Party Autonomy in Determining the Law Applicable to Non-contractual Obligations concerning Cross-Border Data Transfers
This work provides a legal solution for determining applicable law in cross-border data disputes, benefiting legal practitioners and parties involved in cloud computing services.
The paper addresses the challenge of determining the applicable law for non-contractual obligations arising from cross-border data transfers, where traditional location-based rules fail due to data distribution across multiple jurisdictions. It proposes using party autonomy to align the law for non-contractual obligations with the law chosen for the related contractual obligation, enhancing foreseeability.
(1)Cross-border data transfers have become a matter of daily occurrence against the backdrop of the development of cloud computing and artificial intelligence. Consequently, where a data leak gives rise to civil liability, the determination of that liability inevitably assumes an international dimension involving foreign elements. (2)As is starkly demonstrated by secret sharing technology in cloud computing, fragments of data may be presumed to be distributed across multiple jurisdictions on a global scale. This renders traditional private international law measures -- predicated on the identification of a physical location -- inadequate for the purposes of determining the applicable law, a difficulty that is particularly acute in relation to non-contractual obligations. (3)Bearing in mind the typical scenario encountered in practice -- in which a Data Subject brings a claim for damages against a SaaS (Software as a Service) provider, which in turn seeks recourse against an IaaS (Infrastructure as a Service) or PaaS (Platform as a Service) provider -- a characteristic feature of such cases is the concurrence of contractual and non-contractual obligations. Taking this feature into account, it is possible to determine the applicable law governing non-contractual obligations through party autonomy -- by aligning it with the law governing the contractual obligation as selected by the parties, an approach that may be termed private ordering. This serves to overcome the difficulties associated with the identification of a physical location and, at the same time, contributes to ensuring the foreseeability of the parties.