The future of international data transfers: Managing legal risk with a ‘user-held’ data model

Paulius Jurcys, Marcelo Corrales Compagnucci, Mark Fenwick

Research output: Contribution to journalArticlepeer-review

1 Citation (Scopus)


The General Data Protection Regulation (GDPR) contains a blanket prohibition on the transfer of personal data outside of the European Economic Area (EEA) unless strict requirements are met. The rationale for this provision is to protect personal data and data subject rights by restricting data transfers to countries that may not have the same level of protection as the EEA. However, the ubiquitous and permeable character of new technologies such as cloud computing, and the increased inter-connectivity between societies, has made international data transfers the norm and not the exception. The Schrems II case and subsequent regulatory developments have further raised the bar for companies to comply with complex and, often, opaque rules. Many firms are, therefore, pursuing technology-based solutions in order to mitigate this new legal risk. These emerging technological alternatives reduce the need for open-ended cross-border transfers and the practical challenges and legal risk that such transfers create post-Schrems. This article examines one such alternative, namely a user-held data model. This approach takes advantage of ‘personal data clouds’ that allows data subjects to store their data locally and in a more decentralised manner, thus decreasing the need for cross-border transfers and offering end-users the possibility of greater control over their data.

Original languageEnglish
Article number105691
JournalComputer Law and Security Review
Publication statusPublished - Sept 2022

All Science Journal Classification (ASJC) codes

  • Business, Management and Accounting(all)
  • Computer Networks and Communications
  • Law


Dive into the research topics of 'The future of international data transfers: Managing legal risk with a ‘user-held’ data model'. Together they form a unique fingerprint.

Cite this