This post describes a newly available resource for studying the effects of data localization within the European Union, a prospect that has become newly relevant in the wake of this year’s decision in Schrems II by the Court of Justice for the European Union (CJEU). In 1998, I co-authored a book entitled, “None of Your Business: World Data Flows, Electronic Commerce, and the European Privacy Directive.”[1] This month the Brookings Institution, for the first time, has made the text of the book available for free download from its website (click “None of Your Business pdf” on the left of the page).
In 1998, the EU’s Data Protection Directive went into effect, and its potential effect on trans-Atlantic data flows had until then been little studied. Much of the book described the major flows of personal data from the EU to the US. For each category of data flow, the book analyzed whether and in what circumstances the flow might remain legal, if no agreement were reached between the EU and US. Where the data flow appeared unlawful, the book described effects of data localization within the EU.
This detailed analysis of possible data localization is newly important now, not only due to the Schrems II case itself, but also the new guidance by the European Data Protection Board (EDPB). As described extensively elsewhere, the CJEU in Schrems II case invalidated the EU/US Privacy Shield, and cast doubt on the continued use of Standard Contractual Clauses (SCCs). The possibility of strict data localization has become greater after the release on November 10 by the European Data Protection Board (EDPB) of two documents. Professor Théodore Christakis, in discussing the “European Essential Guarantees for Surveillance Measures,” concluded that “the preponderance of transfers to third countries do not meet the essential guarantees as set forth by the EDPB.” Where such essential guarantees do not exist, then the EDPB issued its “Recommendations on Supplementary Measures.” These, too, are strict. Professor Christakis concludes, upon careful examination, that the EDPB Guidance seems “to prohibit almost all such transfers when the personal data is readable in the third country.” He adds: “If European data has almost no way of leaving Europe (that is, in a readable format) that means that it needs to remain in Europe. This is called data localization.”
There has been no recent, systematic study of the effects of EU-wide data localization. Working with the Cross-Border Data Forum, I hope to participate in such a study as soon as practicable. With that said, the 1998 book presents the most systematic discussion to date of how localization would affect major categories of data flows. It is true that some types of data flows have emerged since 1998, including the widespread use of cloud computing, where the personal data of individuals is often stored outside of their home country. Nonetheless, many of the data flows discussed in 1998 have a striking overlap with data flows today. I would like to thank the Brookings Institution for making the 1998 book freely available to inform the current discussions about possible data localization.
Outline of Important Trans-Atlantic Data Flows
Moving forward, I hope to work on a study of the effects of data localization on current data flows. Here, we present the outline of categories of data flows from the 1998 book. Since then, some new types of data flows have become important, such as cloud computing. With that said, the topics listed here at a minimum provide a useful list of data flows to consider in studying effects of data localization.
The book applied the following methodology: describe the data flows; explain the apparent legal limits on such flows; and assess possible options for modifying or blocking such flows.
Chapter 5: Privacy Issues Affecting Many Organizations (p. 90-101)
- Human Resources Records
- Auditing and Accounting
- Business Consulting
- Call Centers and Other Worldwide Customer Service
- Article 7 and Article 26 Processing
- Conclusion
Chapter 6: The Financial Services Sector (p. 102-121)
-
- Payment Systems
- Sale of Financial Services to Individuals
- Sale of Financial Services to Businesses
- Reinsurance
- Participations
- Investment Banking
- Market Analysis
- Hostile Takeovers
- Due Diligence
- Private Placements and Other Sales to Europeans
- Other Issues for European Companies Raising Money in the United States
- Mandatory Securities and Accounting Disclosures
- Legal Required Disclosures
- Disclosures Required by Accounting or Stock Exchange Rules
- Disclosures that are Not Strictly Required
- Individual Credit Histories
- Providing Information to Credit Agencies
- Receiving Credit Reports
- Corporate Credit Histories
- Information on Persons in Their Business Capacity
Chapter 7: Other Sectors with Large Transborder Data Flows (p. 122-151)
- The Press
- Effects Generally on Non-Profits
- International Educational Institutions
- International Conferences
- Effects on Non-EU Governments
- Research and Marketing for Pharmaceuticals and Medical Devices
- Business and Leisure Travel
- Reservation Systems
- Frequent Flyer Miles and Other Affinity Programs
- Internet Service Providers
- Retailing and Other Direct Marketing
- Traditional Direct Marketing
- Direct Marketing and Electronic Commerce
- Effects on Europe of Restrictions on Transfers
- Intraorganizational Data Flows
- Data Flows Between Organizations
- Dynamic Effects
- Conclusion
[1] Peter Swire & Robert Litan, “None of Your Business: World Data Flows, Electronic Commerce, and the European Privacy Directive” (Brookings, 1998). The title of the book was intended to have three meanings. “First, the Directive is about privacy, about the fundamental idea that “my” personal information is none of “your” business. … A second meaning of “none of your business” invokes the concern of other countries that the European Union is trying to impose its privacy rules in an extraterritorial fashion. … A third meaning is closely related to the second. Under the global trade regime administered through the World Trade Organization (WTO), laws that appear to prevent free trade in goods and services are carefully scrutinized. Data protection rules such as the Directive can have the effect of excluding companies in the United States and other third countries from the European market.” Swire & Litan, at p. 3-4. The 1998 book should not be confused with the non-profit “None Of Your Business,” which Max Schrems has established to address E.U. data protection issues.
These statements are attributable only to the authors, and their publication here does not necessarily reflect the view of the Cross-Border Data Forum or any participating individuals or organizations.
