Extraterritorial Impact in Data Protection Law through an EU Law Lens

Abstract

Data Protection is widely recognised as a field of European Union (EU) law that has significant traction beyond the EU’s borders, leading to allegations of data protection imperialism, protectionism and data localization on the EU’s part. This paper suggests an alternative narrative: one of consistency with the broader corpus of EU law. It illustrates, first, that extraterritoriality mechanisms such as those in EU data protection law are also applied in other fields of EU law. Second, using the example of data flows between the UK and the EU at the end of the transition period, this paper suggests that although protectionist motives might provide an explanation for such extraterritoriality a more plausible justification for this approach is to be found in existing and nascent general principles of EU law, such as mutual trust and the autonomy of the EU legal order. This internal consistency with EU law contradicts claims of data exceptionalism. What it offers is an explanation for, rather than a justification or legitimization of, the extraterritorial impact of EU data protection law.