When data travels: The Commission’s objective of making EU data protection travel across the Atlantics

Summary:

EU's new General Data Protection Regulation (GDPR) will be formally passed and published in April/May 2016 and enter into force two years after in 2018. On the other side of the Atlantic, the US remains less stringent on data protection and has only recently passed the Cyber-Security Information Sharing Act (CISA), which makes data transfers between companies and the US government even easier. Therefore, there seems to be a certain level of divergence between the approach to data protection in the EU and US.

This paper investigates the current legal framework on data that travels through the various transatlantic submarine cables and in how far the EU Commission has achieved its goal of obtaining guarantees that US government agencies and companies adequately protect EU citizens’ personal data.