# Data Protection Regulation and International Arbitration: Can There Be Harmonious Coexistence (with the GDPR Requirements Concerning Cross-Border Data Transfer)?

- Type: Literature
- Source: Legal Issues in the Digital Age
- Date: 2021-07-27
- Original: https://doi.org/10.17323/2713-2749.2021.2.21.48
- Canonical: https://overview.legal/posts/132548
- Topics: International Transfer, Confidentiality Obligations and Requirements

## Summary

Recent global trends are producing powerful growth in the digital environment, and its spread is prompting adoption of strict and comprehensive regulation to ensure data protection. This results in a number of difficulties, one of which is lack of consistency between data protection regulation and the regulatory regimes applicable to specific industries and institutions. That inconsistency is particularly evident in the field of international arbitration — one of the most widely used and conveni

## Full text

21 Data Protection Regulation and International Arbitration: Can There Be Harmonious Coexistence (with the GDPR Requirements Concerning Cross-Border Data Transfer)? Elena Mazetova Lecturer, Department of International Law, National Research University Higher School of Economics, LL.M. Address: 20 Myasnitsky Str., Moscow 10100, Rus - sia. E-mail: emazetova@hse.ru Abstract Recent global trends are producing powerful growth in the digital environment, and its spread is prompting adoption of strict and comprehensive regulation to ensure data protection. This results in a number of difficulties, one of which is lack of consistency between data protection regulation and the regulatory regimes applicable to specific industries and institutions. That inconsistency is particularly evident in the field of international arbitration — one of the most widely used and convenient methods for resolving international disputes. The principles and fundamental concepts that largely define international arbitration, such as autonomy of the parties and confidentiality, have made its use very well accepted and widespread. However, data protection requirements often force the parties that are subject to them to make a difficult choice between the basic principles of international arbitration and the requirements of data protection regulation. This bind has come about because data protection regulation, which generally imposes comprehensive compliance obligations, rarely takes into account the specifics of the industries in which it will be applied. In this article it is analyzing application of the GDPR requirements that pertain to cross- border data transfer from the perspective of international arbitration in order to illustrate difficulties and regulatory gaps that may be encountered by the entities interested in thorough compliance with the applicable regulations. Keywords private data, data protection, cross-border data transfer, GDPR, international arbitration, legal claims, legal proceedings. This article is published under the Creative Commons Attribution 4.0 License 22 Articles For citation : Mazetova E. A. (2021) Data Protection Regulation and International Arbitration (Can There Be Harmonious Coexistence?) Legal Issues in the Digital Age, no 2, pp. 21–48. DOI: 10.17323/2713-2749.2021.2.21.48 Introduction The idea that private data needs to be protected is not new: it stems largely from Semayne’s case (in which it was declared that “the house of every one is to him as his castle and fortress”) 1 [Cooper D., Kuner C., 2017: 44] and has undergone a lengthy path of development since then. 2 People have ultimately become much more aware of the importance of protecting their private life and, as a logical extension, of guarding their personal data, but the explosive development of technology has made protecting data a challenging task that requires consideration of various nuances. The problems attendant upon pervasive digitalization are now being widely discussed at a time when the standard way of saving and sharing information is transitioning from paper to digital formats and most pro - cesses and communications are going online, and it is well accepted that the numerous benefits from increasing use of technology usage also entail significant risks. Undoubtedly, the trend toward digitalization has been sig - nificantly reinforced and accelerated by the COVID-19 pandemic, and it is unlikely that this progression toward a digital reality can be reversed in the future. As a result, we face a dramatic increase in the types and amount of data, including data of private individuals, which is constantly being col - lected, stored and transmitted on various (and also continually proliferat - ing) types of devices [Burianski M., Reindl M., 2010: 183]. In this context it is not surprising that data protection issues are attracting increased attention from state actors, 3 which then results in the development of more advanced and complex data protection regulations. 4 It is notable 1 See Semayne’s case, 77 Eng. Rep. 194 (Kb 1604). 2 The idea of data privacy was elaborated thoroughly by Samuel Warren and Louis Brandeis in their article of 1890 published in the Harvard Law Review . 3 For example, the Brazilian General Data Protection Law. Available at: https://gdpr. eu/gdpr-vs-lgpd/ (accessed: 20.04.2021). Another example is the California Consumer Privacy Act. Available at: https://www.theguardian.com/us-news/2019/dec/30/california- consumer-privacy-act-what-does-it-do (accessed: 20.04.2021) 4 According to data from the United Nations Conference on Trade and Development, only 19% of countries across the globe have no special data protection and privacy regula - tions. Available at: https://unctad.org/en/Pages/DTL/STI_and_ICTs/ICT4D-Legislation/ eCom-Data-Protection-Laws.aspx (accessed: 20.04.2021) 23 Elena Mazetova. Data Protection Regulation and International Arbitration...  . 21–48 that the recently growing interest of states in regulating data protection is - sues also points up another trend in digitalization, which is the increased speed and technical simplicity of transferring data between different coun - tries. This trend is understandably welcomed by commercial companies (in particular, those that conduct their business at the international level); how - ever, it is causing heightened concern on the part of regulators. The upshot is that states want their data protection standards to apply across jurisdictional borders or else to significantly restrict transfers of data across those borders [Cooper D., Kuner C., 2017: 32–33, 72], and this influences the approaches to data protection legislation adopted by the respective states. It is also noteworthy that, although large IT corporations such as Google or Facebook are seen as the main “addressees” of recent data protection regulation, we find that even companies whose main business is not directly related to the internet or development of technology are facing significant fines for violation of data protection laws. 5 Thus, it is fair to say that data protection regulation is becoming truly comprehensive and influencing al - most all areas of life by requiring the key actors responsible for collecting and processing private data to apply additional safeguards and protections. As will be shown below, all these circumstances have led to conflicting re - quirements, not only within the field of data protection itself (and in particular as it affects cross-border aspects) but also between data protection regimes and other areas of law, e.g. international arbitration. Those areas of law normally have their own rules and principles of operation, but at the same time they are not exempt from the application of data protection requirements. As Chris - topher Kuner correctly indicated, this incompatibility between different legal regimes may “go beyond simple conflict of laws, and can be viewed as conflicts between different social sectors” (Kuner C., 2013: 135). International arbitration provides a good example of this kind of con - flict: first, it is a rapidly developing and widely used tool for resolving in - ternational disputes. Almost any company that conducts business across borders has either already resorted to international arbitration in order to resolve disputes or may potentially need to do so. 6 Second, although inter - 5 For example, a £18.4 million fine was imposed on Marriott International Inc. for a data protection breach (ICO Penalty Notice. 30 October 2020, case ref.: COM0804337. Available at: https://ico.org.uk/action-weve-taken/enforcement/marriott-international- inc/ (accessed: 06.04.2021)). A similar fine of £20 million was levied against British Air - ways (ICO Penalty Notice.16 October 2020, case ref.: COM0783542. Available at: https:// ico.org.uk/action-weve-taken/enforcement/british-airways/ (accessed: 06.04.2021) 6 International arbitration was considered the preferred method of dispute resolution by 97% of respondents to the 2018 International Arbitration Survey: The Evolution of In - 24 Articles national arbitration understood as a branch of law is far removed from the field of data protection, it is still significantly affected by it and in practice is often forced to adapt to data protection rules. In the analysis that follows, we will focus on the application of data pro - tection regulations to international arbitration and will consider certain difficulties and inconsistencies that parties to international arbitration may encounter in their attempt to comply with data protection requirements. 1. How data protection regulation affects international arbitration As mentioned above, the growing concern about data protection could not fail to impact nearly every aspect of life and business operations. 7 Be - cause international arbitration is one of the most commonly used and con - venient methods for resolution of international disputes, it should come as no surprise that it was affected both by the application of regulations concerning cross-border data transfer and also by the current trend toward data protection in general. The impact becomes even more significant due to the recent devel - opment of online arbitration, as well as to the increasing penetration of digital tools and techniques into the conduct of arbitration proceedings. 8 Furthermore, the risks associated with cross-border data transfer become very meaningful in practice when international arbitration brings together participants from different jurisdictions who travel across the world and represent companies from different countries [Pastore J., 2017: 1029]. Each and every of those participants may be exposed to risks that could under - mine the entire arbitration process [Cohen S., Morril M., 2017: 1005]. Although it may be argued that those risks are limited by the inherent confidentiality of arbitration and also by a consent-based and generally bal - anced approach to the production of documents and information in arbi - tration [Born G., 2021: 2495–2496], experience shows that international ternational Arbitration, which was conducted by the School of International Arbitration at Queen Mary University of London in partnership with White&Case LLP. 7 For instance, question related to the GDPR influence over the arbitration was one of those that the tribunal had to evaluate in Tennant Energy LLC v Government of Canada (see: Tennant Energy, LLC v Government of Canada , PCA case No. 2018-54). 8 The Queen Mary University survey also shows that at least 61% of respondents high - light the “increased efficiency, including through technology” and that such measures as videoconferencing and hearing room technologies are always or frequently used by over 60% of respondents. 25 Elena Mazetova. Data Protection Regulation and International Arbitration...  . 21–48 arbitration, as well as the parties involved in it, are encountering instances of data breaches with increasing frequency. The risks are incurred in a wide range of circumstances that include mistakenly sending personal informa - tion of one of the parties to a person not connected with the proceedings [Smeureanu I., 2011: 183–184], 9 leakage of clients’ private data from law firms [Cohen S., Morril M., 2017: 987]; along with targeted hacker attacks on arbitration institution (e.g., as happened to the Permanent Court of Ar - bitration in the Hague in July 2015 in the course of hearing The Republic of the Philippines v The People’s Republic of China ) (Pastore J., 2017: 1023, 1026). The risks to which private data may be exposed 10 in the process of in - ternational arbitration — which is clearly not risk-free — are a sufficient practical justification of applying data protection measures. The need for the entities involved in international arbitration to comply with data protection requirements arises also from the data protection laws themselves. First, laws in that field typically offer a definition of “data pro - cessing” (as an activity which entails application of data protection regula - tion) so broad that almost any activity or process occurring in the course of resolving a dispute by an arbitration tribunal, from taking initial evidence to issuing an arbitral award, may fall within the scope of data protection requirements 11 and so trigger specific compliance obligations. Second, although most of the recent data protection requirements ex - empt judicial proceedings from some group of obligations or from specific obligations, arbitration is not mentioned explicitly. 12 It is difficult to un - derstand the reasoning behind this approach (there are as yet no official 9 See, for example, the claim of an individual, Mr. Carlos Antonio, brought against an arbitration institution in Spain. As a result of a data breach, the arbitral institution was fined €6,000 for infringement of its obligation to protect data and confidentiality. 10 It should be noted that a risk-based approach is also suggested by data protection regulations themselves, such as the GDPR, which highlights the importance of evaluating risks. Available at https://iapp.org/resources/article/the-risk-based-approach-in-the-gdpr- interpretation-and-implications/ (accessed: 10.04.2021) 11 For example, in according with Art. 4(2) of the GDPR “processing” is defined as “any operation … which is performed on personal data…, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”. 12 See, for example, Art. 23(f) of the GDPR; also see discussion of the Indian Draft Personal Data Protection Bill. Available at: http://arbitrationblog.kluwerarbitration.com/ 2019/04/16/data-protection-in-india-and-arbitration-key-questions-ahead/ (accessed: 23.04.2021) 26 Articles comments or guidance that would explain it), but it leads naturally to dis - cussion of the applicability of the existing exceptions to arbitration due to its mixed nature, which combines jurisdictional and contractual features [Lew J., Mistelis L., Kroll M., 2003: 72]. Nevertheless, commentators gener - ally agree that a conservative approach which interprets the term “judicial proceedings” in a narrow sense as covering only state courts should prevail [Paisley K., 2018: 857]. As matters now stand, parties to arbitration cannot rely on the general exceptions and are forced to apply more nuanced, case-by-case analysis in order to properly comply with data protection regulations. As a result, many reputable and respected arbitration institutions regu - larly update their rules and recommendations to the parties and tribunals involved in order to properly address data protection considerations. 13 Par - allel to that, the professional community of lawyers are working on de - termining the best practices to ensure accurate and comprehensive com - pliance. 14 The importance of those efforts cannot be overestimated: the ICCA-IBA Roadmap to Data Protection in International Arbitration indi - cated that it is intended “to help arbitration professionals better understand the data protection and privacy obligations to which they may be subject in relation to international arbitration proceedings”. 15 Nevertheless, the broad question of whether international arbitration and data protection regula - tions can coexist in harmony remains open. As will be further illustrated by the example of the EU’s General Data Protection Regulation (hereinafter GDPR), 16 the lack of clarity on this matter means that the that parties to international arbitration and the other participants in it must continually choose between non-compliance (or at least improper compliance) with 13 See, for example, Art. 30A of the LCIA Arbitration Rules 1 October 2020; or Sec - tion D “Protection of Personal Data” in the ICC Note to Parties and Arbitral Tribunals on the Conduct of the Arbitration under the ICC Rules of Arbitration.1 January 2019. 14 See, for example, the Cyber Security Guidelines from the IBA’s Presidential Task Force on Cyber Security, October 2018. Available at: https://www.ibanet.org/LPRU/cyber - security-guidelines.aspx (accessed: 23.04. 2021); the ICCA-NYC Bar-CPR Protocol on Cy - bersecurity in International Arbitration, 2020. Available at: https://www.arbitration-icca. org/projects/Cybersecurity-in-International-Arbitration.html (accessed: 20.04. 2021); the Consultation Draft of the ICCA-IBA Roadmap to Data Protection in International Arbitra - tion, February 2020. Available at: https://www.arbitration-icca.org/icca-reports-no-7-icca- iba-roadmap-data-protection-international-arbitration (accessed: 20.04.2021) 15 See the ICCA-IBA Roadmap to Data Protection in International Arbitration, p. 1. 16 Regulation (EU) 2016/679 of the European Parliament and of the Council 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). 27 Elena Mazetova. Data Protection Regulation and International Arbitration...  . 21–48 data protection requirements and securing all the potential benefits of in - ternational arbitration. 2. How the GDPR rules on cross-border data transfer affect international arbitration It is pertinent to note that the recent global trends in data protection regulation have been set in motion largely by the GDPR, which entered into force in 2018. 17 The worldwide acquiescence to the GDPR is due not only to the heavy fines (up to 4% of global gross revenue or €20 million) and possible crimi - nal liability for violation of the GDPR, but also to its broad application and potentially extraterritorial effect. 18 The EU Commission made clear the ex - traterritorial ambition of the GDPR when it stated that “the primary pur - pose of these rules is to ensure that when the personal data of Europeans are transferred abroad, the protection travels with the data”. 19 The approaches employed by the GDPR have also been adopted and reproduced in the leg - islative acts of other countries [Cooper D., Kuner C., 2017: 48). In a sense, the GDPR has prompted extensive reconsideration and improvement of data protection regimes in general, and it still remains one of the most compre - hensive and detailed regulatory tools for personal data protection. For this reason, we will examine in detail some of the data protection issues in international arbitration that have resulted from the rules promul - gated by the GDPR. It should be noted that the overall impact of data pro - tection regulation on international arbitration is significant and that it af - fects a wide variety of procedural matters, such as additional obligations for arbitrators and arbitral institutions [Cohen S., Morril M., 2017: 997–1002], issues with production of evidence [Cooper D., Kuner C., 2017: 100], dif - ficulties with publication of awards [Tshanz P.-Y., 2006], etc. However, in this article we will primarily focus on analysis of the rules and grounds for cross-border data transfer: this regulatory nexus is particularly interesting 17 The GDPR replaced the previous Data Protection Directive (Directive 95/46/EC), which had been in effect since 1995. See: The History of the General Data Protection Reg - ulation. Available at: https://edps.europa.eu/data-protection/data-protection/legislation/ history-general-data-protection-regulation_en (accessed: 04.05.2021) 18 Communication from the EU Commission to the European Parliament and the / Council, Exchanging and Protecting Personal Data in a Globalised World, COM/ 2017/07 final. 10.01.2017. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/? uri= COM%3A2017% 3A7%3AFIN (accessed: 29.04.2021) (hereinafter EU Communication). 19 Ibid. 28 Articles because it highlights the underlining ideas peculiar to each of the regulatory fields under consideration while it also exposes discrepancies even at this basic conceptual level. We find several reasons for this particular problem. First, the GDPR maintains that, once private data of EU data subjects is involved, data protection compliance may be required from almost every - one engaged in a case, including the principal parties themselves, counsels acting on their behalf, arbitral institutions (when applicable), members of the arbitral tribunal, and so on regardless of the home jurisdiction of any of these participants [Paisley K., 2018: 854]. Second, applying specific data protection rules, including the GDPR, in international arbitration is complicated by jurisdictional diversity, such that one party may be from one of the EU countries and another from Africa, the arbitral institution may be seated in an Asian country, the tri - bunal is composed of three arbitrators from three different jurisdictions, and hearings take place in various locations, etc. These geographically and jurisdictionally fragmented features of international arbitration mean that rules for cross-border data transfer will inevitably apply to international ar - bitration, but those rules will also be applied differently in each individual episode of data transfer. Presumably, analysis of the cross-border data transfer regulations and identification of those that are applicable to a given situation should be the first step in preparing for arbitration, as it would determine the scope of possible disclosure and the sequence of actions required to comply with data protection regulations. It would be reasonable to expect that this first step should be rather straightforward and provide the parties with clear guidance concerning the applicable rules and potential risks. However, as will be demonstrated below, the reality may differ from expectations. General GDPR requirements for cross-border data transfer The GDPR regulates cross-border data transfer (i.e. transfer of data out - side the European Economic Area [EEA]) 20 and application of its rules in international arbitration is difficult to avoid. Requirements of the GDPR may come into play in various scenarios: for instance, when a party, either as a result of being registered within the EU 21 or due to processing or con - 20 Actual list of the EEA countries available at: https://ec.europa.eu/eurostat/statis - tics-explained/index.php?title=Glossary:European_Economic_Area_(EEA) (accessed: 10.06.2021) 21 See Art. 3 of the GDPR. 29 Elena Mazetova. Data Protection Regulation and International Arbitration...  . 21–48 trolling data of EU individuals, 22 must decide whether to use or disclose documents containing that data to a tribunal (be it as a part of the party’s written submission, evidence requested by the tribunal, or in any other form); or perhaps that data is to be disclosed to the opposing party from a different jurisdiction so that a suitable justification for transferring that data would be required. In dealing with these issues in international arbitration, the parties should keep in mind the complex data protection environment created by the GDPR, which consists of a combination of prohibitions, limitations and data protection standards in which each layer is important for legitimate cross-border data transfer [Paisley K., 2018: 854–855]. The general rule provided by the GDPR is based on prohibition of data transfer outside the EEA, except for a limited number of circumstances in which it is expressly permitted. 23 In fact, a list of those limited occasions (or grounds) established by the GDPR may be divided into general restric - tions 24 and specific derogations [Paisley K., 2018: 878–881]. 25 In addition, the GDPR establishes the specific requirement to adhere to the data protec - tion standards irrespective of the justification employed for data transfer. 26 The list of grounds that make cross-border data transfer permissible is provided in Articles 45–49 of the GDPR. The method for applying these grounds follows the so-called “cascade principle” [Paisley K., 2018: 878], meaning that each ground for data transfer is to be analyzed one by one and each one applied only if the preceding one was found not suitable. The first group of grounds for cross-border data transfer contains gen - eral restrictions and is at the top of this hierarchy. It contains two require - ments: first, there should be what is termed an adequacy decision; and, second, appropriate safeguards should be applied (the first of these two re - quirements takes precedence over the second). Therefore, transfer of data to a third country which has an adequacy decision from the EU Commission holds the first rank in the overall hier - archy of grounds for permitting cross-border data transfer . 27 An adequacy decision in favor of a country means that the EU Commission, after scru - 22 Ibid. Art. 2. 23 Ibid. Art. 45. 24 Ibid. Art. 45–47. 25 Ibid. Art. 49. 26 Ibid. Art. 44. 27 Ibid. Art. 45. 30 Articles tinizing a country’s legislation concerning data protection, has concluded that the regulations adopted in that country offer the same level of com - mitment to data protection as that established within the EEA. 28 As the EU Commission has noted, if an adequacy decision is in place with respect to certain country, then data transfer to that country does not require any further safeguard. 29 In practice, however, reliance on adequacy decisions has several drawbacks (especially for arbitration). First, adequacy decisions have at present been issued to relatively few countries, 30 which means coverage by adequacy decisions may often be in - complete when many jurisdictions are involved in data exchange. As al - ready mentioned, arbitration often involves various jurisdictions in which data may be transmitted in the course of arbitration proceedings, and it may be difficult (if not impossible) to create an environment fully covered by adequacy decisions. Second, having an adequacy decision is not a permanent guarantee: in fact, even after an adequacy decision in favor of a certain country has been made, that decision may be rescinded if the actual operation of its data protection system is found to be unsatisfactory. 31 One of the most striking examples of reconsideration of data transfer regimes based on adequacy decisions is in a series of cases recently considered by the Court of Justice of the European Union (hereinafter CJEU) pertaining to invalidation of the data protection regimes agreed to between the EU and the USA (i.e. the U.S.-EU Safe Harbor Framework and the EU-US Privacy Shield regime). 32 28 Handbook on European Data Protection Law,,.European Union Agency for Fun - damental Rights and Council of Europe. Luxembourg, 2018 (hereinafter Handbook on European Data Protection Law), p. 254. 29 EU Commission website. Available at: https://ec.europa.eu/info/law/law-topic/data- protection/international-dimension-data-protection/adequacy-decisions_en (accessed: 14.04.2021) 30 The list of the countries that have adequacy decisions is available on the EU Com - mission website and includes: Andorra, Argentina, Canada (as concerns commercial orga - nizations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Swit - zerland and Uruguay. Available at: https://ec.europa.eu/info/law/law-topic/data-protection/ international-dimension-data-protection/adequacy-decisions_en (accessed: 04.05.2021) I t should be noted separately that until 16 July 2020 the adequacy decision regulat - ing transfer of data between the EU and the USA was in effect (although it had limited scope). Available at: https://ec.europa.eu/info/news/joint-press-statement-european- commissioner-justice-didier-reynders-and-us-secretary-commerce-wilbur-ross-7-au - gust-2020-2020-aug-07_en (accessed: 04.05.2021) 31 Handbook on European Data Protection Law, p. 189. 32 For more details see the press release of the EU Commission, “EU Commission and United States agree on new framework for transatlantic data flows: EU-US Privacy Shield”. 31 Elena Mazetova. Data Protection Regulation and International Arbitration...  . 21–48 The first case ( Maximilian Schrems v Data Protection Commissioner {“Schrems I”]), 33 was considered before the GDPR had been issued. Never - theless, analysis of adequacy decisions provided there may also be relevant to post-GDPR practice. In this decision the CJEU invalidated the EU-US Safe Harbor regime, 34 and proclaimed that: [A] decision…by which the Commission finds that a third country ensures an adequate level of protection, does not prevent a supervisory authority of a Member State,…, from examining the claim of a person concerning the protection of his rights and freedoms in regard to the processing of personal data relating to him which has been transferred from a Member State to that third country when that person contends that the law and practices in force in the third country do not ensure an adequate level of protection. 35 This decision had a far-reaching impact and led to a revision of data security standards between the EU and the USA. In particular, the EU-US Safe Harbor regime was reconsidered [Graham N., Mehta T., 2015] and replaced by the EU-US Privacy Shield. 36 The second case ( Data Protection Commissioner v Facebook Ireland Lim - ited and Maximillian Schrems [“Schrems II”]) 37 resulted in the invalida - tion of the EU-US Privacy Shield specifically because USA domestic law granted rights of access to private data for USA public authorities; this meant that the necessary data protection could not be ensured. 38 The EU Available at: https://ec.europa.eu/commission/presscorner/detail/en/IP_16_216 (accessed: 22.04.2021); and the press release of the Court of Justice of the European Union, No 91/20. 16.07.2020. Available at: https://curia.europa.eu/jcms/upload/docs/application/pdf/2020- 07/cp200091en.pdf (accessed: 22.04.2021) 33 See the Judgment of the CJEU (Grand Chamber) of dated 06.10.October 2015 in Case C362/14 ( hereinafter Case C - 362 / 14). 34 In accordance with the “safe harbor” regime, US companies were able to self-certi - fy their compliance with the agreed data protection requirements, which would simplify transfer of data from the EEA to those companies (See: EU Commission Memo/00/47 dated 27 July 2000. How will the ‘safe harbor’ arrangement for personal data transfers to the US work? Available at: https://ec.europa.eu/commission/presscorner/detail/en/ MEMO_00_47 (accessed: 04.05.2021) 35 See Case C-362/14, para 66. 36 EU Commission press release. EU Commission and United States agree on new framework for transatlantic data flows: EU-US Privacy Shield. 02.02.2016. Available at: https://ec.europa.eu/commission/presscorner/detail/en/IP_16_216 (accessed: 04.05.2021) 37 See Judgment of the CJEU (Grand Chamber) of 16. July 2020 in Case C - 311/18 (hereinafter Case C-311/18). 38 See Case C311/18, para 185. 32 Articles and USA have recently been in negotiations concerning a new regulatory regime which would be more in line with the principles and standards of the GDPR. 39 Until such a regulatory regime is agreed upon, companies may consider resorting to various other grounds for the transfer of data between the EU and USA, insofar as such grounds are available to them. These cases demonstrate that adequacy decisions cannot be considered as an entirely stable ground for cross-border data transfer (the EU-US Privacy Shield was in effect for only four years before it was also invalidated); and even if adequacy decisions are in place, they can hardly be relied upon in isolation from the actual data protection measures operating in a particular country. For the purpose of arbitration, both the poor geographical coverage of data protection decisions and the risk of a change in the status of an ad - equacy decision make this tool practically useless in international arbitra - tion and force the parties to continue making their own analysis of the data protection issues in each case. According to Art. 46 of the GDPR, transfer of data to a third country is allowed subject to the existence of “appropriate safeguards”, including en - forceable rights and legal remedies for the data subject. 40 The appropriate safeguards are specifically defined by the GDPR in a list that contains such instruments as binding corporate rules, 41 standard data protection clauses 42 and approved codes of conduct. 43 When applying these principles to justify data transfer in arbitration, it is important to keep in mind at least two spe - cific features attached to these instruments. First, almost no deviations from the established scope of commitments imposed on the entity that is handling data are allowed, as this scope is set by the EU Commission or supervisory authority acting in each EEA country. 44 The commitments established by these instruments may be regarded as 39 See Joint Press Statement by European Commissioner for Justice Didier Reynders and US. Secretary of Commerce Gina Raimondo. 25 March 2021. Available at: https:// ec.europa.eu/commission/presscorner/detail/en/STATEMENT_21_1443 (accessed: 21.04.2021) 40 See Art. 46 and Recital 108 of the GDPR. 41 Ibid. Art. 46 (2)(b) . 42 In accordance with the provisions of the GDPR ( Art. 46 (2)(c) and (d) of the GDPR) data controllers can choose between standard data protection clauses or “ad hoc” data pro - tection clauses. If ad hoc clauses are to be applied, they should be specifically approved by a competent authority. 43 Ibid. Art. 46(2)(e). 44 See Art. 46 (2)(a) of the GDPR. 33 Elena Mazetova. Data Protection Regulation and International Arbitration...  . 21–48 burdensome for the party receiving data 45 and inconvenient for international arbitration, especially in cases where the data recipient’s “interaction” with data does not constitute a long-term established practice, but is instead the result of being involved in a particular case (e.g. as an arbitrator dealing with documents provided by the parties). A similar approach and analogous dif - ficulties are also typical of the other types of appropriate safeguards. Second, each instance of application of any of the appropriate safe - guards requires a separate approval procedure, 46 which significantly com - plicates the overall compliance process and also leaves parties with almost no flexibility to arrive at terms that they are comfortable with themselves. Although employing these appropriate safeguards may seem a good solu - tion for international arbitration at first sight, 47 their detailed provisions, which are almost completely fixed, make this ground for cross-border data transfer diffic ult to employ [Rosenthal D., 2019: 830]. Application of derogations allowing data transfer in international arbitration Overview of derogations In a situation when neither adequacy decisions nor appropriate safe - guards can be applied, grounds from the second group (i.e. specific deroga - tions) are to be considered for cross-border data transfer. The list of dero - gations is provided by Art. 49 of the GDPR, and it describes exceptional situations in which data transfer is allowed without either an adequacy de - cision or appropriate safeguards being in place. In effect, derogations are next in line under the previously mentioned cascade principle for applying grounds. The cascade principle presupposes the superiority of adequacy decisions and appropriate safeguards over specific derogations. 48 An important consideration here is that, although application of Art. 49 of the GDPR allows cross-border transfer of data in exceptional situations, it does not negate the general obligation of a transferring party to comply with 45 Detailed obligations are provided in 2021/914: Commission Implementing Decision (EU) of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council. 46 See Art. 40, 42 and 47 of the GDPR. 47 The European Data Protection Board Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 25 May 2018 (hereinafter Guidelines on derogations), pp. 3-4. 48 Art. 49(1) of the GDPR. 34 Articles other requirements of the GDPR. 49 In particular, Art. 44 as well as Recital 101 of the GDPR stipulate that international data transfer is to be conducted “subject to the other provisions” of the GDPR and, what is even more impor - tant, require that “the level of protection of natural persons …should not be undermined”. 50 In contrast with data transfer performed under adequacy decisions or ap - propriate safeguards, resort to derogations is legitimate only if data trans - fer takes place occasionally and does not constitute a stable channel for data transmission. 51 This peculiarity makes derogations difficult to rely on in the ordinary course of international business; however, for international arbitra - tion this requirement is normally met. Even if company is a frequent partici - pant in arbitration or if these rules are applied to arbitral institutions (which constantly deal with data exchanged between parties and tribunals), each particular transfer of data within arbitration occurs on an ad hoc basis and can scarcely be regarded as continuous data transmission between the enti - ties (be they the disputing parties, the arbitrators or the arbitral institution). The list of available derogations is closed and includes the following situations that permit cross-border data transfer: 52 there is explicit consent to the proposed transfer; the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject’s request; the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person; the transfer is necessary for important reasons of public interest; the transfer is necessary for the establishment, exercise or defense of legal claims; the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent; 49 Guidelines on derogations, p. 3. 50 Recital 101 of the GDPR. A similar passage is in Art. 44 of the GDPR. 51 This requirement comes from the literal interpretation of the Recital 111 of the GDPR, which specifies that data transfer under derogations is possible “…where the trans - fer is occasional…” 52 Art. 49(1)(a)-(g) of the GDPR. 35 Elena Mazetova. Data Protection Regulation and International Arbitration...  . 21–48 the transfer is m ade from a register which is publicly available or avail - able to persons who can demonstrate legitimate interest in consulting it; the transfer serves the legitimate interests of the transferring party It is apparent that not all of the derogations listed above are applicable in principle to arbitration; however, some of them may seem to be particu - larly suitable for it. In particular, if cross-border data transfer is required within international arbitration proceedings, the following derogations may be pertinent: having explicit consent; data transfer necessary for the establishment, exercise or defense of legal claims; or data transfer based on legitimate interest [Paisley K., 2018: 881]. Each of these grounds has its own distinctive features, and they should be considered separately. Application of the explicit consent derogation in arbitration Because arbitration is by nature a consensual procedure, the explicit consent derogation provided by the GDPR may seem the most logical so - lution, but reliance on this ground in international arbitration may be dif - ficult in practice. The chief difficulties in resorting to this derogation arise from the GDPR requirements themselves. The general requirements for what constitutes a data subject’s consent and how it should be obtained in order to comply with the GDPR are es - tablished by Art. 4(11) and Art. 7 of the GDPR, as well as by clarifications in Recitals 32, 42 and 43 of the GDPR. In accordance with these rules data subject consent is to be freely given, specific, informed, and unambiguous. Compliance with these requirements in the context of arbitration will have its own peculiarities. In particular, arbitration may be concerned with different types of data (sometimes even in the course of a single proceeding or one cycle of data exchange). It may involve data about employees, con - tractors, customers, partners, etc. [Paisley K., 2018: 870]; and in each case compliance with the GDPR principles will require different actions. To cite one example, the transfer of an employee’s data within arbitration proceedings (which is presumably the most frequent kind of data processed by the parties) may diverge from as many as three of the four requirements established by the GDPR. It may be difficult to ensure sufficient specificity 53 53 In particular, Recital 39 of the GDPR states that the “specific purpose should be ex - plicit… and determined at the time of the collection of the personal data” . Therefore, it is questionable whether general language regarding possible data transfer for the purposes of arbitration will be sufficient to ensure compliance. 36 Articles and also c ompliance with the requirement of informed consent (especially when it comes to the analysis of consents obtained preemptively). 54 In par - ticular, a conflict may arise between the level of detail required for an ap - propriate consent and the expected level of confidentiality in arbitration. It is also important to note that the GDPR requires that the data subject be “informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards”, 55 which means that at the time when consent is received there should at least be an understanding regarding the scope of data importing jurisdictions. 56 Need - less to say, this requirement is difficult to comply with until the arbitration has commenced. At the same time, if data subject consent is obtained on a case-by-case basis through a separate statement referring to a specific dis - pute or even to a specific operation occurring in the course of proceedings, which would probably better meet the GDPR requirements, the principle of confidentiality of arbitration may be compromised [Paisley K., 2018: 908]. Furthermore, there may be an “imbalance of power” between the em - ployer and employee 57 that comes into conflict with the GDPR require - ment of “freely given consent” 58 (e.g. the quality of consent may hinge on whether an employee actually has an option to reject a clause in the agreement). 59 Another important consideration is that establishing the data subject’s consent as freely given in complex proceedings where each opera - tion constitutes a separate act of data processing (e.g. submission of docu - ments, consideration of witness statements, exchange of positions between the parties, writing an award etc.) [Paisley K., 2018: 845-846) requires that A s another example, the issue of specificity was taken up by the Commission Nationale de l’Informatique et des Libertés (CNIL), which is the French data protection authority. Its decision dated 21 January 2019 levied a fine of €50 million against Google LLC. One of the violations that Google was accused of was a lack of valid consent to data processing. In particular, the CNIL maintained that in order to consent to the privacy policy users had to give their consent not for specific purposes, but for all the processing operations. The CNIL position was that such consent was “neither specific nor unambiguous”. Available at: https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million- euros-against-google-llc (accessed: 15.04.2021) 54 The European Data Protection Board Guidelines 05/2020 on consent under Regula - tion 2016/679, version 1.1. dated 04 May 2020 (hereinafter Guidelines on consent), p. 7. 55 Art. 49(1)(a) of the GDPR. 56 Guidelines on consent, p.8. 57 Ibid. P. 9. 58 Ibid. P. 7. 59 Article 29 of Data Protection Working Party, Opinion 2/2017 on data processing at work. 8 June 2017, para 6.2, p. 23. 37 Elena Mazetova. Data Protection Regulation and International Arbitration...  . 21–48 the data subject have the option to consent to each operation separately or only to some subset of operations. 60 Application of this rule in arbitration will mean literally that a data sub - ject (who is normally not a party to arbitration but an employee of a party as in our example) should be provided both with information about each step of the arbitration proceedings and also should have a certain degree of influence over the procedure itself, which may lead to interference with such basic arbitration concepts as confidentiality and autonomy of the par - ties [Lew J.,, Mistelis L., Kroll M., 2003: 523]. This is just one specific example to show that resorting to the derogation based on the data subject’s consent is a more complex matter than it might initially seem. Furthermore, the stipulation in Article 7 of the GDPR that any consent given should be revocable at any time and that the data subject is to have the option to withdraw their consent in a manner which is as easy as giv - ing consent is important. Thus, it follows from the GDPR’s conditions for obtaining a data subject’s consent and using it (and the same conclusion has been emphasized by the European Data Protection Board) that properly obtained consent gives the data subject full control over the way their date is processed and even over whether it can be processed. 61 Although this approach is reasonable in the context of data protection, it may obstruct ef - ficient resolution of a dispute when it is applied to international arbitration. Finally, because the data subject’s consent is regarded as an exceptional rather than a standard ground for cross-border data transfer, there is a pre - sumption of heightened risk hanging over the data subject due to the lack of adequate (i.e. analogous to the GDPR) protections. 62 In these circum - stances the GDPR sets an even higher standard for the data subject’s aware - ness of potential risk, which is why consent to cross-border data transfer must be “explicit”. 63 This requirement presupposes expression of consent in a much clearer form, which also implies that more details concerning data processing operations are to be provided to the data subject. 64 Compliance with these requirements is essential to ensure that cross- border data transfer based on the data subject’s consent is lawful, and fail - 60 Recital 32 of the GDPR. 61 Guidelines on consent, p. 5. 62 Ibid., p. 20. 63 Art. 49(1)(a) of the GDPR. 64 Guidelines on consent, p. 20. 38 Articles ure to meet the requirements will incur a challenge to data transfer and significant fines. 65 Therefore, if a party chooses to collect the data subjects’ consents for transfer of their data outside the EEA, that party should make sure that the standards set by the GDPR are accurately met. This exercise is not easy in itself, and it becomes even more difficult for arbitration, as the requirements of the GDPR may come into conflict with the requirements and basic concepts that are peculiar to international arbitration. Application of the legal claims derogation One more ground for cross-border data transfer which may be em - ployed for the arbitration is provided by Art. 49(1)(e) of the GDPR. This provision states that transfer outside the EEA is allowed when “…necessary for the establishment, exercise or defence of legal claims”. Recital 111 of the GDPR further clarifies that the legal claims derogation covers a wide range of proceedings, “whether in a judicial procedure or whether in an administrative or any out-of-court procedure, including procedures before regulatory bodies.” The term “out-of-court procedure” implies that the legal claims derogation may also cover arbitration [Paisley K., 2018: 880]. Nevertheless, a party applying this derogation should take into ac - count that, in accordance with Art. 49(1)(e) of the GDPR, the lawfulness of cross-border data transfer in these cases will depend upon whether the data transfer is actually “necessary” — i.e. there must be compliance with what is termed the “necessity test”. 66 This test requires analysis of the data in question and of its relevance to the specific legal proceedings, 67 and thus it coheres with major principles of data protection that have been estab - lished elsewhere in the GDPR such as “purpose limitation” 68 and “data minimization”. 69 Application of the necessity test has several implications in practice. In particular, it restrains the data controller (which may be a party to a dispute 65 In accordance with Art. 83(5)(a) of the GDPR, the fine for a breach of “the basic principles for processing, including conditions for consent…” may be up to €20,000,000 EUR or up to 4 % of the total worldwide annual turnover of the breaching entity for the preceding financial year. 66 If Art. 49(1) of the GDPR is interpreted literally, the legal claims derogation would not be the only one subject to the necessity test. The same language is also used for the derogations provided by Articles 49(1)(b), (c), (d) and (f). (See Guidelines on derogations, p. 12). 67 Ibid., p. 12. 68 Art. 5(1)(b) of the GDPR. 69 Ibid. Art. 5(1)(c). 39 Elena Mazetova. Data Protection Regulation and International Arbitration...  . 21–48 submitted for arbitration) from transferring all the data that is potentially relevant to the legal proceedings 70 and requires limiting that data to what is directly related to the proceedings. 71 Depending on the stage in the arbi - tration proceedings, compliance with this rule may be challenging. When certain data, or a document containing that data, is specifically requested from a party, its relevance and necessity may be relatively easy to verify. However, when the data is included in a memorandum or any other pro - cedural document introduced by a party voluntarily, it may require a more careful and detailed explanation of the usage of the data in question. There are many practical recommendations that can help the transfer - ring party in complying with these rules (for instance, the party might con - sider the feasibility of transferring anonymized or pseudonymized data, etc.). 72 But it is important in any case for the transferring party to under - stand that applying this ground will mean managing both the risk of non- compliance with the GDPR requirements (if the party fails to confirm the relevance or necessity of the transferred data to a particular dispute) and also the risk of providing insufficient evidence to succeed in arbitration (if the party takes a conservative position concerning amount of data to transfer). This allocation of risks (or more precisely, assigning all risks to the transferring party) reveals another interesting peculiarity when the GDPR is applied to international arbitration. For example, a regulatory frame - work for arbitration may allow document production in principle [Born G., 2015: 186], while the decision on the relevance and necessity of certain documents will be taken by the tribunal (although with due consideration of positions of the parties). 73 A decision by the tribunal may contradict the party’s evaluation of the same matter and present the party with the 70 Guidelines on derogations, p. 12. 71 This principle is also highlighted by Article 29 Data Protection Working Party, Working Document 1/2009 on pre-trial discovery for cross border civil Litigation. 11 Feb - ruary 2009, p.10. 72 Guidelines on derogations, p. 12. 73 For example, Art. 3(7) of the International Bar Association Rules on Taking Evidence in International Arbitration (as adopted by a resolution of the IBA Council 29 May 2010), provides: “The Arbitral Tribunal may order the Party to whom such Request is addressed to produce any requested Document in its possession…”. A similar approach is followed by Art. 27(4) of the UNCITRAL Arbitration Rules (as revised in 2010) establishing that “the arbitral tribunal shall determine the admissibility, relevance, materiality and weight of the evidence offered”; as well as by the majority of arbitration rules (see for example: Art. 19.2 of SIAC Rules 2016; Art. 22.2 of HKIAC Rules 2018, Art. R-34(b) of AAA Commercial Arbitration Rules and Mediation Procedures, etc.). 40 Articles difficult choice of which requirements to comply with. Furthermore, the GDPR in Art. 48 establishes separate rules for transferring data in response to foreign judgements or decisions. This dichotomy within the GDPR itself points to another important issue that affects the legitimacy of cross-bor - der data transfer: the interplay between Art. 48 of the GDPR, and the legal claims derogation. Interplay between Art. 48 of the GDPR and the legal claims derogation Art. 48 of the GDPR refers to situations in which transfers or disclosures are not authorized by EU law . Parties should refrain from transferring data in response to a court judgment or decision of a third country if the judge - ment or decision requiring data transfer is not “based on an internation - al agreement…between the requesting third country and the Union or a Member State”. Art. 48 of the GDPR broadly characterizes the bodies that may issue such judgements as courts, tribunals and administrative authori - ties. This makes Art. 48 analogous to Art. 49(1)(e) of the GDPR, as it also would extend to arbitration. Art. 48 would then provide an answer the question about appropriate grounds for data transfer by specifying that the transfer is to be requested by a competent authority (which would be an arbitral tribunal for the pur - pose of this article) as well as outlining the requirements to be followed in these matters. The explication of GDPR Art. 48 provided in the “Guidelines on deroga - tions” states that requests for data transfer from bodies of the types permit - ted (for our purpose, arbitral tribunals) are not “in themselves legitimate grounds for data transfers”. 74 Whether cross-border data transfer in these cases is permissible depends on two factors: first, there must be an interna - tional agreement between the two countries (the country of the authority making the request and the country of the party making a disclosure); and second, there must be a level of data protection consistent with the GDPR. 75 In practice Art. 48 of the GDPR may provide the transferring party with two options for responding to a judgement or decision requiring data transfer outside the EEA depending on whether or not there is an agree - ment between the countries in question: 74 Guidelines on derogations, p. 5. 75 See Recital 115 of the GDPR. 41 Elena Mazetova. Data Protection Regulation and International Arbitration...  . 21–48 if there is an agreement between the European Union or the correspond - ing member state and the country of the requesting authority, refer the au - thority making the request to the procedure for international cooperation established by that agreement (e.g., mutual legal assistance treaties); 76 if there is no such agreement, find other grounds to justify data transfer among those that are offered by the GDPR, usually in Art. 49. 77 This solution follows from the official guidelines on GDPR application 78 and comes from Art. 48, which stipulates that it is to be applied “without prejudice to other grounds for transfer”. However, on closer examination and especially in employing this solution for arbitration, a number of ques - tions arise. First, it is well-known that international agreements on legal assistance between states do not common for arbitration [Paisley K., 2018: 875]. That lack may make it difficult to ascertain whether Art. 48 of the GDPR will be useful in arbitration (at least until appropriate international agreements between states come into play). However, even if we suppose that there are bilateral or multilateral treaties as envisaged by Art. 48 that pertain to arbi - tration, that will not automatically settle the issues in applying Art. 48. At a bare minimum, there would still be the question of how to determine the nationality of an arbitration proceeding, as this may be important in un - derstanding which specific international agreement to apply. For national courts and for administrative or investigative authorities, the jurisdictional link is immediately apparent; but for international arbitration the boundar - ies are blurred. This has become quite evident with the advent of the con - cept of delocalized arbitration, which presupposes that international arbi - tration is detached from any national legal system [Lew J., 2006: 179–204]. Although one possible solution could be reliance on the seat of the arbi - tration 79 by analogy with the approach most commonly taken to determine the nationality of an award under New York Convention on the Recogni - tion and Enforcement of Foreign Arbitral Awards (hereinafter New York 76 Guidelines on derogations, p. 5. 77 See Recital 115 of the GDPR; Guidelines on derogations, p.5. 78 Guidelines on derogations, p. 5. 79 It should be noted that even for purposes of enforcement, the seat of arbitration is not the only possible criterion. For instance, the wording in Art. I (1) of the New York Convention, suggests that the convention should be applied to “…arbitral awards made in the territory of a State other than the State where the recognition and enforcement of such awards are sought....”, as well as to “arbitral awards not considered as domestic awards in the State where their recognition and enforcement are sought.” 42 Articles Convention) [Lew J., Mistelis L., Kroll M., 2003: 700], this approach hard - ly seems compatible with the key purpose of data protection regulation, which is to defend data subjects’ rights from possible negative influence by the regulatory environment in the country to which the data is actually transmitted. 80 This purpose has little or no relevance to the seat of arbitra - tion. It should instead entail consideration of the national laws applicable to entities receiving the data (arbitrators, opposing parties, arbitral institu - tion, etc.). In practice this means that the application of data security stan - dards and grounds for data transmission in arbitration may be extremely fragmented. A second problem with the approach to application of Art. 48 of the GDPR suggested above is that it assumes in effect that the limitations of Art. 48 can always be overridden by the GDPR’s other provisions (such as the derogations offered by Art. 49). This is specifically pertinent to arbi - tration because there are often no international agreements to apply. The presumption would then be that it is always possible to find alternative grounds to justify cross-border data transfer. That regulatory strategy does not seem very logical because there is no clear reason for imposing a restriction that can be easily ignored by ap - plying another clause of the same regulation. We could perhaps use the “cascade principle” described earlier to settle this problem as well; however, that suggestion does not fully align with the general logic of the GDPR. We can think of several reasons that explain why adequacy decisions take pre - cedence over, say, the derogations that may be available. From the perspec - tive of a regulator, adequacy decisions should be the first recourse because the regulator will have been able to verify the security of data transmission in advance. The data transferring party should also see this approach as ac - ceptable because adequacy decisions release them from complying with the more complex and burdensome requirements of the GDPR. However, nei - ther of these lines of thinking can provide a definitive answer to the ques - tion concerning the relationship between Articles 48 and 49 of the GDPR. Until further explanations are provided by the regulatory authorities of the EU, the confusion will continue and leave the transferring party to wrestle with whether they can use other available grounds for the transfer of data (such as those provided by Art. 49) or should instead completely refuse the transfer. Refusing transfer would be consistent with a more conservative opinion about application of Art. 48. According to that position, Art. 48 may be 80 See Communication to the EU Parliament. 43 Elena Mazetova. Data Protection Regulation and International Arbitration...  . 21–48 viewed as restricting reliance on Art. 49(1)(e) of the GDPR only to legal claims pursuant to judgements or decisions which are in turn supported by international bilateral or multilateral agreements. 81 If this interpretation holds (again provided that there are no international agreements that ap - ply to international arbitration), then cross-border data transfer in arbitra - tion would be paralyzed in many ways because the legal claims derogation, which is currently the most suitable ground for transfer of data in interna - tional arbitration, would become difficult or almost impossible to apply. The plain language of Art. 48 of the GDPR also suggests that an inter - national agreement is required in order to enforce or recognize a decision or judgment on data transfer to a third country rather than to substitute for or supplement the other grounds for cross-border data transfer provided by the GDPR. As further clarified by Recital 115 of the GDPR, the pur - pose of this limitation is to preclude extraterritorial application of “laws, regulations and other legal acts” of third countries, which may require data transfer but not provide data protection analogous to that required by the GDPR. 82 Such a literal interpretation of the GDPR’s provisions may suggest a third possibility for applying Art. 48 by maintaining that voluntary compliance with judgements and decisions on data transfer (when no enforcement procedures are involved) falls outside the scope of Art. 48, which would then be applicable only in the event that enforcement of a judgement or decision is required. However, following this interpretation for arbitration proceedings is questionable because even when data transfer is ordered by a tribunal (e.g. as a part of production of evidence ), that order has limited potential for enforcement. The main incentive to comply with the order would be to avoid adverse inferences that would be prejudicial to a party that refuses to comply with a disclosure order. As things currently stand, application of Art. 48 of the GDPR in inter - national arbitration is complicated by a number of factors, including lack of clarity about the exact circumstances in which it should be applied and lack of appropriate international treaties designed for international arbitration as well as the limited enforcement capacity of the tribunals’ orders. This 81 See the report by Ernst & Young. Practical considerations for cross-border discovery under the General Data Protection Regulation (GDPR). Available at: https://assets.ey.com/ content/dam/ey-sites/ey-com/en_gl/topics/assurance/assurance-pdfs/ey-forensics-e- discovery-practical-considerations-for-cross-border-discovery-under-gdpr.pdf (accessed: 14.04.2021) 82 Recital 11 of the GDPR. 44 Articles lack of clarity also brings into question the proper application and perti - nence of Art. 49(1)(e) of the GDPR for international arbitration. Application of the legitimate interest derogation The last resort for a derogation that permits data transfer in internation - al arbitration when none of the previously described grounds and deroga - tions can be applied is provided by Art. 49(1)§2 of the GDPR (i.e. the le - gitimate interest derogation). 83 In practice, this provision may be invoked, if not all the data that party is willing to transfer falls under the legal claims derogation (e.g. it may be difficult to establish direct relevance between the data in question and the arbitration proceedings) [Paisley K., 2018: 876]. In order to comply with Art. 49(1)§2 of the GDPR, the disclosing party should ensure compliance with the following conditions: data transfer is not repetitive; only a limited number of data subjects is concerned; data transfer is necessary for the purposes of “compelling legitimate in - terests pursued by the controller” and such interests “are not overridden by the interests or rights and freedoms of the data subject”; the controller has assessed all the circumstances surrounding the data transfer and has used that assessment to introduce suitable safeguards for protecting personal data. In addition to compliance with those requirements, a data controller relying on the legitimate interest derogation should also notify the supervi - sory authority of the transfer. 84 A comparison of this provision with Art. 49(1)(e) of the GDPR (the legal claims derogation) points up at least two complications peculiar to the legitimate interest derogation: first, the requirement to notify the su - pervisory authority during international arbitration could involve a breach of confidentiality; and second, there is a higher threshold for the necessity test that transferring party must meet. 85 In particular, the disclosing party resorting to Art. 49(1)§2 of the GDPR should be able not only to substantiate that the transfer is necessary, but also to demonstrate that this necessity is derived from “compelling legitimate 83 Guidelines on derogations, p. 14. 84 See §3 of Art. 49(1) of the GDPR. 85 Guidelines on derogations, p. 12. Elena Mazetova. Data Protection Regulation and International Arbitration... Р. 21–48 interests”. There is no direct answer at the moment about whether transfer of data for the purpose of participating in arbitration should be considered as a compelling legitimate interest or not. But the example suggested by the European Data Protection Board in this matter suggests that, in order to comply with the established standard, the disclosing party should be able to demonstrate that transfer of data was required as a protection “from serious immediate harm or from a severe penalty which would seriously affect…business”. 86 It follows that this ground may be applied in arbitration depending on the factual circumstances in arbitration that frame the cross-border data transfer and on the potential negative consequences incurred by failing to transfer. However, the issue of notification remains a substantial obstacle to ready reliance on this ground because confidentiality is a basic principle of arbitration, as has previously been mentioned. The foregoing analysis shows that all of the grounds on which a party can rely for justifying cross-border data transfer provide almost no solution that would suit international arbitration. Even resort to the legal claims and legitimate interest derogations does not provide the transferring party with full protection from claims and challenges related to non-compliance or improper compliance with the GDPR requirements; and, equally im - portant, neither of those rules take into account such distinctive features of arbitration as the requirement of confidentiality or the predominantly voluntary nature of arbitration. Conclusion International arbitration is now faced with data protection requirements (and in particular the GDPR) that allow nearly no acceptable or risk-free solutions, which would enable parties to meet all of the necessary require - ments. This is because the requirements have been formulated without taking into account industry specifics (for our purposes, the specific rules and principles that distinguish international arbitration from other types of procedures for dispute resolution). 87 Therefore, the incentive to comply may be significantly reduced, and diligent compliance may be supplanted by a formalistic exercise. 86 Ibid., p. 15. 87 It should be noted that some jurisdictions, e.g. the USA, historically follow “more of a fragmented and sector-specific approach” [Cooper D., Kuner C., 2017: 48]. Nevertheless, expansion of the digital environment and the huge increase in electronic data exchange largely blurs the differences in regulatory approaches. 46 Articles Although the specific requirements may differ from jurisdiction to ju - risdiction, it would be fair to say that regulators increasingly tend to gravi - tate toward a more stringent rather than a more relaxed approach to data protection (especially in the context of the cross-border data exchange). For instance, Russian regulation (which, along with the Chinese one, is frequently cited as a major antagonist to the GDPR) does not recognize legal claims derogation to legitimate cross-border data transfer and relies primarily on the data subject’s consent or adequacy decisions. 88 Some ju - risdictions also apply so-called “blocking statutes” that literally prohibit the transfer of data to foreign jurisdictions and apply criminal penalties to it. 89 Instances of data protection regulations that are nuanced and adaptive are very rare, if not completely absent. As data protection regulations penetrate almost every aspect of life and business, companies covered by those regulations become more inclined to “tick the right boxes” and find the most convenient ways to justify their practices rather than to protect the real interests of data subjects with due consideration of all relevant circumstances. This outcome has strayed far from the initial ideas that prompted data protection regulation and prob - ably neglects the interests of private data subjects themselves. In order to overcome this problem and to develop regulations which would be helpful in achieving the important task of private data protection, it is necessary to carefully consider all the industries and sectors that may 88 In accordance with Art. 12 of the Federal Law of the Russian Federation “On per - sonal data” No 152-FZ 27.07.2006, cross-border data transfer is allowed only subject to the following limited set of conditions: t he country to which the data is to be transferred provides adequate protection of personal data (such protection may be ensured either by the fact of being signatory to the Strasbourg Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, 28 January 1981, or by being added to a separate list of states with adequate data protections); t he data subject has provided his/her written consent; t he data transfer is provided for by an international treaty; t he data transfer is provided for by the relevant federal laws and is necessary to protect the Constitu - tion, to ensure the country’s defense and state security, as well as to ensure the security of the stable and safe functioning of the transport system; t he data transfer is required to ex - ecute a contract to which the data subject is a party; t he data transfer is necessary to protect the data subject’s rights and interests. 89 00339/09/EN WP 158: Working Document 1/2009 on pre-trial discovery for cross border civil litigation. 11 February 2009, p. 5. See for example, the French Statute № 68- 678 of 26 July 1968, modified by the French Statute No 80-538 of 16 July 1980; the Swiss Criminal Code; China State Secrecy Law; Australian Foreign Proceedings (Prohibition of Certain Evidence) Act 1979, etc. (for more details seethe Sedona Conference Framework for Analysis of Cross-Border Discovery Conflicts: a practical guide to navigating the com - peting currents of International Data Privacy and e-Discovery, 2008 Public Comment Ver - sion, 2008 the Sedona Conference, pp. 18–20). 47 Elena Mazetova. Data Protection Regulation and International Arbitration...  . 21–48 be affected by the data protection regulations and make sure that any such regulation is organically embedded into the existing ecosystems without unnecessarily subverting the principles peculiar to each of them. Building an effective defense for privacy should be the primary purpose. One possible solution that should be considered in order to reduce the current fragmentation (at least in matters of cross-border transfers) would be to arrive at suitable international conventions that would balance the regulatory concerns of different countries and provide all the stakeholders with greater predictability in data protection requirements. References Born G. (2021) International Commercial Arbitration . 3rd ed. The Hague: Kluw er Law International, 4250 p. Born G. (2014) International Commercial Arbitration . 2nd ed. The Hague: Kluwer Law International, 4000 p. Burianski M., Reindl M. (2010) Truth or dare? The conflict between e-discovery in international arbitration and German data protection rules. Schieds VZ: German Arbitration Journal, no 4, pp. 182–200. Cohen S. Morril M. (2017) A call to cyberarms: The international arbitra - tor’s duty to avoid digital intrusion. Fordham International Law Journal , no 3, pp. 957–1005. Cooper D., Kuner C. (2017) Data Protection Law and International Dis - pute Resolution. In: Collected Courses of the Hague Academy of Inter - national Law, vol. 382 Leiden/Boston: Hague Academy of International Law, pp. 9–174. Graham N., Mehta T. (2015) Safe Harbor in a storm: ECJ rules on data transfers to the US. Practical Law UK . Articles 3-619-7150. Available at: https://uk.practicallaw.thomsonreuters.com/3-619-7150?context Data=(sc.Default)&transitionType=Default&firstPage=true (accessed: 20.04.2021) Kuner C. (2013) Transborder Data Flows and Data Privacy. Oxford: Uni - versity Press, 285 p. Lew J., Mistelis L., Kroll M. (2003) Comparative International Commer cial Arbitration . The Hague: Kluwer Law International, 953 p. Lew J. (2006) Achieving the dream: Autonomous arbitration. Arbitration International, no 2, pp. 79–204. Maldoff G. (2016) White Paper, CIPP/US, IAPP Westin Fellow. The risk- based approach in the GDPR: Interpretation and implications. Available at: https://iapp.org/resources/article/the-risk-based-approach-in-the- gdpr-interpretation-and-implications/ (accessed: 20 .04.2021) Articles Paisley K. (2018) It’s all about the data: The impact of the EU General Data Protection Regulation on international arbitration. Fordham International Law Journal , n o 4, pp. 854–908. Pastore J. (2017) Practical approaches to cybersecurity in arbitration. Fordham International Law Journal , no 3, pp. 1023–1029. Rosenthal D. (2019) Complying with the General Data Protection Regula - tion (GDPR) in international arbitration — Practical guidance. Association Suisse de l’Arbitrage Bulletin , no 4, pp. 822–852. Schwarz E. (2018) Ernst & Young report. Practical considerations for cross-border discovery under the General Data Protection Regulation (GDPR). Available at: https://assets.ey.com/content/dam/ey-sites/ey- com/en_gl/topics/assurance/assurance-pdfs/ey-forensics-e-discov - ery-practical-consideration сц3у смма4ку4 s-for-cross-border-discov - ery-under-gdpr.pdf (accessed: 20.04.2021) Smeureanu I. (2011) Confidentiality in International Commercial Arbitra - tion. International Arbitration Law Library. Vol. 22. The Hague: Kluwer Law International, 232 p. Tschanz P.-Y. (2006) Switzerland: Confidentiality of Swiss Supreme Court review of arbitral awards. Available at: https://www.mondaq.com/Litiga - tion-Mediation-Arbitration/43062/Confidentiality-Of-Swiss-Supreme- Court-Review-Of-Arbitral-Awards (accessed: 20.04.2021) Warren S., Brandeis L. (1890) The right to privacy. Harvard Law Review , no 5, pp. 193–220.

---
Generated by overview.legal · https://overview.legal/posts/132548 · 2026-07-21