To celebrate my return to Twitter and to reward or punish my followers (decide for yourself), let me share my draft chapter on the "Evolution of European data law" for the 3rd edition of Paul Craig and Grainne de Burca's Evolution of EU Law 🇪🇺 (OUP 2021): https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3762971
The paper is still "under review" by @SSRN so you might have to copy and paste the link to get access to it.
The paper is heavily influenced by the thinking + teaching generated at the Global Data Law project @GuariniGlobal @nyulaw where I am fortunate to collaborate with @AngelinaFisherD and Benedict Kingsbury. But don't blame them for this paper. Visit http://www.guariniglobal.org/global-data-law  instead.
I received great comments from Johann Justus Vasel and from @PrzemekPalka and @Elibietti. I couldn't incorporate or react to all their sharp thoughts for reasons of time and space but I see this paper very much as launching rather than ending a conversation anyway.
The paper is part of a larger volume on the evolution of EU law (*prior* edition available here: https://global.oup.com/academic/product/the-evolution-of-eu-law-9780199592968?cc=de&lang=en&#). For this reason, the paper tells a story about European data law that is also meant to be a story about EU law, and how it grapples with digitalization.
One key insight that the paper (and our Global Data Law project) tries to convey is that data law is more than data protection law. At the same time, European data law in particular very much gravitates around European data protection law.
For this reason, the paper starts with what I describe as a process of Europeanization: "before there was European data protection law, there was data protection law in Europe".
Much of what became the 1995 Data Protection Directive and lives on in the 2016 #GDPR was foreshadowed in the national data protection laws of Member States and the international instruments developed by @coe and @OECD
As scholars like Spiros Simitis and @paulschwartz have detailed, the EU's data protection law (including the controversial limitation on cross-border transfers of personal data) was initially a consolidation and amalgamation of disparate concepts.
EU data protection law, like EU law generally, is not uniform. What @AntheaERoberts said about international law, is also true, to a lesser extent, for EU law: it's not as European as one might think. But there are unifying forces at work.
After the entry of the force of the EU Charter of Fundamental Rights, which includes dedicated rights of data protection and privacy (Articles 7 and 8), the EU Court of Justice developed an unusually forceful fundamental rights jurisprudence in the field of data protection law.
Moreover, EU data protection law has a unique institutional structure with exceptionally independent data protection authorities, data protection officers in firms, and institutions for supranational coordination and enforcement @EU_EDPB @EU_EDPS
The chapter charts all these developments to explain the evolution of European data protection law as a process of Europeanization, with the GDPR as the main legislative achievement -- so much so that existing and emerging EU data law must gravitate and navigate around it.
The second part of the paper focuses on three domains of EU data law that are not data protection law: the EU law on non-personal data (which are outside the GDPR's scope of application) and EU law on data ownership and access to data (which intersect with the GDPR).
I had to cut sections on EU data security law (blending cybersecurity law and data protection law) and the important law on digital services but I hope to develop these sections into stand alone papers at some point in the future.
The third part of the paper discusses the ways in which European data law (mainly European data protection law) has become globalized.
I discuss non-territorial application, the conditionalities imposed on cross-border transfers of personal data, the EU's intl agreements, and of course @anubradford's #BrusselsEffect which may be more limited and circumscribed in the digital domain than generally believed.
I learned a lot from researching and writing this paper and I'm very curious to get feedback on the account and the ideas that I'm advancing in this piece. Please email me, send me a DM, or reply to this thread.
In the next days and weeks, I would like to push the conversation forward by asking some pointed questions, in particular with regard to the scope of data protection law and the (not always acknowledged) tensions inherent in the EU's data strategy.
But for now, I simply want to acknowledge some of the scholars who have traversed EU data law in much more depth than I was able to do in this chapter. You should all follow them if you do not already (but make sure to not get caught by Twitter's flawed anti-bot algorithm).
You can follow @t_streinz.
Tip: mention @twtextapp on a Twitter thread with the keyword “unroll” to get a link to it.

Latest Threads Unrolled:

By continuing to use the site, you are consenting to the use of cookies as explained in our Cookie Policy to improve your experience.