Growing Global Data Transfer Rules, Policies Risk Isolation, Attorney Warns
Personal data transfer policies and regulatory developments risk chipping away at some elements that have made international data flows part of everyday reality, Hogan Lovells privacy lawyer Eduardo Ustaran posted.
Sign up for a free preview to unlock the rest of this article
Foreign policies are toughening, but last year's White House executive order restricting bulk transfers of Americans' sensitive personal data to countries considered national security risks, such as China, North Korea and Russia, "was a striking change of direction," Ustaran wrote Monday. While not a blanket prohibition, it's severe, he added.
If predictions about the incoming administration's position on data, based on President-elect Donald Trump's current narrative about the promotion of domestic interests and limiting data-sharing to boost national security, prove correct, "data flows from the U.S." will not "get any easier," Ustaran wrote.
Meanwhile, in China, the Personal Information Protection Law seeks legal limits on transferring personal data that mirror the EU approach but is more bureaucratic.
"There is clearly something of a trend" that's spreading to countries with very different legal traditions and systems of government but that share a similar perspective about data, Ustaran wrote. Governments see data as an asset. Increasingly they approach data sovereignty as a policy priority.
Another worrisome trend is Europe's regulatory approach, Ustaran argued. The interpretation of the European Court of Justice decision in Schrems II -- which attempted to balance protection of personal data beyond Europe while calling out excessive powers of some U.S. government agencies to access that information -- "has led to an absolutist approach to data protection, which is only satisfied if the potential for government access to data is nil." If taken to the extreme, this would lead to the conclusion that no matter what protections might be seen as proportional to the risk, "all transfers anywhere are unlawful."
In this uncertain world, "the solution to uncertainty cannot be isolation." Protecting personal data across borders "is essentially about combining responsibility for effective and realistic safeguards that address real risks, rather than theoretical ones, with tolerance for other approaches and standards."
Global privacy regulators said they intend to focus this year on stronger international enforcement cooperation and data free-flow with trust, among other things (see 2411060005).