Is Data Localization a Solution for Schrems II?

Abstract

ABSTRACT For the second time this decade, the Court of Justice of the European Union has struck a blow against the principal mechanisms for personal data transfer to the USA. In Data Protection Commissioner v Facebook Ireland, Maximillian Schrems, the Court declared the European Union-US Privacy Shield invalid and placed significant hurdles to the process of transferring personal data from the European Union to the USA via the mechanism of Standard Contractual Clauses. Many have begun to suggest data localization as the solution to the problem of data transfer; that is, do not transfer the data at all. I argue that data localization neither solves the problem of foreign surveillance, nor enhances personal privacy, while undermining other values embraced by the European Union.