The transfer of personal data to third countries under the GDPR: when does a recipient country provide an adequate level of protection?

Extract

...

Introduction

As we progress into an electronic age, new risks are posed for the right of privacy of the individual. This development is picking up speed as the internet makes transborder trade relationships possible not only for large enterprises, but also for small companies, as well as for individual consumers. A particular risk for the right to privacy is imposed by cross-border data flows from one jurisdiction to another if the recipient country ensures only a lower level of protection of personal data than the sender country so that the sent information loses part of its protection through the transfer.¹ In particular, a transnational data export of this kind makes it easier for private actors to process the personal data for other than the originally intended purposes. Such exports can also make it possible for foreign state agencies to access and process the data.²

The importance of transborder data flows has been recognized for more than 40 years. In 1973, Sweden was the first country to regulate data exports to third countries by making such exports subject to approval by the competent Swedish authority.³ Austria followed suit in 1978 by making the export of personal data to other countries subject to the condition that they guarantee a level of data protection equivalent to that in Austria.⁴ In 1980, the OECD adopted the first international regulation dealing with transborder data flow, which aimed to set a minimum standard of privacy protection with the objective of facilitating transborder data flows and eliminating the different levels of data protection between the countries.⁵