Global Experience in Regulating Data Protection, Transfer and Storage

The rapid expansion of the digital economy and the exponential growth of data transmitted across national borders have made the harmonisation of personal data protection regimes a central issue in contemporary international law. Using comparative legal analysis, this article examines international, regional, and national legal instruments governing cross-border transfers of personal data. These include the Organisation for Economic Co-operation and Development Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, as modernised, the European Union General Data Protection Regulation and its recent adequacy decision concerning the United States, the Asia-Pacific Economic Cooperation and Global Cross-Border Privacy Rules systems, the Organisation for Economic Co-operation and Development Declaration on Government Access to Personal Data, United States national security regulations adopted under Executive Order No. 14117, China’s simplified 2024 rules on cross-border data transfers, Brazil’s 2024 regulation on international data transfers, and Russia’s 2025 amendments on data localisation. The article evaluates trust-building mechanisms, including standard contractual clauses, binding corporate rules, certification mechanisms, and privacy-enhancing technologies, and assesses the Group of Twenty initiative on Data Free Flow with Trust and related trade policy recommendations aimed at reducing regulatory fragmentation. The study concludes that, in the absence of a universal international treaty, mutual recognition of safeguards and the widespread use of privacy-by-design technologies are essential to balancing the protection of human rights with the promotion of innovation.

EU-UK Data Flows, Brexit and No-Deal: Adequacy or Disarray?

ABSTRACT: As cloud computing continues to play a pivotal role in data storage and processing, ensuring the security and integrity of transferred data remains a critical concern. This project introduces a novel approach for secure data transfer and detection leveraging the Counting Bloom Filter in cloud computing environments. The proposed system addresses the vulnerabilities associated with traditional data transfer methods by incorporating the Counting Bloom Filter, a probabilistic data structure. This technology aids in optimizing storage efficiency and enhances the accuracy of data detection, crucial for maintaining data integrity during transmission. The project focuses on these cure transfer of sensitive information within cloud computing environments, providing an added layer of protection against unauthorized access and potential data corruption. The Counting Bloom Filter is employed to detect anomalies and ensure the integrity of the transferred data, contributing to a robust and reliable cloud-based data transfer mechanism. Key objectives of the project include the implementation of advanced encryption techniques for secure data transfer, the integration of the Counting Bloom Filter for efficient data detection, and the development of a comprehensive system ensuring data integrity in the cloud. The project's innovation lies in its ability to enhance the security and reliability of data transfer in cloud computing, addressing the evolving challenges associated with data protection and privacy. In conclusion, the Secure Data Transfer and Detection from Counting Bloom Filter in Cloud Computing project represents a significant advancement in the realm of secure data transmission. By combining encryption methods with the unique capabilities of the Counting Bloom Filter, the project offers an effective solution for securing data during transfer, ensuring the integrity of information in cloud computing environments. Keywords:- Cloud computing, Data storage, Data processing, Data transfer, Security, Integrity, Counting Bloom Filter, Probabilistic, data structure, Storage efficiency, Data detection, Sensitive information, Encryption techniques, Unauthorized access, Data corruption, Anomaly detection, Data protection, Privacy, Secure data transfer, Cloud-based data transfer, System development, Data transmission.

In the context of the rapid expansion of the digital economy, digital services trade has become a key driver of global trade growth. At the same time, an increasing number of countries have introduced regulatory restrictions on cross-border data flows, motivated by concerns related to national security, data sovereignty, and personal data protection. While such measures serve legitimate public interests, they may also impose legal and economic constraints on cross-border digital services trade.Focusing on member states of the Regional Comprehensive Economic Partnership (RCEP), this paper empirically examines the regulatory effects of cross-border data flow restrictions on digital services exports using panel data from 2014 to 2022. The results indicate that, overall, stricter data flow restrictions are associated with a significant reduction in digital services exports. The negative impact is more pronounced in developing economies and in jurisdictions that adopt data localization–oriented regulatory frameworks. Further analysis shows that improved digital infrastructure and participation in trade agreements can partially mitigate the trade-restrictive effects of data flow regulations. Heterogeneity analysis reveals that the impact of data flow restrictions varies according to regulatory design and levels of economic development.The findings remain robust across a series of robustness checks. From a legal and regulatory perspective, the results highlight the importance of adopting differentiated and proportionate approaches to cross-border data governance. Enhancing regulatory cooperation and aligning data flow rules within trade agreements such as RCEP may help reconcile data protection objectives with the facilitation of digital services trade.

Reeta Sony A.L - National Law University, New Delhi, India. E-mail:reeta.sony@nludelhi.ac.in.Sri Krishna Deva Rao - Professor, National Law University, New Delhi, India. E-mail: psrikrishnadevarao@gmail.com.Bhukya Devi Prasad - Council of Scientific and Industrial Research, New Delhi, India. E-mail: bdeviprasad@csir.res.in. Cloud computing refers to anything that involves delivering hosted services over the Internet. It is fast, cheap, flexible and elastic in nature. In spite of its benefits, cloud computing raises risks for data protection and privacy. One key issue presented by cloud computing is the fact that it changes our thinking of what we consider to be "our data" Data is no longer physically stored on a specific set of computers or servers, but is rather geographically distributed. The globalised nature of cloud computing poses a challenge for personal data protection, which requires a clear location for personal data, an identification of the processor and a responsible individual for data processing. Cloud data can be misused and/or shared with third parties without prior knowledge or consent of the data owner. The direct participation of an individual in transborder data transfer, third party participation in data storage, the processing and transmission of dataand, finally, negligence of data protection due diligence from cloud service providers, makes data protection and privacy laws more relevant. The recent PRISM surveillance programme scandal at the US National Security Agency (NSA) demonstrated the privacy risks that citizens around the world take on when their personal informa­tion is stored and processed in the cloud. This situation requires awell-established techno-legal solution along international standards. India, unlike the European Union, has no dedicated regulatory framework to deal with privacy and personal data protection. Although cloud computing is still in its initial stages in India, existing laws for people who are currently using facilities offeredby cloud service providers are extremely inadequate. However, cloud computing requires legal protection in India under the country's data protection laws, privacy laws and data breach laws, which must meet "international standards'! It is the right time for the Indian government to enact appropriate regulatory frameworks to protect personal data and privacy in the cloud era. The overall objective of this paper is to understand the impact of cloud computing on privacy and personal data protection and to analyse present legal frameworks governing privacy and personal data protection in India and Europe.

Extract Data protection and privacy have increasingly become matters of global interest. This is reflected in the growth of data protection legislation around the world and the globalisation of data processing. These factors have led to concern about how privacy and data protection rights can be protected across national borders; interest in ways to avoid conflicts between the data protection laws of different jurisdictions; and examination of the tension between allowing data flows and protecting privacy on a global scale. The present book by Kinfe Yilma addresses these issues in a scholarly yet original way. The author first examines the history and structure of international legal regimes for privacy protection under both international human rights law and data protection law. He then focuses on three initiatives designed to strengthen the rights to privacy and data protection in public international law, namely Internet bills of right, ongoing discussions at the United Nations (UN), and transnational data protection standards. The author finally argues that challenges to the global protection of privacy can best be dealt with through the use of “soft law”.

Case study describing the pillars, personnel, and process of developing the TARDIS:REFLUX smartphone app

The exponential intensification in cross-border data flows has augmented privacy and security concerns globally, principally in the Global South. Disparate data regulations betwixt different jurisdictions engender complex compliance challenges for governments and companies embroiled in international data collection, processing and transfers. This research examines the feasibility and imperative of a United Nations (UN) backed framework for omniverse data governance to be referred as undpa—United Nations Data Privacy Authority—one that acts as an overseer and accountability mechanism to monitor data systems universally. Such an agency could facilitate cooperation in adapting data privacy laws to rapid technological vicissitudes, whilst also promoting secure and ethical cross-border data exchange. However, achieving consensus on a global regulatory structure faces impediments, given conflicting priorities and legal regimes across countries. Meanwhile, the paucity of robust data protection laws in manifold Global South nations contrasts with stricter regimes in Europe and North America. The power asymmetry around data governance enables violations of southern digital rights. Absent robust data regulations, the personal information of individuals in developing countries exists in a state of ‘virtual terra nullius’—an unclaimed frontier vulnerable to unauthorised extraction and exploitation. This legal ambiguity has catalysed breaches by states and corporate actors, with recent examples targeting databases across the Global South alongside firms like Equifax. Asserting public ownership over citizen data is key to addressing this inequity. Binding legal frameworks must enshrine southern data sovereignty and prevent breaches that violate privacy. Ergo, this research advocates substantive reforms to establish binding global regulatory standards for data protection and governance under the UN. Learning from entities like wipo, cisg such a framework would curb unlawful data weaponisation and violations of digital rights across borders. It would also foster secure and ethical digital ecosystems that protect individual liberties universally—upholding principles of data justice for historically marginalised communities. Constructive North-South cooperation alongside multilateral action is indispensable to realising this vision.

Protecting digital identity in the cloud: Regulating cross border data disclosure

The new development trends including Internet of Things (IoT), smart city, enterprises digital transformation and world's digital economy are at the top of the tide. The continuous growth of data storage pressure drives the rapid development of the entire storage market on account of massive data generated. By providing data storage and management, cloud storage system becomes an indispensable part of the new era. Currently, the governments, enterprises and individual users are actively migrating their data to the cloud. Such a huge amount of data can create magnanimous wealth. However, this increases the possible risk, for instance, unauthorized access, data leakage, sensitive information disclosure and privacy disclosure. Although there are some studies on data security and privacy protection, there is still a lack of systematic surveys on the subject in cloud storage system. In this paper, we make a comprehensive review of the literatures on data security and privacy issues, data encryption technology, and applicable countermeasures in cloud storage system. Specifically, we first make an overview of cloud storage, including definition, classification, architecture and applications. Secondly, we give a detailed analysis on challenges and requirements of data security and privacy protection in cloud storage system. Thirdly, data encryption technologies and protection methods are summarized. Finally, we discuss several open research topics of data security for cloud storage.

In the ever-evolving tapestry of the digital age, the seamless flow of information across borders has become the lifeblood of global commerce and communication. At the heart of this digital symphony lies cyberspace; an expansive, borderless realm where traditional concepts of jurisdiction and territoriality are constantly being redefined. As we navigate this brave new world, the complexities of international data transfers emerge as a critical area of concern, demanding our attention and innovative thinking. The digital age has ushered in an era where data is often likened to the new oil, fueling the engines of the global economy. From multinational corporations orchestrating complex supply chains to individuals engaging in cross-border e-commerce, the ability to transfer data across international boundaries is indispensable. It is estimated that by 2025, the global data sphere will grow to 175 zettabytes, with a significant portion of this data crossing international borders. Yet, with this exponential growth comes a web of legal complexities, as data often traverses multiple jurisdictions, each with its own regulatory tapestry. Historically, jurisdiction has been a function of geography, with clear-cut boundaries delineating the reach of legal authority. However, in the digital realm, where information can be transmitted instantaneously across continents, these boundaries blur, posing significant challenges for legal frameworks that were designed for a pre-digital era. The inherent fluidity in data storage and transfer underscores the need to rethink how jurisdiction is determined and exercised in the digital age. As we delve deeper into the complexities of cyberspace, we will explore the historical context and traditional concepts of jurisdiction and territoriality, examine case studies and legal precedents, and analyze the challenges in determining applicable law for data transfers. We will also address the tautological issues that arise in international data transfers and propose both theoretical and practical solutions. Finally, we will discuss the role of sovereignty and the rule of law in data transfers, and offer recommendations for harmonizing international data protection laws to create a unified framework that balances data privacy with global data flows. In this brave new world of digital interconnectedness, the stakes are high, and the need for innovative legal solutions is paramount. Let us embark on this journey together, navigating the complexities of international data transfers and striving to create a more secure and compliant digital future.

Cross-border data is crucial for the digital economy s growth, but uncontrolled transfers risk national security, public interests, corporate interests, and data sovereignty. Currently, cross-border data regulation lacks unified global rules, with existing ones dominated by Europe and the U.S. China needs to improve its international legal protection for cross-border personal information transfer. This paper examines China s mechanisms for personal data privacy protection in digital trade, including frameworks for big data, cloud computing, and cloud service selection for data lifecycle privacy protection. It suggests clarifying data controllers and exporters obligations, strengthening regulatory responsibilities, improving cross-border data legislation, enhancing law operability, and advocating for stronger international cooperation and participation in global rule-making to protect personal privacy information rights.

This chapter explains the tension between the governance of personal data transfers by the European Union (EU) and in international trade law. It argues that the restrictions on transfers of personal data outside the European Economic Area (EEA) under the General Data Protection Regulation (GDPR) go beyond what is permitted under the General Agreement on Trade in Services (GATS). This chapter contends that a violation of these commitments cannot be justified under the necessity test of the GATS general exception for privacy and data protection. Yet, in the EU, privacy and data protection are fundamental rights. Transfers of personal data outside the EEA constitute an interference with these rights and must, therefore, be consistent with the necessity test of the EU Charter of Fundamental Rights (EU Charter). This chapter demonstrates how a simultaneous application of two necessity tests creates a catch-22 situation and sketches the ways out of this compliance dead lock.

In this digital era, there is a trend of international business expansion by conducting corporate actions, including acquisition, which causes the transfer of personal data both domestically and cross-border due to post-acquisition integration. Meanwhile, in Law No. 27 of 2022 on Personal Data Protection, there are only separate provisions in Article 48 and Article 56 regarding corporate actions and cross-border transfers of personal data, without regulating the correlation between these two provisions. This could potentially lead to the automatic transfer of personal data outside Indonesian jurisdiction as a result of post-acquisition integration. This paper aims to analyse the urgency of establishing a post-acquisition cross-border personal data transfer regulation and formulate an ideal regulation to address this legal issue. The research method used is normative juridical research with a statutory, comparative, conceptual, and case approach, with legal material collection techniques by literature and website study, and analysed using systematic, grammatical, and comparative interpretations. From the results of this research, the author found that there are norm incompleteness in this law. Therefore, the Indonesian government can adopt the provisions in the European Union The General Data Protection Regulation 2016/679 in formulating the ideal provisions regarding the cross-border transfer of personal data post-acquisition.

Vietnam: Data Privacy in a Communist ASEAN State