Regulation of Transborder Data Flows under ... - Tilburg University

Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 23
Conspicuous by their absence from the list of countries with transborder data flow
regulation are some of the major world economies such as Brazil, China, India, Japan,
and the United States. However, economic growth over the long term is likely to be
higher in developing countries than in the more developed economies, 65 and many
developing countries have adopted regulatory frameworks for transborder data flows.
Taking African countries as an example, their motivations for enacting such frameworks
include the promotion of electronic commerce, 66 the protection of private life, 67 and the
protection of privacy in connection with large-scale government data collection projects
(such as digitalisation of the electoral rolls). 68 This demonstrates that the motivations for
enacting regulation of transborder data flows in the developing world are similar to those
in the more developed countries, and that such regulation is a global phenomenon, rather
than only an isolated or a regional one.
F. Voluntary and private sector mechanisms
In addition to laws and legislation, a variety of voluntary and private-sector mechanisms
may regulate transborder data flows. For example, the US-EU Safe Harbor framework
can be adopted voluntarily by organisations based in the US that import personal data
from the EU. 69 Safe Harbor gives rise to legally-binding obligations, among which are
protections for ‘onward transfers’ of personal data. 70 The EU also recognizes mechanisms
such as binding corporate rules 71 and standard contractual clauses, 72 which can be entered
into voluntarily but then become legally-binding, as a legal basis for data transfers from
the EU.
65 See, e.g., Carnegie Endowment for International Peace, ‘The World Order in 2050’ (April 2010),
, at 1, predicting that by 2050,
‘traditional Western powers will remain the wealthiest nations in terms of per capita income, but will be
overtaken as the predominant world economies by much poorer countries’.
66 See Government of Mauritius, Debate No. 12 of 01.06.04, Second Reading of the Data Protection Bill
(No. XV of 2004), at 2, stating that adoption of a data protection bill ‘will also constitute a strong incentive
for prospective overseas agencies to do business in Mauritius in the ICT sector proper, or in businesses
where personal data is used routinely’.
67 See Burkina Faso, Assemblée Nationale, Dossier N°06 relatif au projet de loi portant sur la protection
des données à caractère personnel, at 3.
68 See République du Sénégal, Rapport sur le projet de loi N°32/2007 portant sur la protection des données
à caractère personnel, at 3.
69 See European Commission Decision 2000/520 of 26 July 2000 pursuant to Directive 95/46 of the
European Parliament and of the Council on the adequacy of the protection provided by the safe harbor
privacy principles and related frequently asked questions issued by the US Department of Commerce,
[2000] OJ L215/7.
70 See Onward Transfer Principle of the Safe Harbor Privacy Principles issued by the US Department of
Commerce on July 21, 2000, .
71 See Article 29 Working Party, ‘Working Document setting up a framework for Binding Corporate Rules’
(n 49), at 7.
72 See Commission Decision (EC) 2010/87/EU of 5 February 2010 on standard contractual clauses for the
transfer of personal data to processors established in third countries under Directive (EC) 95/46/EC of the
European Parliament and of the Council, [2010] OJ L39/5, Clause 11; Commission Decision (EC)
2004/915 of 27 December 2004 amending Decision (EC) 2001/497 as regards the introduction of an
alternative set of standard contractual clauses for the transfer of personal data to third countries, [2004] OJ
L385/74, Clause 2.