ARTICLES 

The standard for personal data protection is the system embodying the EU’s protection for fundamental rights. The GDPR rules on international transfers of personal data and the CJEU’s judicial review both focus on the realization of the EU’s personal data protection standard. The general principle of data transfers is the permanent minimum protection standard for outbound data. Adequacy decisions and standard data protection clauses are the legal tools to apply the EU standard to specific countries and specific companies wholly or individually. For China’s data legislation, we should comprehensively analyze the potential risks of the EU model, be cautious of the standard data protection clauses, adequacy decisions and the other complex legal tools with EU characteristics, get rid of the historical inertia of legal transplantation of the European statutory law, and avoid blindly borrowing from the GDPR model and falling into the “long-arm” jurisdiction of the CJEU. As to China’s data flow legislation, we should take an overall consideration of the personal data and non-personal data flow legislation, explore value-neutral rules to provide new ideas for legal convergence, and take a lead in the global competition in data legislation.