Realistic rights cannot be defined completely in legal texts. There must be blanks, vagueness and even conflicts in the law as a social contract or a contract as a transaction between the parties. However, in the implementation of the law and the performance of the contract, will ultimately be determined by the party (not just the parties) who has the remaining control rights in the incomplete contract, so the degree of realization of the right is determined by the remaining control rights. Although the Civil Code clearly protects data rights as the object of civil rights to reduce the transaction cost of data circulation, it selectively sets aside the issue of further confirmation of data rights. When rights and interests of data cannot be clearly defined, or the cost of definition is too high, according to the requirements of mechanism design, the vague definition of legal rights can be made up to a certain extent through reasonable allocation of the remaining control rights in important links, key auxiliary links, or main application scenarios in the process of data circulation. Due to the constraints of decision-making information costs and the limitations of government incentives, it is impossible to allocate residual control rights perfectly through a formal system; and to clearly allocate a certain residual control rights to parties, third-party professional institutions, etc., it is still hope that the market mechanism is a configuration that plays a fundamental role. China's current selection of rules on rights and interests of data protection and promotion of data flow has moved towards the combined mode of "liability rules + control rules". Such as standard contract, enterprise data protection reputation mechanism, technical standards, data assets and data infringement compensation pricing mechanism, etc., can be used to clarify some important allocation of residual control rights, support the implementation of relevant legal rules or making up for their deficiency. Here are some concrete examples related to the above. A standard contract can adopt a combination of "general terms + special terms"; the enterprise data privacy protection reputation mechanism can set up a hierarchical disclosure mechanism to specifically determine the disclosure content, disclosure method and disclosure scope; the formulation and improvement of technical standards should clarify the target positioning, roughness and detail of the standard, and how to coordinate with the hard law as a soft law; and the data assets and data infringement compensation evaluation made by a third-party evaluation agency should be the basis for bargaining between the transaction parties or court judgment, but it is not suitable to be compulsorily stipulated as the transaction price. This function similar to decentralized legislation can not only accumulate experience, but also reduce the cost of legislation and the social cost of legislative failure. Consequently, in the face of the system construction problem of how to manage the data flow, a realistic and feasible approach is to continuously improve the construction of data-related legal systems and supporting measures through the continuous accumulation of effective mechanism designs.