Personal Data Transfers in International Trade and EU law: A Tale of Two ‘Necessities’

Abstract

Cross-border flows of personal data have become essential for international trade. European Union (EU) law restricts transfers of personal data to a degree that is arguably beyond what is permitted under the EU’s World Trade Organization commitments. These restrictions may be justified under trade law’s ‘necessity test.’ The article suggests that they may not pass this test. Yet, from an EU law perspective, the right to the protection of personal data is a fundamental right. An international transfer of personal data constitutes a derogation from this right and, therefore, must be consistent with another necessity test, the ‘strict necessity’ test of the derogation clause of the EU Charter of Fundamental Rights. This article shows how a simultaneous application of the trade law and EU Charter ‘necessities’ to EU restrictions on transfers of personal data creates a catch-22 situation and sketches the ways out of this compliance deadlock.