8 - Enabling Transatlantic Trade and Protecting Privacy through Cross-Border Data Transfer Agreements

Summary

The discussion on transatlantic jurisdictional tensions could be constructed as one on enabling, or frustrating, free trade. The General Data Protection Regulation holds that personal data may be transferred only to States with an essentially equivalent level of data protection to that in the EU. This so-called adequacy standard pushes third States to enact EU-style regulation and has thus had extraterritorial effect. As the US has not received an overall adequacy decision, EU to US data transfers are based upon sector-specific agreements or other transfer mechanisms. In 2015, the Court of Justice of the EU invalidated the US–EU Safe Harbour agreement, which had enabled many EU–US data transfers for companies, ruling that it infringed privacy and data protection rights. Since then, both parties have renegotiated multiple data transfer agreements, each time to incorporate stronger EU data protection standards. US companies have realised the need to have privacy and data protection approaches closer to those in Europe to be attractive to the EU market. Ultimately, there is perceptible legal diffusion based on EU values. If the EU has managed this diffusion by requiring certain data transfer arrangements, the wider implications are that global data privacy protections are gradually becoming stronger.