Personal Data Transfers in International Trade and EU Law: A Tale of Two ‘Necessities’

Abstract

Cross-border flows of personal data have become essential for international trade. European Union (EU) law restricts transfers of personal data to a degree that is arguably beyond what is permitted under the EU’s World Trade Organization commitments. These restrictions may be justified under trade law’s ‘necessity test.’ The article suggests that they may not pass this test. Yet, from an EU law perspective, the right to the protection of personal data is a fundamental right. An international transfer of personal data constitutes a derogation from this right and, therefore, must be consistent with another necessity test, the ‘strict necessity’ test of the derogation clause of the EU Charter of Fundamental Rights. This article shows how a simultaneous application of the trade law and EU Charter ‘necessities’ to EU restrictions on transfers of personal data creates a catch-22 situation and sketches the ways out of this compliance deadlock.

Untitled

“…При этом существует противоречие между обязательством по защите персональных данных в соответствии со ст. 8 Хартии ЕС о фундаментальных правах, Регламентом по защите персональных данных Европейского союза [EU, 2016] и обязательствами ЕС по либерализации торговли и обеспечению свободы потоков данных [Yakovleva, 2020]. Приоритетом Китая остается киберсуверенитет 5 , безопасность данных и, соот-ветственно, жесткое регулирование, предполагающее требования локализации и осторожное отношение к концепции свободного потока данных 6 .…”

Protecting Our Mosts Valuable Personal Data: A Comparison Of Transborder Data Flow Laws In The European Union, United Kingdom, And Indonesia

“…13 United Kingdom Data Protection Act (2018) [Hereinafter as UK DPA]. 14 Glenn Wijaya,'Residual Issues in Indonesia's Forthcoming Personal Data Protection Law' (iapp.org,18 August 2022) <https://iapp.org/news/a/residual-issues-in-indonesias-forthcoming-personal-dataprotection-law/>. 15 Ady Thea DA, 'Advokat Ini Ingatkan 3 Ketentuan Transfer Data Pribadi Ke Luar Negeri' (hukumonline, 4 October 2022) <https://www.hukumonline.com/berita/a/advokat-ini-ingatkan-3-ketentuantransfer-data-pribadi-ke-luar-negeri-lt633baec525388/>.…”

“…Nowadays, data transfers between companies have been common, including those with overseas branches or parent companies. 18 For example, with the use of pervasive media, 19 personal data of an individual or company can be transferred internationally to foreign platforms. Data exchanges on the borderless platform have increased in the cyberspace world, and it does not stop with the initial data when the data is sent, and continue to grow and develop along with the activities and movements in question .…”