Personal Data Transfers in International Trade and EU Law

Abstract

Abstract This chapter explains the tension between the governance of personal data transfers by the European Union (EU) and in international trade law. It argues that the restrictions on transfers of personal data outside the European Economic Area (EEA) under the General Data Protection Regulation (GDPR) go beyond what is permitted under the General Agreement on Trade in Services (GATS). This chapter contends that a violation of these commitments cannot be justified under the necessity test of the GATS general exception for privacy and data protection. Yet, in the EU, privacy and data protection are fundamental rights. Transfers of personal data outside the EEA constitute an interference with these rights and must, therefore, be consistent with the necessity test of the EU Charter of Fundamental Rights (EU Charter). This chapter demonstrates how a simultaneous application of two necessity tests creates a catch-22 situation and sketches the ways out of this compliance dead lock.