The third country problem under the GDPR: enhancing protection of data transfers with technology

Abstract

Transfers of personal data from the protected area to third countries have been a continuous saga in the European Commission and the Court of Justice of the European Union (CJEU).

The article analyses recent developments related to transfers of personal data to third countries, including shortcomings in the current transfer mechanisms.

The role of technology as a safeguard in third-country transfers under the GDPR is then analysed under the different transfer mechanisms.

The main contribution of this article is to link an analysis of the legal requirements for transfers of personal data to third countries with a computer science-based analysis of Privacy-Enhancing Technologies (PETs) in order to better ensure the overall proportionality, efficiency, and foreseeability in cross-border transfers of personal data to third countries.