1. Lee A. Bygrave, Norwegian Research Center for Computers and Law
The GDPR’s data export regime: caught between a rock and hard place?
EU2017.ee; University of Tartu, 8 Sept. 2017

2. This is not bananas we’re talking about!

3. The second crusade?
“Why would Europe not be proud to contribute its requiring standards of respect for fundamental rights to the world in general?”
-- CJEU President, Koen Lenaerts, 2015

4. EU as global rule maker The Brussels effect …
Over 100 countries with dp laws
Most follow ‘EU’ model
Cf. APEC Privacy Framework
Position of PRC?

5. GDPR data export regime: tried and tested
Over 40 years of European TBDF restrictions
Legitimate rationale: anti-circumvention (not protectionism or proselytization!)
GDPR export regime ≈ DPD export regime
Reliance on adequacy assessment of third country
But some tweaking and added detail …

6. Some examples of tweaking
Explicit provision for BCRs (Art. 47)
Rules extend to data transfers to intl. orgs.
More fine-grained adequacy assessment
E.g. adequacy of sectors, not whole jurisdictions‘
‘Anti-FISA’ clause (aka ‘Snowden’ clause):
‘Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State’ (Art. 48)
[not binding on UK or Ireland]

7. GDPR data export regime: trying and tiring (and tired?)
Cumbersome and exacting
focus on practical effect
Lopsided in focus
relatively few adequacy findings
privileged status of USA
Safe Harbor Agreement (2000);
EU-U.S. Privacy Shield (2016);
Umbrella Agreement for data exchange between LEAs in EU and U.S. (2017)
Where does PRC feature?

8. Don’t forget the judiciary (and Charter)!

9. Fundamental rights jurisprudence as game changer
Ratcheting up of standards
Adequate protection = ‘essentially equivalent’ protection: Case C-362/14, Schrems v. Data Protection Commissioner
CFR as primary benchmark
Less room for pragmatism
Cf. SHA and NZ adequacy decision
Would Lindqvist (Case C-101/01) be resolved differently now?
EU TBDF regulation “caught between reality and illusion” (Kuner)

10. “Interoperability” as holy grail
OECD Guidelines, para. 21;
APEC Cross-Border Privacy Rules