Cross-border data transfers between the EU and the U.S.: a transatlantic dispute

Abstract

This article deals with the clash between the European and American approach to transborder data flows. In the last decades, the discourse has been that the U.S. offers a market-dominated approach while the EU was embedded in a right-dominated policy. General Data Protection Regulation (GDPR) restricts data transfers outside the EU. An analysis of the meaning of the level of adequate protection of a non-EU country is necessary to transfer data beyond the EU. The Court of Justice of the European Union has invalidated the Privacy Shield agreement to transfer commercial data from the European Union to the United States, leaving transatlantic data transfers in a current predicament. Safe Harbour Principles previously and Privacy Shield recently have been read according to EU data protection law, in particular the General Data Protection Regulation in combination with the European Charter of Fundamental Rights. The landmark Schrems II judgement is assessed to point out current available options to transfer data from the European Union to the United States and also several implications on cross-border data flows beyond the EU-U.S. relationship.