A Battle of the Big Three?—Competing Conceptualizations of Personal Data Shaping Transnational Data Flows

In the unfolding digital era, personal data has increasingly been conceptualized in a hybrid way, primarily drawing on notions of economics, privacy, and national security. Such a sui generis nature makes personal data something of its own category, opening the door to different conceptualizations by different actors. This article identifies three primary conceptualizations of personal data adopted by three major powers (the US, the EU, and China) with respect to cross-border data transfers—namely, a factor of production, an embodiment of fundamental rights, and an element of national security. Highlighting different attributes of personal data, these conceptualizations differ in what they understand personal data to be, how they address the relationship between individuals, their data, and the governments, as well as what they frame as the most important normative goals for regulatory interventions. Moreover, these conceptualizations are embedded in different philosophies and ideologies, ranging from neo-liberalism to human rights and to sovereignty. These irreducible normative elements render the contestations among such conceptualizations unable to be easily resolved. Further, divergent conceptualizations of personal data mandate and justify different legal paradigms to institutionalize their basic logics and policy choices. Built on different primary conceptualizations of personal data, three major legal paradigms compete to regulate cross-border personal data flows: a trade paradigm, a privacy paradigm, and a security paradigm. Aligned with its major conceptual framing of personal data, a great power often embraces a particular paradigm as its dominant approach to regulate cross-border transfers of personal data. These paradigms strive to provide legal and regulatory solutions (including legal prescriptions, regulatory institutions, and enforcement tools) to address the salient problems identified and framed by different conceptualizations of personal data.