Cross-border Data Transfer After Schrems II: The Globalization of EU Standards of Data Protection Through Adequacy Decisions or Trade Agreements?

Abstract: The Schrems II judgement delivered on 16 July of 2020 was the second time that an EU court invalidated an adequacy decision authorizing EU-US data transfer. Doubts gather around the suitability of adequacy decision being an instrument to govern cross-border data transfer. This thesis therefore wishes to explore the deficiencies of such an instrument posed by the current regime as established in the GDPR—which is to find adequacy. This thesis finds that the requirement of finding adequacy, as stipulated by the GDPR and case law in light of the Charter, is a unilateral finding and may face the hard truth that there simply could not be such a finding in the US. Under the current US legal system, the disparity between the EU’s approach to protection of personal data and that of the US remain fundamentally great. What’s more, the national security grounds on which access to personal data by public authorities is authorized under US law, pose unacceptable interference to the fundamental rights of privacy and data protection of the EU data subjects, which would not be allowed under EU law. Besides finding the legal requirements of adequacy finding from the GDPR and case law, this thesis also examines the adequacy decision regarding data transfer to Japan. Although that adequacy decision generally fulfils the legal requirements, there exist flaws and possible objections to such an adequacy finding in Japan. The Commission’s approach to adequacy decision therefore seems to regard it as a tool for facilitating trade and risks making it merely a “formality”. This thesis also tries to evaluate the possibility of using trade agreements to govern cross-border data. The advantages of trade agreement compared with adequacy decision as an instrument to govern cross-border data transfer are explained but also the shortcomings and difficulties of it are exposed. Adequacy decision is beneficial to the global promotion of EU standards of data protection, to which the adequacy decision regarding data transfer to Japan is an example. However, with no international consensus, this thesis acknowledges the difficulty of ensuring the level of protection after personal data crosses borders and balancing fundamental rights with the interest of trade in a global trade context. Still, this thesis submits that the insistence on the use of adequacy decision as an instrument to govern cross-border data transfer should uphold the level of protection guaranteed by EU law.