Regulation of Transborder Data Flows under ... - Tilburg University

More documents

Recommendations

Info

Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 36 H. Applicable law and jurisdiction In practice, the subjects of transborder data flow regulation and applicable law are often intertwined, and countries may use rules on applicable law to protect data transferred beyond their borders. For example, personal data may generally not be transferred outside the geographic boundaries of the EU without a legal basis, which may require the continued application of EU law to the processing of the data in other countries. Thus, under EU law, certain legal bases for international data transfers (e.g., signature of EU-approved standard contractual clauses between data exporter and data importer that impose data processing obligations based on EU law) result in the application of EU data protection standards in other countries where personal data are processed. Moreover, EU standards are then also applied to further transfers from the data importer to third parties (so-called ‘onward transfers’). 126 In addition, rules on applicable law may mandate the application of EU data protection law in some cases involving the transfer of personal data outside the EU even when an ‘international data transfer’ under the rules on transborder data flows is not considered to take place. For example, when an individual in the EU enters data in an Internet search engine or uploads data onto an online social network operated from a server outside the EU, this is not generally considered to result in an ‘international data transfer’, but it does result in the direct applicability of EU law to the data processing based on Article 4(1)(c) of the EU Directive. 127 Application of Article 4(1)(c) is designed to avoid the circumvention of EU law, 128 which, as explained above, is also the main justification given for regulation of transborder data flows. Thus, the EU rules on applicable law and those concerning the regulation of transborder data flows may both serve the same purpose. Regulation in other regions may also apply data protection and privacy law to the processing of data transferred outside the country. The APEC Privacy Framework seems to provide that the protections of the law of the place from which the data were transferred ‘attach to’ the data and continue to be applicable as they are transferred abroad. 129 Further examples are provided by the Privacy Act of New Zealand, certain 126 See, e.g., Commission Decision (EC) 2004/915 of 27 December 2004 amending Decision (EC) 2001/497 as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries, [2004] OJ L385/74, Clauses II(i) and III; Safe Harbor Onward Transfer Principle, . 127 See Article 29 Working Party, ‘Opinion 5/2009 on online social networking’ (WP 163, 12 June 2009), at 5-7. 128 See C de Terwagne and S Louveaux, ‘Data Protection and Online Networks’, 13 Computer Law and Security Report 234, 238 (1997). 129 APEC Privacy Framework (n 2), Principle IX. Accountability, at 31, , stating ‘Thus, information controllers should take reasonable steps to ensure the information is protected, in accordance with these Principles, after it is transferred’. See Christopher Kuner, ‘Data Protection Law and International Jurisdiction on the Internet (Part 1)’, 18 International Journal of Law and Information Technology 176, 188-89 (2010) and Christopher Kuner, ‘Data Protection Law and International Jurisdiction on the Internet (Part 2)’, 18 International Journal of Law and Information Technology 227 (2010).
Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 37 provisions of which apply to information held outside that country, 130 and the draft Privacy Principles of the Australian government, which make the entity transferring data abroad liable for breaches of the Principles committed outside Australia by the data importer. 131 In addition, rules on applicable law and jurisdiction with regard to data protection and privacy law are notoriously unclear, 132 which can create problems in particular for individuals, who often may not be able to determine which law applies to the processing of their personal data, and to which national regulatory authorities they may turn if a problem arises. 130 New Zealand Privacy Act 1993, section 10; Law Commission of New Zealand, ‘Review of the Privacy Act 1993’ (March 2010), , at 390. 131 See Australian Government, ‘Australian Privacy Principles, Companion Guide’ (n 56), at 13. 132 See, e.g., European Commission, ‘Comparative Study on Different Approaches to New Privacy Challenges in Particular in the Light of Technological Developments’, Final Report, 20 January 2010, , at 24, referring to the ‘ambiguity and different implementation of the “applicable law” rules’ of EU data protection law.
Page 1 and 2: TILT (TILBURG INSTITUTE FOR LAW, TE
Page 3 and 4: Kuner/Regulation of Transborder Dat
Page 35: Kuner/Regulation of Transborder Dat
Page 87 and 88:
Kuner/Regulation of Transborder Dat
Page 89 and 90:
Kuner/Regulation of Transborder Dat
show all

Regulation of Transborder Data Flows under ... - Tilburg University

Create successful ePaper yourself

Delete template?

Save as template?