Global Experience in Regulating Data Protection, Transfer and Storage

Abstract

Cross-border data flows management and privacy protection are placed high in the international digital agenda due to unprecedented growth in the volume and pace of data collection, processing, storage and transfer globally. Despite the high importance of data flows regulation and its serious influence on all enterprises involved in digital economy, there is little research conducted in Russia and systemizing the national strategies in this sphere of regulation. The article provides an overview of the existing approaches of different countries to data protection, transfer (cross-border included) and storage, analyses the impact of regulation on international trade flows, and develops proposals for possible measures to reduce costs for companies in the digital age. The research discovers that today most countries of the world regulate personal data and other categories of sensitive data flows through the introduction of either a separate law or data protection provisions in the relevant sectoral laws. The countries’ approaches range from a complete ban on the cross-border transfer of all or certain categories of data to foreign countries to complete liberalization in this area. The most common approach is the introduction of one or several restrictions from the set of measures related to cross-border data transfers: data localization requirement; limitations on the number or type of countries to which sensitive data can be transferred without additional requirements; and the requirement of the personal data subject’s consent or responsible public authorities’ permission.