Cross-border Data Transfer Research Articles

Nuevo marco jurídico en materia de protección de datos de carácter personal en la Unión Europea

Este trabajo versa sobre el impacto producido por la nueva legislacion europea en materia de proteccion de datos. Se abordaran algunas de las principales novedades que trae consigo el nuevo Reglamento Europeo de Proteccion de Datos, (conocido tambien como Reglamento General de Proteccion de datos o RGPD) como la nueva figura del Data Protection Officer, los nuevos derechos y obligaciones promulgados, en especial, el derecho al olvido, el regimen sancionador y el futuro nuevo marco juridico de la transmision internacional de datos a terceros paises, asi como algunas menciones a la Directiva de proteccion de datos en materia penal y otra legislacion relevante.

Cross border data transfer: Complexity of adequate protection and its exceptions

The majority of the fear that exists about the cloud arises due to the lack of transparency in the cloud. Fears have persisted in relation to how the data are frequently transferred in a cloud for various purposes which includes storing and processing. This is because the level of protection differs between countries and cloud users who belong to countries which provide a high level of protection will be less in favour of transfers that reduce the protection that was originally accorded to their data. Hence, to avoid client dissatisfaction, the Data Protection Directive has stated that such transfers are generally prohibited unless the country that data is being transferred to is able to provide ‘appropriate safeguards’. This article will discuss the position of the Data Protection Directive and how the new General Data Protection Regulation differs from this Directive. This involves the discussion of the similarity as well as the differences of the Directive and Regulation. In summary, it appears that the major principles of the cross border transfer are retained in the new regulation. Furthermore, the article discusses the exceptions that are provided in the standard contractual clause and the reason behind the transition from Safe Harbor to the new US-EU Privacy Shield. This article subsequently embarks on the concept of Binding Corporate Rule which was introduced by the working party and how the new regulation has viewed this internal rule in terms of assisting cross border data transfer. All the issues that will be discussed in this article are relevant in the understanding of cross border data transfer.

Cross-border issues under EU data protection law with regards to personal data protection

ABSTRACTWe are living in an inter-connected, global digital society where the services of different operating systems are universal in nature, but many Internet activities are still being tackled by national laws and regulations. A long-existing question is which law is applicable in cases of Internet activities because the online world does not have any physical boundaries. How the European Union (EU) approaches this duality has become a concern for data protection laws. By analysing some recent Court of Justice of the European Union case laws, this article seeks to discover how the EU data protection law tackles disputes involving transnational issues online, which includes its extra-territorial application and cross-border data transfers. The article also indicates that there is an enormous gap between legislation and practice.

Crisis of Privacy and Sacrifice of Personal Data in the Name of National Security: The CJEU Rulings Strengthening EU Data Protection Standards

Snowden’s surveillance revelations in 2013 raised the issue of privacy and security in the public spotlight. These revelations underlined the need for strong data protection framework. At the same time, the pressing demand to address security concerns and the threat of terrorist attacks might weaken privacy and data protection standards. Two landmark judgments of the Court of Justice of the European Union (the CJEU), namely, the Digital rights Ireland judgment which invalidates Data Retention Directive, and the Schrems judgment which invalidates Safe Harbour Decision forming a legal basis for transatlantic data transfers are of great significance in strengthening the rights to privacy and data protection in the context of digital mass surveillance. They will have far-reaching implications on EU and national data retention mechanisms, as well on cross-border data transfer framework. Through the lens of the CJEU the paper seeks to reveal the key challenges data protection law faces both at national and EU level that have to be overcome in response to mass surveillance in order to maintain a proper balance between privacy and national security.

Cross-Border Data Transfers after the Cjeu's Safe Harbour Decision

Cross-Border Data Transfers after the Cjeu's Safe Harbour Decision

Safe Harbour Agreements and Cross-Border Data Transfer

Safe Harbour Agreements and Cross-Border Data Transfer

The Portuguese regulatory regime for Binding Corporate Rules

Given the vast number of requests for authorisations for the transfer of personal data to countries outside of the EU and the growing complexity of how companies and corporate groups choose to structure their international activities, it should hardly have come as a surprise when, in 2003, the Article 29 Data Protection Working Party recommended that the approaches afforded by the standard contractual clauses and Safe Harbor Principles should be complemented by Binding Corporate Rules. Citing a growing demand on the part of multinational companies, which due to their complex architectural structures worldwide would like to benefit from the possibility to adopt ‘codes of conduct for international transfers’ (WP 74, p. 5), the Working Party analysed the possibility of authorizing cross-border data transfers under a BCR system and came to the conclusion that it would be a useful additional alternative to the already existing methods of conducting international transfers. While the Working Party endorsed BCRs in this manner, however, the actual decision of whether to accept BCRs was left to the individual data protection authorities of each member state. Portuguese Law 67/98, of 26 October 1998, on the Protection of Personal Data (the Data Protection Law) implements the EU Data Protection Directive 95/46/ EC. Article 20(2) of the Data Protection Law, which is analogous to Article 26(2) of the Directive, expressly empowers the national data protection authority (the CNPD) to authorize transfers of personal data to a State which does not ensure an adequate level of protection as long as ‘the controller adduces adequate safeguards with respect to the protection of the privacy

Cross Border Data Transfer in E-Discoveries in the U.S. and the European and German Privacy Laws

Abstract European Companies involved in U.S. litigation proceedings are often subject to disclosure requests by the opponent party. In such case they are forced to disclose personal data which are protected by European privacy laws. As European privacy laws do not contain any explicit regulations, this article gives practical guidance how to comply with disclosure requests on the one hand and with the national privacy laws on the other hand.

Data Protection and Transborder Data Flow in the European and Global Context

Very similar to trade barriers, data protection has been an obstacle to free global data flow. The European legal system on cross-border data flow set up by Directive 95/46/EC prohibits transfer of personal data to third countries which do not have an adequate data protection level. With enormous international implications, such a regionally oriented system is heavily dependent on effective monitoring of cross-border data transfer. Due to a lack of proper supervision on data transfer, it encounters many challenges, which forces the European Commission to adopt the contractual model and the corporate law model. Meanwhile, compared with issues like free trade and environmental protection, not much international consensus has been reached on cross-border data protection. As a result, bilateral, regional, and multilateral collaborations between national sovereignties are to be strengthened, to facilitate transborder data flow and to safeguard individuals� right to data protection.

A Synopsis of Proposed Data Protection Legislation in SA

Privacy International1 made the following statement regarding South Africa’s financial sector in its 2005 world survey: “South Africa has a well-developed financial system and banking infrastructure. Despite the sophistication of the financial sector, the privacy of financial information is weakly regulated by a code of conduct for banks issued by the Banking Council.” This extract highlights some of the problems South Africa are experiencing with its current status on privacy as viewed from an International perspective. In recent years the International society has stepped up its efforts in creating a global village wherein the individual could be assured of having his/her privacy protected. Various conventions and guidelines2 have previously laid the foundation for privacy but it was not until the European Union’s (EU) launch of its Directive on Data Protection in 1995 that we have seen a real coerced shift in the focus of such protection. Cross border data transfers from the EU became something of the past unless third countries (those countries outside the EU) could prove the existence of adequate data protection provisions. It seemed to a big extend that international trade would be hampered and some of its biggest trading partners, such as the US, suddenly felt the impact due to its lagging protection measures. In order to curtail such inadequacies, a Safe Harbor Agreement was entered into between the EU and US whereby cross border data flow would be allowed under certain prerequisites. This Agreement however, does not cover Financial Institutions.

An Electronic Infrastructure for Research and Treatment of the Thalassemias and Other Hemoglobinopathies: The Euro-Mediterranean Ithanet Project

Hemoglobin (Hb) disorders are common, potentially lethal monogenic diseases, posing a global health challenge. With worldwide migration and intermixing of carriers, demanding flexible health planning and patient care, hemoglobinopathies may serve as a paradigm for the use of electronic infrastructure tools in the collection of data, the dissemination of knowledge, the harmonization of treatment, and the coordination of research and preventive programs. ITHANET, a network covering thalassemias and other hemoglobinopathies, comprises 26 organizations from 16 countries, including non-European countries of origin for these diseases (Egypt, Israel, Lebanon, Tunisia and Turkey). Using electronic infrastructure tools, ITHANET aims to strengthen cross-border communication and data transfer, cooperative research and treatment of thalassemia, and to improve support and information of those affected by hemoglobinopathies. Moreover, the consortium has established the ITHANET Portal, a novel web-based instrument for the dissemination of information on hemoglobinopathies to researchers, clinicians and patients. The ITHANET Portal is a growing public resource, providing forums for discussion and research coordination, and giving access to courses and databases organized by ITHANET partners. Already a popular repository for diagnostic protocols and news related to hemoglobinopathies, the ITHANET Portal also provides a searchable, extendable database of thalassemia mutations and associated background information. The experience of ITHANET is exemplary for a consortium bringing together disparate organizations from heterogeneous partner countries to face a common health challenge. The ITHANET Portal as a web-based tool born out of this experience amends some of the problems encountered and facilitates education and international exchange of data and expertise for hemoglobinopathies.

Five years of the APEC Privacy Framework: Failure or promise?

The APEC Privacy Framework was developed from 2003, adopted by APEC in 2004 and finalised in 2005. It was intended as a means of improving the standard of information privacy protection throughout the APEC countries of the Asia–Pacific, and of facilitating the trans-border flow of personal information between those countries. In 2007 a number of ‘Pathfinder’ projects for cross-border data transfers were launched under the Framework. In the five years since the process commenced, what has it achieved, and what is it likely to achieve? This paper argues that the APEC Privacy Framework has had many flaws from its inception, including Privacy Principles that are unnecessarily weak, and no meaningful enforcement requirements. Since its adoption in 2004, little attempt has been made to encourage its use as a minimal standard for privacy legislation in developing countries (which might have been useful), and it is having little impact on the significant number of legislative developments now taking place. Instead, the ‘Pathfinder’ projects seem to be developing toward a generalised version of the US ‘Safe Harbor’ scheme. What is known of the Pathfinder projects leaves many questions unanswered, such as what standards for data transfers they aim to implement; whether compliance with all of APEC's own Privacy Principles will be required; and how ‘Accountability Agents’ will be accredited. Consumer input into APEC's privacy processes has been belated and ad-hoc but business influences omnipresent. Despite these flaws, APEC could still play a useful role in the gradual development of higher privacy standards in Asia, provided its priorities are re-oriented. The major developments in Asian privacy protection are likely to come from elsewhere, including other regional groupings, and attractions of standards originating in Europe. The paper concludes with suggestions for other directions.

Barriers to International Data Transfer

Free flow of information is one of the corner stones of free trade and economic growth. Communication networks now connect millions of commercial organizations throughout the world. Ostensibly, the networks could contribute immensely to the welfare of businesses, but there still exist many legal barriers that prevent genuinely free flow of data and information across borders. Strict laws in European countries forbid U.S. businesses to tap private data. This prevents free flow of information within multinational corporations and hinders marketing efforts of organizations that wish to target their products and services to selective consumers in foreign countries. The article reviews cross-border data transfer laws of different countries and the international effort to harmonize legislation.