Legal limitations on the transfer of personal data to third countries

Abstract

Although international data transfers are one of the main pillars of the global economy and are becoming increasingly important, there is no international legal framework for data protection. Different rules apply in different jurisdictions, which makes the lawful performance of cross-border data transfers a challenging task in practice. Further confusion arises from constantly changing requirements, for example, due to the invalidation of the EU-US Privacy Shield decision by the ECJ in its groundbreaking Schrems II judgment. This thesis aims to shed light on this complex topic. For this purpose, the current requirements regarding data transfers to third countries under the GDPR as well as the developments in recent years will be outlined before a concept for a long-term solution will be presented.