑞.迈向数据跨境流动的全球规制:基本关切与中国方案[J]. 行政法学研究, 2022(4): 73-88. (LIU J R. Toward global regulation of cross-border data flow: core concerns and China’s approach[J]. Administrative law review, 2022(4): 73-88.)
[57] 董淳锷.市场事前监管向事中事后监管转变的经济法阐释[J]. 当代法学, 2021, 35(2): 69-81. (DONG C E. Economic law interpretation of the shift from ex-ante to in-process and ex-post market regulation[J]. Contemporary law review, 2021, 35(2): 69-81.)
[58] 杨慧妍.国家安全视域下的数据出境合规体系研究——以国内首例涉案数据被鉴定为情报案为例[J]. 情报杂志, 2023, 42(6): 201-207. (YANG H Y. Research on data export compliance system from the perspective of national security: a case study of China’s first data-related case identified as involving intelligence[J]. Journal of intelligence, 2023, 42(6): 201-207.)
[59] 中华人民共和国数据安全法[EB/OL]. [2025-05-10]. https://flk.npc.gov.cn/detail2.html?ZmY4MDgxODE3OWY1ZTA4MDAxNzlmODg1YzdlNzAzOTI%3D. (Data security law of the people’s republic of China [EB/OL]. [2025-05-10]. https://flk.npc.gov.cn/detail2.html?ZmY4MDgxODE3OWY1ZTA4MDAxNzlmODg1YzdlNzAzOTI%3D.)
[60] 个人信息出境标准合同办法[EB/OL]. [2025-01-25]. https://www.cac.gov.cn/2023-02/24/c_1678884830036813.htm. (Measures for standard contracts for personal information exports[EB/OL]. [2025-01-25]. https://www.cac.gov.cn/2023-02/24/c_1678884830036813.htm.)
[61] 梅傲, 陈子文.总体国家安全观视域下我国数据安全监管的制度构建[J]. 电子政务, 2023(11): 104-115. (MEI A, CHEN Z W. Institutional construction of data security supervision in China from the perspective of holistic national security[J]. E-Government, 2023(11): 104-115.)
[62] 刘东阁, 庞瑞芝.金融关联对企业数字化创新的影响研究[J]. 管理学报, 2025, 22(2): 316-325. (LIU D G, PANG R Z. Research on the impact of financial connections on enterprise digital innovation[J]. Chinese journal of management, 2025, 22(2): 316-325.)
[63] 马其家, 刘飞虎.数据出境中的国家安全治理探讨[J]. 理论探索, 2022, (2): 105-113. (MA Q J, LIU F H. Exploration of national security governance in data exports[J]. Theoretical exploration, 2022(2): 105-113.)
[64] 熊光清, 张素敏.总体国家安全观视角下我国数据出境安全管理制度的完善[J]. 哈尔滨工业大学学报(社会科学版), 2023, 25(5): 32-40. (XIONG G Q, ZHANG S M. Improving China’s data export security management system from the perspective of holistic national security[J]. Journal of Harbin Institute of Technology (social sciences edition), 2023, 25(5): 32-40.)
[65] 姚怡帆, 胡峰.生命体免疫视角下数据安全免疫模型构建及应用研究[J]. 情报理论与实践, 2025, 48(2): 92-101. (YAO Y F, HU F. Construction and application of data security immune model from the perspective of biological immunity[J]. Information studies: theory & application, 2025, 48(2): 92-101.)
[66] 董伟玮, 秦音.基于“技术—制度”框架的超大城市政务数据共享体系建构与优化策略[J]. 现代情报, 2025, 45(6): 140-152. (DONG W W, QIN Y. Construction and optimization of government data sharing systems in megacities based on a “technology-institution” framework[J]. Modern information, 2025, 45(6): 140-152.)
[67] 董克, 吴佳纯, 马廷灿.我国数据出境安全风险要素体系研究[J]. 情报理论与实践, 2024, 47(6): 49-59. (DONG K, WU J C, MA T C. Research on the framework of security risk elements in China’s data exports[J]. Information studies: theory & application, 2024, 47(6): 49-59.)
[68] 包柠榛.中概股赴美上市的数据安全审视:风险来源、中美监管与应对[J]. 东北师大学报(哲学社会科学版), 2023(4): 145-155. (BAO N Z. Data security scrutiny of Chinese companies listed in the U.S.: risk sources, Sino-U.S. regulation, and responses[J]. Journal of Northeast Normal University (philosophy and social sciences), 2023(4): 145-155.)
[69] 中共中央办公厅国务院办公厅印发《关于依法从严打击证券违法活动的意见》[EB/OL]. [2025-05-11]. https://www.gov.cn/xinwen/2021-07/06/content_5622763.htm. (General office of the CPC central committee and general office of the state council print and issue the opinions on law-based severe crackdown on illegal securities activities [EB/OL]. [2025-05-11]. https://www.gov.cn/xinwen/2021-07/06/content_5622763.htm.)
[70] 李海英, 马民虎.我国数据跨境流动的治理框架与实践方案[J]. 图书与情报, 2022(6): 50-57. (LI H Y, MA M H. Governance framework and practical solutions for cross-border data flow in China[J]. Library and information, 2022(6): 50-57.)
Outlines

/

〈 〉