Un-mapping Personal Data Transfers

Abstract

European data protection law channels data processing in many ways: it fabricates spaces within which personal data can move freely, circumscribes borders that personal data shall not cross unless following ad-hoc paths and erects legal routes through which personal data might move. These seemingly discordant gestures of personal data liberation and blocking at borders, of data confinement and data release, appear to presuppose that personal data can be managed almost materially, let loose, stopped or conveyed for specific destinations through delimited channels. More generally, the recurrent notion of data transfers hints that data are effectively being sent or received, pull or pushed, across existing tracks, and only through them. This contribution explores the tensions between this viewpoint and the acknowledgement, by EU personal data protection law itself, of the legal irrelevance of data location. To do so, it investigates the definition of the territorial scope of European data protection laws, as well as the fictional aspects of regulating personal data protection in terms of a co-existence of areas of free movement of data and spaces where data flows, depicting hermetic transfers. Discussing jurisprudential developments such as the Schrems judgment, the paper gives special attention to the definition of the territorial scope of application of the proposed General Data Protection Regulation. Ultimately, this article aims to move beyond current discussions about the territoriality and extra-territoriality of EU data protection law by critically inquiring into the tensions between these notions and data (re-)location.