Regulation of Transborder Data Flows under ... - Tilburg University

Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 45
Greater transparency also needs to be created for individuals. This means that privacy
notices giving information about transborder data flows should be drafted in clearer
language; that the use of consent to transfer data should be limited; and that cross-border
regulatory cooperation should be increased, so that individuals can more easily assert
their rights with regard to data that have been transferred to other countries. Data
controllers also need to provide greater transparency with regard to the location and
identity of entities they use to process and store personal data.
H. Areas for further work
Much important research remains to be done regarding the regulation of transborder data
flows. Among areas where research is needed are the economic effects of transborder
data flows; the benefits and costs of regulation; and the attitudes of individuals to them.
Further policy instruments and practical tools could also be drafted, such as guidelines to
allow entities exporting personal data to evaluate the risks of such exports (similar to the
Guidelines of the Treasury Board of Canada referred to above). Such guidelines could
define more precisely various risk levels as they relate to particular data processing
scenarios. In addition, many developing countries would likely benefit from the drafting
of a model law dealing with transborder data flows, so that they do not always have to
start from scratch or use a regional or national model when doing so. However, the
drafting of a model law would require international agreement on the default rule for
transborder data flows, which has so far been lacking.
It would be difficult to select a single international organisation to coordinate such work.
Data protection and privacy is still seen as peripheral to the work of many international
organisations, and there is not a single one that combines both the wide membership and
specialised expertise to deal with all the ramifications of the topic. This is partly because
data protection and privacy law does not neatly fall into a particular area of law, but is a
mixture of various areas such as consumer protection, human rights law, and other
areas. 153 Each of the organisations that deal with the topic brings strengths and
weaknesses. In particular, those organisations with the most expertise in policy issues
concerning transborder data flows (such as the OECD) lack membership of developing
countries, 154 while the various UN organisations tend not to have as much expertise in
data protection and privacy law. Regional institutions also may be too closely tied to one
region to deal with issues of a global nature. This argues for enhanced cooperation of a
number of organisations in order to make use of the strengths which each of them has.
153 See Jon Bing, ‘Data Protection, Jurisdiction and the Choice of Law’ (1999) Privacy Law & Policy
Reporter 92, .
154 Michael Kirby, ‘The History, Achievement and Future of the 1980 OECD Guidelines on Privacy’ (n
87), at ___, asking what the OECD should do ‘to ensure the consideration of representative opinions from
developing countries in the expression of the values that will impact on global technology’.