The Future of International Data Transfers: Managing New Legal Risk with a ‘User-Held’ Data Model

Research output: Contribution to journalJournal articlepeer-review

Documents

The General Data Protection Regulation (GDPR) contains a blanket prohibition on the transfer of personal data outside of the European Economic Area (EEA) unless strict requirements are met. The rationale for this provision is to protect personal data and data subject rights by restricting data transfers to countries that may not have the same level of protection as the EEA. However, the ubiquitous and permeable character of new technologies such as cloud computing, and the increased inter-connectivity between societies, has made international data transfers the norm and not the exception. The Schrems II case and subsequent regulatory developments have further raised the bar for companies to comply with complex and, often, opaque rules.
Many firms are, therefore, pursuing technology-based solutions in order to mitigate this new legal risk. These emerging technological alternatives reduce the need for open-ended cross-border transfers and the practical challenges and legal risk that such transfers create post-Schrems. This article examines one such alternative, namely a user-held data model. This approach takes advantage of ‘personal data clouds’ that allows data subjects to store their data locally and in a more decentralised manner, thus decreasing the need for cross-border transfers and offering end-users the possibility of greater control over their data.

Original languageEnglish
Article number105691
JournalComputer Law & Security Review
Volume46
Number of pages25
ISSN0267-3649
DOIs
Publication statusPublished - 2022

Number of downloads are based on statistics from Google Scholar and www.ku.dk


No data available

ID: 289918618