Global Experience in Regulating Data Protection, Transfer and Storage

Cross-border data flows management and privacy protection are placed high in the international digital agenda due to unprecedented growth in the volume and pace of data collection, processing, storage and transfer globally. Despite the high importance of data flows regulation and its serious influence on all enterprises involved in digital economy, there is little research conducted in Russia and systemizing the national strategies in this sphere of regulation. The article provides an overview of the existing approaches of different countries to data protection, transfer (cross-border included) and storage, analyses the impact of regulation on international trade flows, and develops proposals for possible measures to reduce costs for companies in the digital age. The research discovers that today most countries of the world regulate personal data and other categories of sensitive data flows through the introduction of either a separate law or data protection provisions in the relevant sectoral laws. The countries’ approaches range from a complete ban on the cross-border transfer of all or certain categories of data to foreign countries to complete liberalization in this area. The most common approach is the introduction of one or several restrictions from the set of measures related to cross-border data transfers: data localization requirement; limitations on the number or type of countries to which sensitive data can be transferred without additional requirements; and the requirement of the personal data subject’s consent or responsible public authorities’ permission.

1. Birukov M. M. Aktual’nye aspekty pravovoy zashchity personal’nykh dannykh v Yevropeyskom soyuze, SSHA i Rossii [Topical Aspects of the Legal Protection of Personal Data in the European Union, the United States and Russia]. Moskovskiy zhurnal mezhdunarodnogo prava [Moscow Journal of International Law], 2015, no. 3, pp. 197-208.

2. Evseeva A. A., Kalutsky I. V., Spevakov A. G. Sravnitel’nyy analiz rossiyskogo i kitayskogo zakonodatel’stva v oblasti obrabotki i zashchity personal’nykh dannykh [Comparative Analysis of Russian and Chinese Legislation in the Area of Processing and Protection of Personal Data]. Izvestiya Yugo-Zapadnogo gosudarstvennogo universiteta [Proceedings of the Southwest State University], 2016, vol. 20, no. 3, pp. 78-84.

3. Emuranova O. A. Sravnitel’nyy analiz pravovogo regulirovaniya zashchity personal’nykh dannykh grazhdan Rossii i stran BRIKS [Comparative Analysis of Legal Regulation of Personal Data Protection of the Citizens in Russia and BRICS Countries]. In: V mire nauki i innovatsiy: sb. stat. st. Mezhdunar. nauch.-prakt. konf. (25 dekabrya 2016 goda, Perm) [In the World of Science and Innovations: Collection of Articles of the International Workshop and Conference, 25 December 2016, Perm], in 8 vols., vol. 8. Ufa, Aeterna, 2016, pp. 159-164.

4. Zhuravlev M. S. Zashchita personal’nykh dannykh v telemeditsine [Personal Data Protection in Telemedicine]. Pravo. Zhurnal VShE [Law. HSE Journal], 2016, no. 3, pp. 72-84.

5. Lopatkina N. V., Muslov B. V. Pravovoe regulirovanie vrachebnoy tayny i zashchity personal’nykh dannykh kak faktor obespecheniya bezopasnosti lichnosti, obshchestva, gosudarstva [Legal Regulation of Medical Confidentiality and Personal Data Protection as a Factor of Safety of the Individual, Society and State]. Pravo. Bezopasnost’. Chrezvychaynye situatsii [Law. Safety. Emergency Situations], 2015, no. 2(27), pp. 17-23.

6. Proskuryakova M. I. Konstitutsionno-pravovye ramki zashchity personal’nykh dannykh v Rossii [Constitutional Framework for the Protection of Personal Data in Russia]. Vestnik Sankt-Peterburgskogo universiteta [Vestnik of Saint Petersburg University], 2016, no. 2, pp. 12-27.

7. Binns R., Lyngs U., Van Kleek M., Zhao J., Libert T., Shadbolt N. Third Party Tracking in the Mobile Ecosystem. In: Proceedings of the 10th ACM Conference on Web Science. Amsterdam, 2018, May 27-30, pp. 23-31.

8. Determann L. Privacy and Data Protection. Moscow Journal of International Law, 2019, no. 1, pp. 18-26.

9. Durou E. Big Data. Mining a National Resource. A Middle East Point of View, 2015, Fall, pp. 22-29. https://www2.deloitte.com/content/dam/Deloitte/xe/Documents/About-Deloitte/mepovdocuments/mepov18/mepov18_fall-2015.pdf.

10. Ferracane M. F., Marel E. van der. Do Data Policy Restrictions Inhibit Trade in Services? The European Centre for International Political Economy, Digital Trade Estimates Working Paper, 2018. https://ecipe.org/publications/do-data-policy-restrictions-inhibit-trade-inservices/.