Study on the Construction of a Mechanism to Coordinate Interests in the Exercise of the Right to Transfer Personal Information

China's Personal Information Protection Law establishes the right to transfer personal information for the first time and authorizes the state Internet information department to formulate relevant implementation rules. Although the right to transfer personal information is a limitation of the right to carry data as stipulated in the EU General Data Protection Regulation(GDPR), the process of exercising the right to transfer personal information still leads to conflict of interests between the third-party platform and the original platform. Constructing a mechanism for coordination of interests is a key task in formulating relevant implementation rules, which is conducive to reducing resistance to the exercise of the right to transfer personal information and realizing the dual purpose of “strong use and protection” of personal information. The introduction of the “Today's headlines case” highlights the complexity of the conflict of interest in the transfer of personal information and illustrates the urgency of constructing a mechanism for coordination of interests. Then, we systematically construct the right structure of the right to transfer personal information and reveal its special features that distinguish it from the right to carry data. The analysis of the respective interests of the two platforms shows that it is not desirable to adopt a single value orientation for protection, but rather to construct a coordination mechanism for the coexistence of multiple interests. Further, in the process of exercising the right to transfer personal information, it is necessary to balance the interests of the original platform and the third-party platform in terms of cost-sharing mechanism and obligation- sharing mechanism. First, about the cost-sharing mechanism. The third-party platform should share the cost of transferring personal information with the original platform by paying the consideration; the cost of identity verification should be borne by the original platform independently, and the way and process of identity verification should be distinguished according to the type of personal information. Secondly, about the obligation sharing mechanism. The original platform shall review the third-party platform's ability to fulfill compliance obligations and provide assistance to those with insufficient ability to fulfill obligations, but set up an exit mechanism within a certain period of time; among the transmission obligations, distinguish between transfer and restoration for obligation sharing; among the security obligations, the original platform shall bear the main responsibility while the third-party platform shall bear the auxiliary responsibility, and share the risks among them equally by purchasing insurance.