Abstract

Keywords

Cross-border data transfers; personal information; data protection; privacy; cloud computing; Protection of Personal Information Act; General Data Protection Regulation.

……………………………………………………….

1 Introduction

Cross-border transfers of personal information 1

* Mthuthukisi Malahleka. LLB (UNISA) LLM (UP) LLM (RU) Cert Compliance Management (UCT). PhD Researcher, School of Law and Economics (Erasmus University Rotterdam, Netherlands) Email: mthuthukisi@hotmail.com. ORCiD: https://orcid.org/0000-0003-4564-8559. Affiliated with Rhodes University: This research is supported by the Rhodes University Postgraduate Funding Office and the University Capacity Development Program. I would like to extend my gratitude towards Rhodes University Faculty of Law for their support in obtaining funding. The views and opinions expressed in this paper are solely those of the author.

1 See s 1 of the Protection of Personal Information Act 4 of 2013 (POPIA) for the definition of the term "personal information".

Personal information forms part of privacy. Privacy is a personality right protected as a fundamental human right under section 14 of the Constitution, 8

8 The Constitution of the Republic of South Africa, 1996 (the Constitution). (In terms of s 14 of the Constitution, the right to privacy includes the claim not to have one's person, home, and property searched or possessions seized. Therefore, it consists of a right to protection against the unlawful collection, retention, dissemination, and use of personal information. The State must then respect, protect, promote and fulfil the rights in the Bill of Rights (including the right to privacy), hence adopting the POPIA. The right to privacy is not absolute; it is subject to limitations under s 36 of the Constitution. However, the cross-border unlawful processing of personal information through cloud computing violates the right to privacy and activates the provisions of the POPIA.)

A critical analysis of section 72 under chapter 9 of the POPIA which regulates cross-border data transfers with other relevant sections will be explored using a doctrinal approach. Thereafter, a comparative analysis of Chapter V of the European Union (EU) General Data Protection Regulation (GDPR) 14

14 General Data Protection Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons Concerning the Processing of Personal Data and the Free Movement of Such Data, and Repealing Directive 95/46/EC OJ L 119/1 (2016) (the GDPR).

must comply with the standard set by the GDPR if South Africa (SA) wants to maintain its position on the international IT market. 16

16 Schwartz 1995 Iowa L Rev 487; Roos 2020 CILSA abstract.

Cloud computing is a model for enabling convenient and on-demand network access to a shared pool of configurable computing resources. 17

17 Mell and Grance 2011 http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf; Hage and Brown date unknown http://www.johnseelybrown.com/ cloudcomputingdisruption.pdf.

2.1 Concerns about data protection on cloud computing services

The cross-border personal information transfers underpin a growing range of economic activities across the globe. 23

23 Mattoo and Meltzer 2018 J Int'l Econ L 769.

computing has made it easy to quickly and seamlessly transfer personal information to other jurisdictions or international organisations. 25

25 Mattoo and Meltzer 2018 J Int'l Econ L 770.

The South African Law Reform Commission (SALRC) 30

30 The mission of the South African Law Reform Commission (SALRC) is the continuous reform of the law of South Africa under the principles and values of the Constitution to meet the needs of a changing society operating under the rule of law.

circumstances pertaining to data transfer operations. Alternatively the assessment was conducted based on the presence of the rules of law, including general and sectoral, adopted in that country in question as well as the security measures and professional rules complied with in that specific country. 34

34 Article 25(2) of the Directive.

4 The scope of the paper

The discussion in this paper is limited to the provisions of the GDPR and the POPIA on cross-border transfers of personal information. 39

39 Mainly Chapter 9 of the POPIA and Chapter V of the GDPR.

For clarity for the discussion in this paper, in the POPIA, a "data controller", 43

43 See Art 4(7) of the GDPR for the definition of the term "controller".

The GDPR uses the term "personal data" 44

44 See Art 4(1) of the GDPR for the definition of the term "personal data".

4.1 POPIA's scope

POPIA is applicable to responsible parties 45

45 See s 1 of the POPIA for the definition of a "responsible party".

important interests such as the free flow of personal information within and across the borders of the Republic, therefore, intentional and negligent wrongful processing of personal information across borders of SA, falls within POPIA's scope.

The GDPR make provisions in relation to the protection of fundamental rights and freedoms of natural persons concerning the processing of their data and the free movement of such personal data. 56

56 Article 1(1) of the GDPR.

Personal data processed within the confines of the activities of an establishment, in other words a controller or a processor in the EU territory, regardless of whether the processing takes place within the EU territory or

not the provisions of the GDPR will be applicable. 63

63 Article 3(1) of the GDPR.

The scope of the GDPR and the POPIA is similar, as highlighted above; however, there are differences in terms of terminology and their broadness in the application. POPIA recognises that juristic persons may, in certain circumstances, be entitled to the right to privacy and a good name. 70

70 Neethling, Potgieter and Knobel Neethling-Potgieter-Visser Law of Delict 342-345; Roos 2020 CILSA 9.

data subjects will have to rely on other legal remedies such as the common law and constitutional law data protection mechanisms.

The GDPR make provisions for the processing of personal data by controllers who can be natural or legal persons. 72

72 Article (4)(7) of the GDPR.

5 Trans-border data flows under the POPIA

Any public or private body in SA is prohibited in terms of the Act to transfer or initiate the cross border transfer of personal information using cloud computing services to another recipient who is domiciled in another country. 75

75 Section 72(1) of the POPIA.

as outlined in the POPIA. 83

83 Section 72(1)(a)(i) of the POPIA.

Section 72(1)(b) read with sections 4, 88

88 Section 4 of the POPIA deals with the lawful processing of personal information.

5.2 Exclusions

The POPIA does not prohibit the processing of personal information across SA borders in order to perform contractual obligations between the data subject and the responsible party. 94

94 Section 72(1)(c) of the POPIA.

obligations, 96

96 Section 72(1)(d) of the POPIA.

5.3 Authorisation by the Information Regulator

Responsible parties who conduct cross-border data transfers using cloud computing services are bound to conduct themselves, at minimum, with the conditions set out in the POPIA. 99

99 Sections 2, 3, 57, 69, 72, and ch 3 of the POPIA.

processing of personal information across the border. The following paragraphs will discuss provisions of the GDPR on cross-border data transfers.

6 Trans-border data flows under the GDPR

The GDPR's provisions influence and affect international transfers of personal data 106

106 Yakovleva and Irion 2020 AJIL Unbound 10.

information is a threat to the right to privacy and, may only be done in terms of the law meaning the EU data protection laws. 118

118 Google Spain v Agencia Española de Protección de Datos (AEDP) 317 ECR (13 May 2014) para 96.

It is difficult to bring data out of the EU in terms of the GDPR. However, in the absence of an adequacy finding, data controllers may adopt specific binding corporate rules or model contracts approved by the EU to conduct cross-border data transfers. A controller must be compliant with the domestic data protection laws of a country that has been granted an adequacy decision from the EU, 119

119 EU 2021 https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en; Quan 2020 Frontiers Law China 273.

The term "cross-border processing" is defined as the processing of personal data in the context of the activities of establishments of a controller domiciled in more than one EU Member State. 121

121 Article 4(23) of the GDPR.

POPIA does not define "cross-border processing" as much as it makes provisions for its protection. "Onward transfers" of personal data remain problematic on cross-border data transfers. 124

124 Esayas 2012 Computer Law and Security Review 664; Mouzakiti 2015 EDPL 41.

or organisation outside the country of origin to another country also known as the third country. 125

125 Mouzakiti 2015 EDPL 41; Voss 2020 Washington International Law Journal 506.

6.1 Adequacy decision on cross-border data transfers

A determination of adequacy requires countries who are not Member States of the EU to adopt and implement a privacy legislation that is similar or equivalent to the GDPR. 126

126 Schrems v Data Protection Commissioner 310 IEHC (2014) para 73.

The transfer of personal data out of the EU can only be carried out based on an adequacy decision, 128

128 Article 45 of the GDPR.

transfers to a country or international organisation that has been granted an adequacy finding does not require any specific authorisation. 133

133 Article 45(1) of the GDPR.

The EC further considers international commitments the country or international organisation from outside the EU is engaged into, 140

140 Blume 2015 IDPL 34; Roos 2020 CILSA 5.

6.1.1 Revoking the adequacy decision

The EC shall, following the review, suspend, amend or repeal its decision of an adequacy finding through implementing acts without retroactive effect, 144

144 Article 45(5) of the GDPR.

In an earlier case of the CJEU decision in Schrems v Data Protection Commissioner 149

149 Schrems v Data Protection Commissioner C-362/14 CJEU (2015). See also Schrems v Data Protection Commissioner 310 IEHC (2014) (hereinafter the Schrems case).

transferred by Facebook Ireland to its servers based in the US. Immediately after the "Snowden revelations", 151

151 Edward Joseph Snowden is an American former computer intelligence consultant who leaked highly classified information from the National Security Agency (NSA) in 2013 when he was an employee and subcontractor. His illegal disclosures revealed numerous global surveillance programs, many ran by the NSA and the Five Eyes Intelligence Alliance with the cooperation of telecommunication companies and European governments, and prompted a cultural discussion about national security and individual privacy; Wikipedia 2022 https://en.wikipedia.org/ wiki/Edward_Snowden.

complaint. 157

157 Schrems case 71.

6.1.2 Issues around the adequacy decision

The process to make an adequacy determination is faced with challenges such as assessing the legal frameworks of other foreign countries, the scarcity of sufficient resources to conduct such assessments and the process itself being time-consuming. 159

159 Mouzakiti 2015 EDPL 41.

6.2 Appropriate safeguards on cross-border data transfers

Data transfers from the EU to non-EU countries or international organisation can only take place if they have appropriate safeguards, 165

165 Article 46(1) of the GDPR.

enforceable between public bodies or authorities, 167

167 Article 46(2)(a) of the GDPR.

POPIA is shallow compared to the GDPR as to what constitutes "appropriate safeguards". They do not prescribe what constitutes a binding agreement and the enforcement mechanisms to ensure adequate data protection.

6.3 The role of binding corporate rules on cross-border data transfers

The GDPR defines binding corporate rules as policies that should be adhered to aimed at protecting personal data when processed by a data controller or processor established within the EU territory. 177

177 Article 4(20) of the GDPR.

are applicable for data transfers to a data controller or processor in another country outside the EU within a group of undertakings, 178

178 Article 4(19) of the GDPR defines the term "group of undertakings" as controlling and controlled undertakings.

Structures and contact details of the group of enterprises or undertakings must be specified in the binding corporate rules. 183

183 Article 47(2)(a) of the GDPR.

The binding corporate rules must further provide data subjects with an unconditional right to bring complaints before a competent and independent SA or before the courts of that country in question. 188

188 Article 47(2)(e) of the GDPR.

subject must be compensated or obtain redress where appropriate. 189

189 Article 47(2)(e) of the GDPR.

Section 72 of the POPIA has a similar definition for the term "binding corporate rules". 194

194 Section 72(2)(a) of the POPIA.

Challenges with binding corporate rules were highlighted in Schrems and Facebook Ireland v Data Protection Commissioner. In this case, the challenge was against the availability of binding corporate rules when the government of the receiving country was not using personal data in consonant with EU privacy and data protection laws. 195

195 See High Court Commercial 2016 https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62014CJ0362.

6.4 Unauthorised data transfers or disclosures in and out of the EU

Transferring personal data out of the EU without the necessary disclosure or authorisation is deemed unlawful. 197

197 Article 48 of the GDPR.

6.5 Derogations for specific situations

Transferring personal data to countries or international organisation outside the EU in the absence of the appropriate safeguards, including binding corporate rules and the adequacy decision can occur only under specific conditions. 200

200 Article 49(1) of the GDPR.

Thirdly, the data transfer must be necessary for the execution or performance of one or more contractual obligations for the data subject's benefit between the controller and another party other than the data subject. 204

204 Article 49(1)(c) of the GDPR.

rights. 206

206 Article 49(1)(e) of the GDPR.

The eighth condition states that data transfers may occur only if not repetitive. 210

210 Article 49(1)(g) of the GDPR.

So far none of the above derogations have proven to be appropriate for controllers who transfer personal data out of the EU. For instance, these derogations require explicit consent by the data subject of the possible risks of such transfers but it must be "informed consent" which raises the stakes. 214

214 Article 49(1)(a) of the GDPR; Mattoo and Meltzer 2018 J Int'l Econ L 777.

instances, data controllers do not have contractual agreements with data subjects such as when personal data is processed from the website on the internet or monitoring data subjects' behaviours online. These scenarios normally do not forge or create contractual obligations or relationships. To transfer data out of the EU countries to pursue a legitimate interest is heavily restricted and cannot be utilised for large quantities and frequent data transfers. 215

215 Article 49(1)(a) of the GDPR; Mattoo and Meltzer 2018 J Int'l Econ L 777.

6.6 International cooperation on cross-border data transfers

The EC and SAs take appropriate steps to ensure that the EU citizen's personal data is processed lawfully. 216

216 Article 50 of the GDPR.

6.7 Comparison

The GDPR sets a uniform standard and data processing principles for all EU countries, whilst POPIA is limited to SA. Although the IR is established under section 39 of the POPIA, which performs similar functions as the SAs under the GDPR, the POPIA does not explicitly clarify the duties of the IR on international data transfers to the extent that the GDPR does on SAs. There is no mention of the IR or its role under section 72 of the POPIA. The role of the IR on cross-border data flows is briefly mentioned under section 57(d), where its authorisation for cross-border data transfers is required. In contrast, Article 48 of the GDPR requires the SA to authorise cross-border

personal data transfers. Non-compliance with section 72 is classified as interference with protecting personal information in section 73(1)(b). 222

222 Section 73(1)(b) of the POPIA states that –for the purposes of Chapter 10 of the POPIA, “interference with the protection of the personal information of a data subject consists, in relation to that data subject, of – (a) any breach of the conditions for the lawful processing of personal information as referred to in Chapter 3; (b) non-compliance with section 22,54,69,70,71 or 72; or (c) a breach of the provisions of a code of conduct issued in terms of section 60”.

The difference in notification requirements and penalties regards more stringent time constraints and more severe fines imposed by the GDPR. The GDPR places a duty on any breaching organisation to report to SAs within 72 hours of discovering a breach. POPIA is very vague in this regard and does not provide a specific timeline. Perhaps more worryingly for the organisations affected, the fines in the GDPR for breaches are significantly severe, up to 20 million euros compared to POPIA's R10m fine. The GDPR also allows penalties to be calculated as a percentage of the global annual revenue of companies (whichever of the two amounts is larger). POPIA provides for criminal sanctions for the unlawful processing of personal information in general which is a provision that the GDPR does not have.

7 Challenges of GDPR on cross-border data transfers regulation for South Africa

Since the GDPR came into force, some businesses, including big role players in the digital space have resorted to exit the EU market due to compliance challenges with the GDPR, and high possibilities of facing lawsuits for non-compliance. 223

223 Quan 2020 Frontiers Law China 272.

uncertainty for internet companies, increasing the cost of compliance for domestic companies and foreign investors. For countries like SA, the cross-border provisions of the GDPR pose a challenge. Significant portions of SA's export services, including to the EU, rely much on cross-border data transfers. However, SA has adopted the POPIA which currently hasn't been to an EC's adequacy assessment. Some of the SA's exports in goods and services to the EU comprise of information technology-driven and software-enabled services. 225

225 Mattoo and Meltzer 2018 J Int'l Econ L 777.

Despite the GDPR having a legitimate aim to protect EU data subjects, on the other hand, it makes the movement of data internationally more challenging. Obtaining an EC adequacy decision on data privacy laws for a country out of the EU enables unrestricted access to the markets in the EU. However, prematurely stringent privacy legislations have the potential to hurt the efficiency, and development of financial sector and other markets by restricting international data flows. It is, therefore, suggested that POPIA be amended to comply with the GDPR standards on cross-border data transfers and approach the EC for an adequacy determination.

8 Recommendations

One could argue that the differences highlighted above between the POPIA and the GDPR on cross-border data transfers are not substantial enough to derail an adequate finding of the POPIA by the EC on cross-border data transfers. 227

227 Roos 2020 CILSA 31.

8.1 Data portability

POPIA must consider adopting the provisions such as Article 20 of the GDPR on data portability. EU data subjects can order that their data be transferred from one controller to another. This is a matter which POPIA does not explicitly address, which is highly recommended to be adopted on cross-border data flows. This means EU data subjects can choose which

jurisdictions their personal information can be transferred to; they are more empowered to control their personal information than their SA counterparts.

A cloud computing-specific provision is recommended within the regulations because a data subject had control over software, hardware and data before introducing cloud computing services into the IT space. The user of cloud computing pays for the use of software as well as the hardware which is typically owned by the cloud computing service provider, and the only asset the user owns is data. 229

229 Ahmed 2010 http://ssrn.com/abstract=1712565.

8.3 Multi-faceted approach

SA data protection laws must consider adopting a multi-faceted approach. Certain bodies and organisations have recommended a multi-faceted approach, including the International Telecommunication Union and the Organisation for Economic Cooperation and Development. Should SA take this route, like other jurisdictions such as Australia this approach will be a solution that will place SA in the world stage for sufficient data protection mechanism. Besides, this is a move and approach that has been called for

by many commentators across the world. 231

231 Mokowadi-Tladi Regulation of Unsolicited Electronic Communication 303.

8.4 Data governance

The concept of data governance framework is adopted to formalise the functions, policies, and procedures as well as the roles, within which the organisation that processes personal data must adhere to and view such data as a strategic asset. 232

232 See Cohn 2015 ISJLP 813; Voss 2020 Washington International Law Journal 518.

Organisations and industries that adopt good data governance frameworks stand a good chance to comply with different data privacy legislations applicable to their cross-border data transfers supply chain. The users of cloud computing services must start by mapping and understanding data processing mechanisms and where their data is as a first step for good data governance. 241

241 Voss 2020 Washington International Law Journal 527.

9 Final remarks

The analysis of section 72 of the POPIA and article 44 of the GDPR provided above, shows that section 72 does to a certain extent provide some level of data protection on cross border data flows. However, the provisions of section 72 lack adequacy as compared to the similar provision under the GDPR on cross boarder data transfers regulation. Section 72 does not protect all the categories of personal data transfers to another country except those that meet the provisions as set out under section 72. The enforcement mechanisms and remedies for the breach of section 72 are vague as discussed above. In terms of the onward transfer of personal information to third countries or parties outside SA, section 72 lacks the enforcement adequacy to hold the recipient accountable in ensuring that further transfers are lawful, and the third party or country does provide adequate data protection and remedies for the unlawful processing. The comparison of section 72 and article 44 have identified some explicit and specific shortcomings of the Act on cross boarder data transfers through cloud computing services. POPIA has not yet been presented (at the time of the research) before the EC for adequacy assessment, which entails, transferring personal information to and from the EU remains extensively restricted. The Act was built upon the provisions of the EU Directive that has been repealed and replaced by a new data protection regulation (GDPR), this observation creates an idea that POPIA is based on an outdated legislation despite some provisions of the Directive being present in the GDPR. Therefore, provisions of section 72 could be met with some challenges when its assessment by the EC is conducted for an adequacy decision should that procedure be initiated in future. The revision of section 72 regulating cross-border data flows through cloud computing services is

the best option to improve data protection laws. The above-proposed recommendations would have to deal with all forms of processing personal information across the SA borders, whether automated or non-automated means through cloud computing services. The use of cloud computing services keeps increasing annually across almost all industries, so the more use of cloud computing becomes a threat to the right to informational privacy. Lawmakers must preserve, guard, and protect the right to informational privacy against international data breaches through cloud computing platforms.

Bibliography

Literature

Allan and Currie 2007 SAJHR

Allan K and Currie ID "Enforcing Access to Information and Privacy Rights: Evaluating Proposals for an Information Protection Regulator for South Africa" 2007 SAJHR 570-586

Blume 2015 IDPL

Blume P "EU Adequacy Decisions: The Proposed New Possibilities" 2015 IDPL 34-39

Bradford 2012 NWULR

Bradford A "The Brussels Effect" 2012 NWULR 19-35

Carpenter 2010 Washington Journal of Law, Technology and Arts

Carpenter RH Jr "Walking from Cloud to Cloud: The Portability Issue in Cloud Computing" 2010 Washington Journal of Law, Technology and Arts 1-14

Cohn 2015 ISJLP

Cohn BL "Data Governance: A Quality Imperative in the Era of Big Data, Open Data, and Beyond" 2015 ISJLP 811-826

Engels 2019 Intereconomics

Engels B "Data Governance as the Enabler of the Data Economy" 2019 Intereconomics 216-222

Esayas 2012 Computer Law and Security Review

Esayas SY "A Walk in the Cloud and Cloudy It Remains: The Challenges and Prospects of 'Processing' and 'Transferring' Personal Data" 2012 Computer Law and Security Review 662-678

Kuner 2017 German Law Journal

Kuner C "Reality and Illusion in EU Data Transfer Regulation Post Schrems" 2017 German Law Journal 881-918

Kuner Transborder Data Flows

Kuner C Transborder Data Flows and Data Privacy Law (Oxford University Press Oxford 2013)

Mattoo and Meltzer 2018 J Int'l Econ L

Mattoo A and Meltzer JP "International Data Flows and Privacy: The Conflict and Its Resolution" 2018 J Int'l Econ L 769-789

Millard and Bascerano 2016 PELJ

Millard D and Bascerano EG "Employers' Statutory Vicarious Liability in Terms of the Protection of Personal Information Act" 2016 PELJ 1-38

Mokowadi-Tladi Regulation of Unsolicited Electronic Communication

Mokowadi-Tladi SE The Regulation of Unsolicited Electronic Communication (Spam) in South Africa: A Comparative Study (LLD-thesis University of South Africa 2017)

Mouzakiti 2015 EDPL

Mouzakiti F "Transborder Data Flows 2.0: Mending the Holes of the Data Protection Directive" 2015 EDPL 39-51

Narayanan 2012 Chicago Journal of International Law

Narayanan V "Harnessing the Cloud: International Law Implications of Cloud-Computing" 2012 Chicago Journal of International Law 783-809

Neethling 2012 THRHR

Neethling J "Features of the Protection of Personal Information Bill, 2009 and the Law of Delict" 2012 THRHR 241-255

Neethling, Potgieter and Knobel Neethling-Potgieter-Visser Law of Delict

Neethling J, Potgieter J and Knobel JC Neethling-Potgieter-Visser Law of Delict 7th ed (LexisNexis Durban 2014)

Neethling, Potgieter and Roos Neethling on Personality Rights

Neethling J, Potgieter J and Roos A Neethling on Personality Rights 2nd ed (LexisNexis Durban 2019)

Peterson 2012 J Marshall L Rev

Peterson T "Cloudy with a Chance of Waiver: How Cloud Computing Complicates the Attorney-Client Privilege" 2012 J Marshall L Rev 383-408

Power and Trope 2005 Business Law

Power EM and Trope RL "Lessons in Data Governance: A Survey of Legal Developments in Data Management, Privacy and Security" 2005 Business Law 471-516

Power and Trope 2006 Business Law

Power EM and Trope RL "The 2006 Survey of Legal Developments in Data Management, Privacy, and Information Security: The Continuing Evolution of Data Governance" 2006 Business Law 251-294

Quan 2020 Frontiers Law China

Quan X "The Governance of Cross-Border Data Flows in Trade Agreements: Is the CPTPP Framework an Ideal Way Out?" 2020 Frontiers Law China 253-279

Roos 2020 CILSA

Roos A "The European Union's General Data Protection Regulations (GDPR) and Its Implications for South African Data Privacy Law: An Evaluation of Selected 'Content Principles'" 2020 CILSA 1-37

Roos Law of Data (Privacy) Protection

Roos A The Law of Data (Privacy) Protection: A Comparative and Theoretical Study (LLD-thesis University of South Africa 2003)

SALRC Privacy and Data Protection

South African Law Reform Commission Discussion Paper 109, Project 124: Privacy and Data Protection (SALRC Pretoria 2005)

Schwartz 1995 Iowa L Rev

Schwartz PM "European Data Protection Law and Restrictions on International Data Flows" 1995 Iowa L Rev 471-496

Van der Merwe et al ICT Law

Van der Merwe DP et al Information and Communications Technology Law 2nd ed (LexisNexis Durban 2016)

Voss 2017 University of Illinois Journal of Law, Technology, and Policy

Voss WG "Internet, New Technologies, and Value: Taking Share of Economic Surveillance" 2017 University of Illinois Journal of Law, Technology and Policy 469-485

Voss 2019 University of Illinois Journal of Law, Technology, and Policy

Voss WG "Obstacles to Transatlantic Harmonization of Data Privacy Law in Context" 2019 University of Illinois Journal of Law, Technology and Policy 405-463

Voss 2020 Washington International Law Journal

Voss WG "Cross-Border Data Flows, the GDPR, and Data Governance" 2020 Washington International Law Journal 485-532

Voss and Woodcock Navigating EU Privacy and Data Protection Laws

Voss WG and Woodcock K Navigating EU Privacy and Data Protection Laws (American Bar Association Cleveland 2016)

Yakovleva and Irion 2020 AJIL Unbound

Yakovleva S and Irion K "Toward Compatibility of EU Trade Policy with the General Data Protection Regulation" 2020 AJIL Unbound 10-14

Yav 2018 International Journal Data Protection Officer, Privacy Officer, and Privacy Counsel

Yav C "Perspectives on the GDPR from South Africa" 2018 International Journal Data Protection Officer, Privacy Officer, and Privacy Counsel 19-20

Yoo and Blanchette Regulating the Cloud

Yoo CS and Blanchette JF Regulating the Cloud: Policy for Computing Infrastructure (MIT Press Cambridge, Mass 2015)

Case law

South Africa

Dlomo v Natal Newspapers (Pty) Ltd 1989 1 SA 945 (A)

Investigating Directorate: Serious Economic Offences v Hyundai Motor Distributors (Pty) Ltd; In re Hyundai Motor Distributors (Pty) Ltd v Smit 2001 1 SA 545 (CC)

Janit v Motor Industry Fund Administrators (Pty) Ltd 1995 4 SA 293 (A)

Universiteit van Pretoria v Tommie Meyer Films 1977 4 SA 376 (T)

European Union

Google Spain v Agencia Española de Protección de Datos 317 ECR (13 May 2014)

Schrems and Facebook Ireland v Data Protection Commissioner C-311/18 CJEU (2020)

Schrems v Data Protection Commissioner 310 IEHC (2014)

Schrems v Data Protection Commissioner C-362/14 CJEU (2015)

Legislation

Ireland

Irish Data Protection Act 25 of 1988

Irish Data Protection (Amendment) Act 6 of 2003

South Africa

Constitution of the Republic of South Africa, 1996

Protection of Personal Information Act 4 of 2013

European Union

Commission Decision 2000/520/EC of 26 July 2000 Pursuant to Directive 95/46/EC of the European Parliament and of the Council on the Adequacy of the Protection Provided by the Safe Harbour Privacy Principles and Related Frequently Asked Questions Issued by the US Department of Commerce OJ L 215/7 (2000)

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals Concerning the Processing of Personal Data and the Free Movement of Such Data OJ L281/31 (1995)

EU-US Privacy Shield C(2016) 4176 (2016)

EU-US Safe Harbor Agreement (2000)

General Data Protection Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons Concerning the Processing of Personal Data and the Free Movement of Such Data, and Repealing Directive 95/46/EC OJ L 119/1 (2016)

Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the Protection of Individuals with Regard to the Processing of Personal Data by the Community Institutions and Bodies and on the Free Movement of Such Data OJ L 8/1 (2001)

Government publications

Gen N 309 in GG 44411 of 1 April 2021

International instruments

Charter of Fundamental Rights of the European Union (2000)

Convention for the Protection of Human Rights and Fundamental Freedoms (1950)

Treaty on European Union (2009)

Internet sources

Ahmed 2010 http://ssrn.com/abstract=1712565

Ahmed S 2010 Data Portability: Key to Cloud Portability and Interoperability http://ssrn.com/abstract=1712565 accessed 7 May 2022

Article 29 Data Protect Working Party 2012 https://ec.europa.eu/justice/article29/documentation/opinion/recommendations/files/2012/wpl96_en.pdf

Article 29 Data Protect Working Party 2012 Opinion 05/2012 on the Cloud Computing WP 196 https://ec.europa.eu/justice/article29/ documentation/opinion/recommendations/files/2012/wpl96_en.pdf accessed 22 April 2022

Article 29 Data Protection Working Party 2017 https://www.datenschutzkonferenz-online.de/media/wp/20180206_wp254_ rev01.pdf

Article 29 Data Protection Working Party 2017 Adequacy Referential 18/EN WP254 rev.01 (28 November 2017) https://www.datenschutzkonferenz-online.de/media/wp/20180206_wp254_rev01.pdf accessed 6 April 2024

Charlet 2019 https://news.bloomberglaw.com/privacy-and-data-security/big-google-privacy-fine-may-set-bar-foreuprivacy-penalties

Charlet D 2019 Big Google Privacy Fine May Set Bar for EU Privacy Penalties, https://news.bloomberglaw.com/privacy-and-data-security/big-google-privacy-fine-may-set-bar-foreuprivacy-penalties accessed 26 August 2022

CJEU 2015 http://www.europe-v-facebook.org/CJEUhearingnotes.pdf

Court of Justice of the European Union 2015 Procedure, Protocol of the Hearing http://www.europe-v-facebook.org/CJEUhearingnotes.pdf accessed 19 September 2022

EU 2020 https://europa.eu/european-union/about-eu/countries_en

European Union 2020 Country Profiles https://europa.eu/european-union/about-eu/countries_en accessed 9 April 2024

EU 2021 https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en

European Union 2021 Data Protection under GDPR https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data- non-eu-countries-en accessed 5 September 2022

Europe-v-Facebook Organisation Project 2017 http://europe-v-facebook.org/EN/en.html

Europe-v-Facebook Organisation Project 2017 C-362/14 – Schrems Further Files Concerning the Schrems Case before the CJEU http://europe-v-facebook.org/EN/en.html accessed 19 September 2022

European Commission 2007 https://ec.europa.eu/info/aid-development-cooperation-fundamental-rights/your-rights-eu/eu-charterfundamental-rights_en

European Commission 2007 EU Charter of Fundamental Rights and Freedoms 2007/C 303/01 https://ec.europa.eu/info/aid-development-cooperation-fundamental-rights/your-rights-eu/eu-charterfundamental-rights_en accessed 05 September 2022

European Commission 2020 https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

European Commission 2020 Adequacy Decision: How the EU Determines if a Non-EU Country has an Adequate Level of Data Protection https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en accessed 6 September 2022

Hage and Brown date unknown http://www.johnseely brown.com/cloudcomputingdisruption.pdf

Hage J and Brown JS date unknown Cloud Computing – Storms on the Horizon http://www.johnseelybrown.com/cloudcomputingdisruption.pdf accessed 15 April 2022

High Court Commercial 2016 https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62014CJ0362

The High Court Commercial 2016 The Data Protection Commissioner v Facebook Ireland Limited and Maximilian Schrems, Request for a Preliminary Ruling under Article 267 TFEU (2016) No 4809 P https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62014CJ0362 accessed 27 August 2022

Ireland's National Public Media 2018 https://www.rte.ie/ news/2018/0717/979174-eu-japan/

Ireland's National Public Media 2018 European Union and Japan Sign Historic Trade Deal https://www.rte.ie/news/2018/0717/979174-eu-japan/ accessed 29 August 2022

Kayali 2019 https://www.politico.eu/article/france-hits-google-with-e50-million-fine-for-gdpr-violation/

Kayali L 2019 France Hits Google with 50 Million Fine for GDPR Violation https://www.politico.eu/article/france-hits-google-with-e50-million-fine-for-gdpr-violation/ accessed 19 August 2022

Manyika et al 2016 https://www.mckinsey.com//media/McKinsey/

Business%20Functions/McKinsey%2ODigital/Our%20Insights/Digital%20globalization%20The%20new%2era%20f%2Oglobal%20flows/MGI-Digitalglobalization-Full-report.ashx

Manyika J et al 2016 Digital Globalization: The New Era of Global Flows https://www.mckinsey.com//media/McKinsey/Business%20Functions/McKinsey%2ODigital/Our%20Insights/Digital%20globalization%20The%20new%2era%20f%2Oglobal%20flows/MGI-Digitalglobalization-Full-report.ashx accessed13 September 2022

Martin 2011 http://works.bepress.com/timothy_martin/3

Martin TD 2011 Hey! You! Get Off of My Cloud: Defining and Protecting the Metes and Bounds of Privacy, Security, and Property in Cloud Computing http://works.bepress.com/timothy_martin/3 accessed 21 April 2022

Mckinsey Global Institute 2016 https://www.mckinsey.com/~/media/ McKinsey/Business%/`2OFunctions/McKinsey%/`20Digital/Our%/o2Olnsights/Digital%20globalizationo2OThe%20newo20era/o2ofo2Oglobal/o20flows/MGI-Digital-globalization-Full-report.ashx

Mckinsey Global Institute 2016 Digital Globalisation: The New Era of Global Flows https://www.mckinsey.com/~/media/McKinsey/Business%/ `2OFunctions/McKinsey%/`20Digital/Our%/o2Olnsights/Digital%20globalizationo2OThe%20newo20era/o2ofo2Oglobal/o20flows/MGI-Digital-globalization-Full-report.ashx accessed 7 September 2022

Mckinsey Global Institute 2019 https://www.mckinsey.com/~/media/ McKinsey/Featured%/`20Insights/Innovation/Globalizationo2Oino20transitiono2OThe%20future%20fo20trade/o20and%20value%20chains/MGI-Globalizationo2Oin%/o20transition-The-future-of-trade-and-value-chains-Fullreport.ashx

Mckinsey Global Institute 2019 Globalization in Transition: The Future of Trade and Value Chains https://www.mckinsey.com/~/media/

McKinsey/Featured%/`20Insights/Innovation/Globalizationo2Oino20transitiono2OThe%20future%20fo20trade/o20and%20value%20chains/MGI-Globalizationo2Oin%/o20transition-The-future-of-trade-and-value-chains-Fullreport.ashx accessed 7 September 2022

Mell and Grance 2011 http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf

Mell P and Grance T 2011 The NIST Definition of Cloud Computing http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf accessed 19 April 2022

Meltzer 2020 https://www.brookings.edu/research/the-court-of-justice-of-the-european-union-in-schrems-ii-the-impact-of-gdpr-on-data-flows-and-national security/#footnote-1

Meltzer JP 2020 The Court of Justice of the European Union in Schrems II: The Impact of the GDPR on Data Flows, and National Security https://www.brookings.edu/research/the-court-of-justice-of-the-european-union-in-schrems-ii-the-impact-of-gdpr-on-data-flows-and-national-security/#footnote-1 accessed 9 April 2022

Preston 2008 https://www.informationweek.com/software-services/down-to-business-customers-fire-a-few-shots-at-cloud-computing

Preston B 2008 Down to Business: Customers Fire a Few Shots at Cloud Computing https://www.informationweek.com/software-services/down-to-business-customers-fire-a-few-shots-at-cloud-computing accessed 14 April 2022

Wikipedia 2022 https://en.wikipedia.org/wiki/Edward_Snowden

Wikipedia 2022 Edward Snowden https://en.wikipedia.org/wiki/Edward_ Snowden accessed 26 September 2022

WorldAtlas 2020 https://www.worldatlas.com/nations.htm

WorldAtlas 2020 How Many Countries Are in the World? Https://www.worldatlas.com/nations.htm accessed13 September 2022

List of Abbreviations