Cross-Border Personal Data Transfers

This work is devoted to the cross-border transfer of personal data and, in particular, is aimed to analyze the regulatory framework of this process in the digital economy. The author considers the existing regulatory approaches from the point of its applicability in the conditions of active use of information technologies, and also suggests possible options for its improvement. The purpose of the research is to specify the concept of cross-border flow of personal data taking into account the current level of the development of information technologies, as well as to identify the main directions of the development of the regulation of cross-border data flow. The achievement of the purpose stated above requires gaining a number of objectives. First of all, it is necessary to identify the criteria of cross-border data flow based on the legal definitions and executors’ practice. Secondly, the author shall highlight and analyze the main models of the information technologies used for cross-border data flow. Thirdly, the research activity shall be focused on the analysis of the legislative development, legislative initiatives and the doctrine on the matter of the regulation of the cross-border transfer of personal data based on a comparative analysis of the legislation of the Russian Federation and the legislation of foreign countries. The research is divided into several parts, which are an introduction, three main chapters (consist of several paragraphs), a conclusion and list of references. In the first chapter the author focuses on the legal definition of a "cross-border data flow". The second chapter is dedicated to regulatory issues, it is especially focused on the legal and economic necessity of the established proscription and limitations. The last chapter is devoted to the general issues of the liability and applicability of the EU regulation to Russian companies. In the conclusion the author summarizes the main results of the research. The author came to the following conclusions: 1. The current definition of cross-border transfer of personal data is poorly adapted to modern conditions and does not take into account the level and significance of information technologies: the definition established in 1981 has not changed since then while it does not take into account technical changes that occurred during the transfer of personal data. A possible solution to this problem may be to change the definition established in the Russian legislation. 2. Within the framework of the new European regulation in the field of personal data, a mixture of organizational and geographical regulatory approaches is fixed; this approach is currently adopted by some countries outside the European Union, which may indicate the formation of a new trend. The implementation of the elements of the organizational approach into the Russian legislation will balance the existing regulation. 3. Responsibility for violating the requirements of cross-border transfer of personal data in the framework of Russian legislation is poorly developed and needs to be modified, which should primarily address issues of administrative legal responsibility, since the effectiveness of established liability directly affects the level of protection of the rights of personal data subjects.