Cross-border Data Transfer Research Articles

Shades of authoritarian digital sovereignty: divergences in Russian and Chinese data localisation regimes

ABSTRACT The concept of sovereignty is now referred to in cyberspace-related policy by a range of governments, both authoritarian and democratic. At the same time, the most prominent proponents of state – or sovereignty-centric models of internet governance are Russia and China, whose positions are often characterised as a shared ‘Sino-Russian’ model. This paper subjects this idea of a shared Sino-Russian approach to empirical scrutiny by conducting a comparative analysis of rules, regulations and policies on data localisation in both countries. By delimiting the research question to regulations on data localisation and cross-border data transfers in both countries, we identify an important set of similarities and differences between the Russian and Chinese approaches. They share some features associated with authoritarian regimes, such as uncertainty around the selective enforcement of broadly formulated rules and a centralised assessment of outbound data transfers. However, we also find significant differences in the level of institutional centralisation, degrees of responsiveness within the policymaking process, and economic logics driving data localisation and cross-border transfer regulations. Based on these findings, we argue that despite a perception that Russia and China adhere to a similar model of authoritarian digital sovereignty, there are significant disparities in their data localisation regimes.

Data protection legislation in Africa and pathways for enhancing compliance in big data health research

BackgroundThe increasing availability of large volumes of personal data from diverse sources such as electronic health records, research programmes, commercial genetic testing, national health surveys and wearable devices presents significant opportunities for advancing public health, disease surveillance, personalized medicine and scientific research and innovation. However, this potential is hampered by a lack of clarity related to the processing and sharing of personal health data, particularly across varying national regulatory frameworks. This often leaves researcher stakeholders uncertain about how to navigate issues around secondary data use, repurposing data for different research objectives and cross-border data sharing.MethodWe analysed 37 data protection legislation across Africa to identify key principles and requirements for processing and sharing of personal health and genetic data in scientific research. On the basis of this analysis, we propose strategies that data science research initiatives in Africa can implement to ensure compliance with data protection laws while effectively reusing and sharing personal data for health research and scientific innovation.ResultsIn many African countries, health and genetic data are categorized as sensitive and subject to stricter protection. Key principles guiding the processing of personal data include confidentiality, non-discrimination, transparency, storage limitation, legitimacy, purpose specification, integrity, fairness, non-excessiveness, accountability and data minimality. The rights of data subjects include the right to be informed, the right of access, the right to rectification, the right to erasure/deletion of data, the right to restrict processing, the right to data portability and the right to seek compensation. Consent and adequacy assessments were the most common legal grounds for cross-border data transfers. However, considerable variation exists in legal requirements for data transfer across countries, potentially creating barriers to collaborative health research across Africa.ConclusionsWe propose several strategies that data science research initiatives can adopt to align with data protection laws. These include developing a standardized module for safe data flows, using trusted data environments to minimize cross-border transfers, implementing dynamic consent mechanisms to comply with consent specificity and data subject rights and establishing codes of conduct to govern the secondary use of personal data for health research and innovation.

Comparative analysis of data protection regulations in East African countries

Purpose Protection of personal data is integral to the digital economy, ensuring trust and privacy as its foundational elements. The purpose of this study is to analyze data protection laws in Tanzania, Kenya, Uganda and Rwanda to understand their legal frameworks and identify challenges hindering their effective implementation. Design/methodology/approach This study uses a comparative exploratory case study approach, analyzing legal frameworks of four East African (EA) countries through examination of legal documents, official reports and academic articles. The dimensions of analysis include registration, supervisory authority, data subject rights and cross-border data transfer regulations. Findings While all four EA countries are in the process of enacting data protection acts, they differ in scope, provisions and enforcement; more needs to be done to ensure mature data protection in these countries. The commonalities and distinctions in the legal frameworks are underscored, providing a mapping of data protection regulations in the EA region. Moreover, this study reports implementation constraints and areas for improvement. Practical implications The findings of this study provide valuable insights for policymakers, highlighting areas where data protection regulations can be improved. The results of this study can guide harmonizing regional data protection laws, ensuring consistent and effective enforcement. This study offers a foundation for future policy development and regional cooperation on data protection issues. Social implications The social implications of this research lie in its potential to shape public attitudes on data protection and privacy rights. By highlighting these concerns, this study may influence societal norms and values, encouraging a more informed and conscientious public discourse on inclusive policies that consider the diverse needs of different regional populations. Originality/value This study provides a pioneering comparative analysis of data protection regulations across four EA countries, offering unique insights into the regional variations and commonalities in legal frameworks. Its value lies in informing future policy development, enhancing regional cooperation and contributing to the harmonization of data protection practices in the selected EA countries, which remains an under-explored area in existing literature.

Correction to: The conflict between China’s restrictions on cross-border data transfer and US discovery of evidence

Correction to: The conflict between China’s restrictions on cross-border data transfer and US discovery of evidence

Cross-Border Data Transfer between the gcc Data Protection Laws and the gdpr

Abstract This article explores the procedures related to data protection laws in the Gulf Cooperation Council States (gcc) and the European Union (EU) regarding the General Data Protection Regulation (gdpr). It draws conclusions about the rules governing the transfer of personal information outside of a country. Transfers of personal data to foreign countries or international organizations are discussed, specifically, transfers based on an ‘adequacy’ judgment, or transfers subject to suitable protections. The article also highlights the primary modifications made to safeguard the outbound transmission of personal information in the EU and the gcc states. The article shows that the gcc nations are concerned about protecting citizens and residents’ personal information and that there is room for development in the legislative process regarding the improvement of personal data protection regulations.

National security as the trump card: assessing China's legal regime on cross-border data transfer

ABSTRACT A strong regulatory framework for cross-border data transfer is crucial to balance the relationships between national security, economic interests, and individual privacy. However, China's approach, utilizing security assessment and standard contract clauses, prioritizes national security above all else. The recent Regulation on Standardizing and Promoting Data Cross-border Transfer strengthens this approach, suggesting a continued focus on national security for the foreseeable future. This emphasis on national security is not accidental, but rather a core principle of China's long-held ‘national security comes first’ doctrine and its unique political philosophy, which places public interests above private ones. Accordingly, China has implemented a type of soft data localization, significantly affecting foreign companies operating in its borders and affecting the landscape of consumer privacy protection.

Legal Issues of Cross-Border Data Transfer in the Era of Digital Government

Legal Issues of Cross-Border Data Transfer in the Era of Digital Government

Developing China's Approaches to Regulate Cross-border Data Transfer:Relaxation and Integration

This article illustrates the developing Chinese cross-border data flow regulation regime deriving from a holistic national security conception to its balance with personal information protection and digital economic development. Under the pressuring demand of digital economy development and an increasing appeal to global data governance, China is progressively improving and modifying its original government-led and restrictive cross-border data regulations. Subsequent practices and the publication of the Provisions on Promoting and Regulating Cross-border Data Transfer (PPR) in March 2024 deliver a clear sign of relaxation on restrictions on cross-border data flow, especially on the subject of personal information outbound transfer. Detailed comparison with data provisions in the Regional Comprehensive Economic Partnership (RCEP), the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), and the Digital Economy Partnership Agreement (DEPA) demonstrates that global governance of cross-border data flows is unshaped but not unrealistic, even with current fragmented national approaches. China has established a complete personal information protection legal regime and is very close to integrating into transnational cooperation for a broader framework. In addition, by coordinating national provisions regarding cross-data transfer with international rules and piloting lenient cross-border data supervision mechanisms in numerous Pilot Free Trade Zone (PFTZ), China is ready to evolve its cross-border data flow regulations and contribute to global data governance step-by-step.

REGULATION OF CROSS-BORDER DATA FLOW AND ITS PRIVACY IN THE DIGITAL ERA

We are living in a world where information systems are becoming a new weapon to control the future. When the data flows across national borders, it becomes an invaluable resource for economic and informational development in any nation. Today, cross-border data flows are an important component of international trade because companies are frequently transfer customer’s and employee’s data across different countries. This paper will examine the importance of the free flow of cross-border data and its privacy concerns. It also examines the failure of the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, to provide protection from cross-border data transfer; specifically, the Digital Personal Data Protection Act, 2023, is silent on the criteria of listing countries for data transfer and the processing of personal data of those data principals who are living outside India. Some countries have implemented laws pertaining to “data localization” as a means to restrict the movement of data outside their respective borders, but it affects international trade and development. So, it raises a question: What kind of and how much data do nations have to restrict for cross-border data transfer internationally? This paper analyse the General Data Protection Regulation of the European Union, the Cross-Border Privacy Rules of the Asia-Pacific Economic Cooperation of the United States, and the Privacy Shield Framework between the EU and the US. In the end this paper concludes with suggestions for the privacy of cross-border data and the need of uniform law for its worldwide applicability.

THE LEGAL FRAMEWORK FOR CROSS-BORDER DATA TRANSFER BETWEEN MAINLAND CHINA AND HKSAR

Cross-border data transfer is a hard issue in today’s world of “digital nationalism”. In this post-Snowden world, data-localization has become the norm. China has adopted data localization rules in various laws, from Internet Security Law to Data Security Law. China’s constitutional structure of “one country, two systems” presents a unique question to data localization: should cross-border data transfer between the Mainland and SARs (Special Administrative Regions) be constrained by data-localization rules? Since both basic laws for Hong Kong and Macau define these two SARs as "free trade" zones and "separate customs" territories, once data from the Mainland are transferred to the SARs, there would be no existing laws to hinder their further flow to the globe. Furthermore, the SARs have their laws protecting data rights and regulating data use, which are quite different from the national laws. These unique features render cross-border data transfer within China a challenging and interesting topic. This article takes the challenge by focusing on the legal framework for data transfer between Mainland China and Hong Kong. It delineates the relevant legal rules in China and its HKSAR, points out the obstacles and difficulties, and suggests reforms. Keywords: Cross-Border Data Transfer, Digital Sovereignty, Data Localization, National Security, Hong Kong SAR, Mainland China

What Can IIAs Contribute to Regulating Cross-border Data Transfer: A Threshold Analysis

Abstract States are using legislation to regulate cross-border data transfer, which has raised new concerns that international investment agreements (IIAs) may be used to protect foreign investment. According to current IIA texts and arbitration practices, some data is likely to be regarded as ‘investment’, but indefinite data ownership and invisibility ‘in the territory’ make use traditional IIA structures to regulate cross-border data transfer uncertain. What IIAs can contribute to regulating cross-border data transfer has a significant impact on the protection of foreign investments. IIAs need to be reformed to keep their vitality in the face of the challenges brought by digital technology. As a response, they can clarify essential concepts, including when is data an ‘investment’ and who is the ‘investor’ that is entitled to bring claims. Considering the distinct data realms, IIA reform is more likely to be initiated through bilateral or regional negotiations among States with similar cultures or complementary interests.

PDPHE: Personal Data Protection for Trans-Border Transmission Based on Homomorphic Encryption

In the digital age, data transmission has become a key component of globalization and international cooperation. However, it faces several challenges in protecting the privacy and security of data, such as the risk of information disclosure on third-party platforms. Moreover, there are few solutions for personal data protection in cross-border transmission scenarios due to the difficulty of handling sensitive information between different countries and regions. In this paper, we propose an approach, personal data protection based on homomorphic encryption (PDPHE), to creatively apply the privacy computing technology homomorphic encryption (HE) to cross-border personal data protection. Specifically, PDPHE reconstructs the classical full homomorphic encryption (FHE) algorithm, DGHV, by adding support for multi-bit encryption and security level classification to ensure consistency with current data protection regulations. Then, PDPHE applies the reconstructed algorithm to the novel cross-border data protection scenario. To evaluate PDPHE in actual cross-border data transfer scenarios, we construct a prototype model based on PDPHE and manually construct a data corpus called PDPBench. Our evaluation results on PDPBench demonstrate that PDPHE cannot only effectively solve privacy protection issues in cross-border data transmission but also promote international data exchange and cooperation, bringing significant improvements for personal data protection during cross-border data sharing.

Beyond Digital Protection(ism)

Abstract What values and conceptualizations of data are being advanced through new data protection regulations in Asia? This article answers this question with a comparative analysis of data protection regulations in China, India, and South Korea. The article identifies four key dimensions of divergence: conceptualizations of personal and sensitive information, cross-border data transfer restrictions, state exceptions, and considerations for platforms. This leads to three conclusions: local notions of “privacy” are animated by complex domestic priorities and geopolitics, data protection regulations contribute to platform governance, and local exceptions to data protection regulations reveal diverse political strategies to manage citizen-state relations.

Cross-jurisdictional Data Transfer in Health Research: Stakeholder Perceptions on the Role of Law

Large data-intensive health research programmes benefit from collaboration amongst researchers who may be located in different institutions and international contexts. However, complexities in navigating privacy frameworks and data protection laws across various jurisdictions pose significant challenges to researchers seeking to share or transfer data outside of institutional boundaries. Research on the awareness of data protection and privacy laws amongst stakeholders is limited. Our qualitative study, drawn from a larger project in Singapore, revealed insights into stakeholders’ perceptions of the role of law in cross-national health data research. Stakeholders in our study demonstrated a range of perceptions regarding the role of data protection law in governing the collection and transfer of health data for research. The main criticisms included inadequate legal protection to data and lack of uniformed data protection standards. Despite these criticisms, participants recognised the importance of data protection law in supporting cross-border data transfers and proposed measures to improve perceived limitations of existing laws. These measures include strengthening existing legal framework, establishing contractual agreements and imposing severe punishments for data misuse.

Banks, open banking and data protection

As economic systems continue to evolve, with a particular focus on digital, the banking sector is at the forefront of technological advances, revolutionizing the way customers' finances are managed. With the rapid digitization of financial technologies, the importance of bank data protection and confidentiality measures increases, especially in the context of cross-border data transfers in which different actors are involved, both from the regulated financial-banking area and from less regulated areas, which together can offer open banking services (open-banking). Banking entities around the world are entrusted with customers' sensitive personal and financial data, making the principle of data security a primary concern for maintaining customer trust. Effective data protection in banking encompasses a complex approach, in strict compliance with applicable national and international regulations, state-of-the-art encryption technologies and comprehensive risk management strategies to maintain the highest standards of security, transparency and trust in the system banking.

Hunter: Tracing anycast communications to uncover cross-border personal data transfers

Cross-border personal data transfers are heavily regulated worldwide, with data protection authorities imposing huge fines on organizations that fail to meet their strict compliance requirements. However, network-level optimizations such as anycast addresses were not designed with personal data in mind, and their use may unwittingly divert personal data out of a legal boundary. This paper describes Hunter, an automated method to trace anycast communications and identify those threatening data protection compliance. We have applied Hunter in the wild to a set of Android apps to discover that all apps observed sending personal data to anycast addresses eventually carry out international transfers but fail to disclose them in their privacy policies. Our findings suggest that using anycast addresses to transmit personal data generally results in data protection compliance issues.

Global data privacy laws: A critical review of technology's impact on user rights

In the rapidly evolving landscape of technology, the intersection with data privacy laws has become a focal point for scholars, policymakers, and practitioners alike. This paper provides a comprehensive and critical examination of the global data privacy laws in light of the profound impact of technology on user rights. As the digital era progresses, the balance between technological innovation and the protection of individual privacy rights has become increasingly complex. The analysis encompasses a wide range of global data privacy frameworks, including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other relevant regional legislations. The paper explores the challenges and opportunities presented by emerging technologies, such as artificial intelligence, machine learning, and big data analytics, in shaping the landscape of data protection. Furthermore, the study evaluates the effectiveness and enforcement mechanisms of existing data privacy laws in addressing the ethical implications of technology, particularly in the context of user consent, data breaches, and algorithmic decision-making. Special attention is given to the evolving nature of digital surveillance, biometric data processing, and the implications of cross-border data transfers. In order to foster a comprehensive understanding, the paper also reviews the evolving nature of user rights and consent in the digital age. It critically examines the adequacy of current legal frameworks in addressing the challenges posed by technology-driven intrusions into individual privacy, considering issues of transparency, accountability, and user empowerment. By providing a nuanced analysis of the interplay between global data privacy laws and technological advancements, this paper aims to contribute to the ongoing discourse on the need for adaptive and robust legal frameworks. It calls for a proactive approach to address the evolving landscape, advocating for a harmonized and globally inclusive regulatory environment that safeguards user rights without stifling technological innovation.

The new EU-US data protection framework's implications for healthcare.

In July 2023, the United States and the European Union introduced the Data Privacy Framework (DPF), introducing the third generation of cross-border data transfer agreements constituting adequacy with respect to personal data transfers under the General Data Protection Regulation (GDPR) between the European Union (EU) and the US. This framework may be used in cross-border healthcare and research relationships, which are highly desirable and increasingly essential to innovative health technology development and health services deployment. A reliable model meeting EU adequacy requirements could enhance the transfer of patient and research participant data. While the DPF might present a familiar terrain for US organizations, it also brings unique challenges. A notable concern is the ability of individual EU Member States to establish individual and additional requirements for health data that are more restrictive than GDPR requirements, which are not anticipated by the DPF. This article highlights the DPF's potential impact on the healthcare and research sectors, finding that the DPF may not provide the degree of lawful health data transfer desirable for healthcare entities. We examine the DPF against a background of existing Health Insurance Portability and Accountability Act obligations and other GDPR transfer tools to offer alternatives that can improve the likelihood of reliable, lawful health data transfer between the US and EU.

An Analysis of Nigeria's Legal Framework for Cross-Border Data Transfer: The Afcfta Perspective

An Analysis of Nigeria's Legal Framework for Cross-Border Data Transfer: The Afcfta Perspective

The conflict between China’s restrictions on cross-border data transfer and US discovery of evidence

The conflict between China’s restrictions on cross-border data transfer and US discovery of evidence