The GDPR as Global Data Protection Regulation?

Abstract

The deterritorialization of the Internet and international communications technology has given rise to acute jurisdictional questions regarding who may regulate online activities. In the absence of a global regulator, states act unilaterally, applying their own laws to transborder activities. The EU's “extraterritorial” application of its data protection legislation—initially the Data Protection Directive (DPD) and, since 2018, the General Data Protection Regulation (GDPR)—is a case in point. The GDPR applies to “the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services . . . to such data subjects in the Union; or (b) the monitoring of their behaviour . . . within the Union.” It also conditions data transfers outside the EU on third states having adequate (meaning essentially equivalent) data protection standards. This essay outlines forms of extraterritoriality evident in EU data protection law, which could be legitimized by certain fundamental rights obligations. It then looks at how the EU balances data protection with third states’ countervailing interests. This approach can involve burdens not only for third states or corporations, but also for the EU political branches themselves. EU law viewed through the lens of public international law shows how local regulation is going global, despite its goal of protecting only EU data subjects.

Why and how does the regulation of emerging technologies occur? Explaining the adoption of the EU General Data Protection Regulation using the multiple streams framework

“…The DPD set out the circumstances and principles under which personal data can be lawfully processed and transferred; recognized the rights of individuals in accessing, controlling, and obtaining information about their data; and called on member states to monitor the application of the Directive within their territories through independent, public data protection authorities. The paradigm for regulating personal data spread to over 30 countries and influenced data protection globally (Ryngaert & Taylor 2020). However, balancing the dual objectives of protecting the right to privacy and establishing an internal digital market proved challenging, especially with constant social and technological change (Robinson et al 2009;Lynskey 2013).…”

“…As a case of technology regulation despite significant lobbying and opposition, the GDPR presents an opportunity to examine the interaction among forces that affect the regulatory process. Further, the regulation has high policy significance as it is likely to have a long‐term effect on the regulation of personal data not only in the EU but around the world (Ryngaert & Taylor 2020).…”

Those who control the code control the rules: How different perspectives of privacy are being written into the code of blockchain systems

“…First, defining and measuring privacy is not straightforward. There are many contrasting definitions, and each lend themselves to competing measurement proxies (Belanger and Crossler, 2011; Finn et al, 2013; Moore, 2008; Pavlou, 2011; Ryngaert and Taylor, 2020; Smith et al, 2011; Van Den Hoven, 2008). Second, many individuals are willing to concede privacy as part of an economic exchange for products and services (Acquisti et al, 2016; Awad and Krishnan, 2006; Posner, 1981; Sutanto et al, 2013).…”

Two Years After: A Scoping Review of GDPR Effects on Serious Games Research Ethics Reporting

“…Norway). The far-reaching scope of the regulation may be attributed to the principle of territoriality, which effectively protects every EU citizen with the GDPR even if the data processing party is non-EU related [34]. Thus, researchers from other countries must comply with GDPR if European participants are included in the study.…”