No description available.

From the very outset of the EU data protection legislation, and hence from the 1995 Directive, international data transfer has been subject to strict requirements aimed at ensuring that protection travels with data. Although these rules have been widely criticized for their inability to deal with the complexity of modern international transactions, the GDPR has essentially inherited the same architecture of the Directive together with its structural limitations. This research aims to highlight the main weaknesses of the EU data export restrictions and identify what steps should be taken to enable a free, yet safe, data flow. This research first places EU data transfer rules in the broader debate about the challenges that the un-territorial cyberspace poses to States’ capabilities to exert their control over data. It then delves into the territorial scope of the GDPR to understand how far it goes in protecting data beyond the EU borders. The objectives underpinning data export restrictions (i.e., avoiding the circumvention of EU standards and protecting data from foreign public authorities) and their limitations in achieving such objectives are then identified. Lastly, three possible “solutions” for enabling data flow are tested. Firstly, it is shown that the adoption by an increasing number of non-EEA countries of GDPR-like laws and the implementation by many companies of GDPR-compliant policies is more likely to boost international data flow than internationally agreed standards. Secondly, the role that Article 3 GDPR may play in making data transfer rules “superfluous” is analysed, as well as the need to complement the direct applicability of the GDPR with cross-border cooperation between EU and non-EU regulators. Thirdly, the study finds that the principle of accountability, as an instrument of data governance, may boost international data flow by pushing most of the burden for ensuring GDPR compliance on organizations and away from resource-constrained regulators.

Over the last decades technological companies have grown significantly and impacted our societies both politically and economically.The significant amount of user data these companies collect and manage have economic as well as political impacts on our societies.  The busines model of social media companies has raised alerts and provoked calls for regulatory measures. The thesis investigated whether social media platforms ‘data’ can constitute a protected investment under a Bilateral Investment Treaty, and what is the position of the international investment law if any about the digital economy. The author made an analysis of data localization regulation to determine if tech companies can claim protection under a BIT to avoid potential issues of a domestic regulation. After the analysis of international legal instruments, BITs and scholar literature the results of the study concluded that data could constitute a protected investment under the wording of certain BITs.