Legal Challenges and New Governance Paths for User Data Protection on Online Shopping Platforms

网络购物平台用户数据兼具人格权益与经济价值属性，个人信息与隐私存在交叉易导致责任竞合。当前数据保护面临多重困境，收集环节存在超范围收集、捆绑式授权和隐性收集问题；共享流转环节透明度不足、责任界定模糊，跨境流动监管缺失；数据泄露侵权时，责任主体认定难、损害量化阻碍大且司法救济成本高。法律责任体系中，民事责任采用“过错推定 + 举证责任倒置”，行政责任需优化裁量基准，刑事责任实现从个人到单位追责转变，同时应落实数据全生命周期保护要求。为完善保护，需构建精细化数据分类管理体系，保障用户权利，完善动态监管与应急响应，提升全民数据素养，强化平台义务，建立全链条责任体系，以实现用户权益保护与数字经济发展共赢，并推动形成符合国情的用户数据保护范式。User data on online shopping platforms has dual attributes of personality rights and economic value. The overlap between personal information and privacy can easily lead to liability concurrence. Current data protection faces multiple dilemmas: in the collection phase, there are issues of excessive data collection, bundled authorization, and implicit data collection; in the sharing and circulation phase, there is insufficient transparency, vague liability definition, and lack of cross-border flow supervision; when data leakage occurs, it is difficult to identify responsible entities, quantify damages, and the cost of judicial relief is high. In the legal liability system, civil liability adopts “presumption of fault + inversion of the burden of proof”, administrative liability needs to optimize discretion benchmarks, criminal liability shifts from individual to unit accountability, and full lifecycle data protection requirements should be implemented. To improve protection, it is necessary to build a refined data classification management system, safeguard user rights, improve dynamic supervision and emergency response, enhance public data literacy, strengthen platform obligations, and establish a full-chain liability system, so as to achieve a win-win situation between user rights protection and digital economic development, and promote the formation of a user data protection paradigm that suits national conditions.