Lee A. Bygrave, Norwegian Research Center for Computers and Law The GDPR’s data export regime: caught between a rock and hard place? EU2017.ee; University of Tartu, 8 Sept. 2017

This is not bananas we’re talking about!

The second crusade? “Why would Europe not be proud to contribute its requiring standards of respect for fundamental rights to the world in general?” -- CJEU President, Koen Lenaerts, 2015

EU as global rule maker The Brussels effect … Over 100 countries with dp laws Most follow ‘EU’ model Cf. APEC Privacy Framework Position of PRC?

GDPR data export regime: tried and tested Over 40 years of European TBDF restrictions Legitimate rationale: anti-circumvention (not protectionism or proselytization!) GDPR export regime ≈ DPD export regime Reliance on adequacy assessment of third country But some tweaking and added detail …

Some examples of tweaking Explicit provision for BCRs (Art. 47) Rules extend to data transfers to intl. orgs. More fine-grained adequacy assessment E.g. adequacy of sectors, not whole jurisdictions‘ ‘Anti-FISA’ clause (aka ‘Snowden’ clause): ‘Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State’ (Art. 48) [not binding on UK or Ireland]

GDPR data export regime: trying and tiring (and tired?) Cumbersome and exacting focus on practical effect Lopsided in focus relatively few adequacy findings privileged status of USA Safe Harbor Agreement (2000); EU-U.S. Privacy Shield (2016); Umbrella Agreement for data exchange between LEAs in EU and U.S. (2017) Where does PRC feature?

Don’t forget the judiciary (and Charter)!

Fundamental rights jurisprudence as game changer Ratcheting up of standards Adequate protection = ‘essentially equivalent’ protection: Case C-362/14, Schrems v. Data Protection Commissioner CFR as primary benchmark Less room for pragmatism Cf. SHA and NZ adequacy decision Would Lindqvist (Case C-101/01) be resolved differently now? EU TBDF regulation “caught between reality and illusion” (Kuner)

“Interoperability” as holy grail OECD Guidelines, para. 21; APEC Cross-Border Privacy Rules