Cross-border data flows in the digital economy : an analysis between the European Union General Data Protection Regulation and the Southern African Development Community Data Protection Model law

Abstract

Technology has enabled the transmission of personal data across multiple jurisdictions and data has become central to the emerging digital economy. Whilst this development provides an opportunity for greater economic integration and access to global markets, it also presents a new challenge in respect of the regulation of personal data which is still predominantly based on national laws with limited jurisdiction. Other regions such as the European Union (EU) have recently introduced regulatory interventions to address the challenges posed by cross border personal data transfers which are enabled by digital technologies, whilst also limiting the hindrance to free data flows. Despite this progress, other regulatory instruments such as the Southern African Development Community (SADC) data protection model law, which provides guidance to SADC member states, are no longer fit for purpose in light of the advancements in technology. Against this background the study will critically assess and compare the extraterritorial application of the EU General Data Protection Regulation against the SADC data protection law within the context of the growing digital economy. To this end, the study will analyse the objectives and key terminology of the GDPR together with the cross-border data flow provisions. The study will thereafter compare the GDPR provisions with the SADC model law on data protection, focusing on the corresponding cross-border data flow provisions. Pursuant to the above, the study will focus on determining the compatibility of the SADC model law provisions, vis-à-vis the GDPR provisions in order to make recommendations to bring the SADC model law on par with the GDPR which is hailed as international best practice.