Data Localization Laws and Policy: The EU Data Protection International Transfers Restriction Through a Cloud Computing Lens

Countries are increasingly introducing data localization laws and data export restrictions, threatening digital globalization and inhibiting cloud computing's adoption despite its acknowledged benefits. Through a cloud computing lens, this multi-disciplinary book examines the personal data transfers restriction under the EU Data Protection Directive (including the EUUS Privacy Shield and General Data Protection Regulation). It covers historical objectives and practical problems, showing why the focus should move from physical data location to effective jurisdiction over those controlling access to intelligible data and control of access to data through security measures. The book further discusses data localization laws' failure to solve concerns regarding the topical and contentious issue of mass state surveillance. Its arguments are also relevant to other data localization laws, cross-border transfers of non personal data and transfers not involving cloud computing. Comprehensive yet accessible, this book is of great value to academics in law, policy, computer science and technology. It is also highly relevant to cloud computing/technology organisations and other businesses in the EU and beyond, data privacy professionals, policymakers and regulators.

Table of Contents:
Contents: Foreword by Rosemary Jay Foreword by Christopher Kuner 1. Background 2. Legislative history and objectives 3. The ‘transfer’ concept 4. Assumptions 5. Mechanisms and derogations 6. Compliance and enforcement 7. Access and security 8. Summary and recommendations Index

About the Author :
W. Kuan Hon, Of Counsel, Dentons, UK and an Editor, Encyclopedia of Data Protection and Privacy

Review :
‘Displaying great originality and rigour, this book makes the case that location-based personal data protection should have that “Frankenrule” replaced by regulation based on enforcement of security and encryption standards. With an interdisciplinary focus on law, computer security and industrial organisation (in technological and business value chains of data processing), this approach is to be recommended to legal scholars of the Internet.’ ‘It should be read by every data protection supervisory authority and law-maker in Europe.’ ‘Data localization is not just a short-term phenomenon, but reflects a profound unease with increasing globalization, and a lack of certainty as to whether we want national borders carried over onto the online space. This book helps illuminate the choices that we face as a society in deciding where we want those boundaries to be set.’ ‘This book which is partly a legalistic discussion about terms and concepts is very useful for companies involved in cloud computing, as it explains the challenges in practical terms and with many examples of real cases. The arguments that the author makes are often not only relevant in the cloud computing context, but also apply more generally for cross-border transfers.’