TITLE:
The Risk-Based Approach to Personal Data Protection and the Response of the International Trade Law
AUTHORS:
Yuhong Yan
KEYWORDS:
The Risk-Based Approach, The-Right-Based Approach, Personal Data Protection, “Necessary and Proportionate” Test, USMCA, WTO
JOURNAL NAME:
Beijing Law Review,
Vol.14 No.3,
September
11,
2023
ABSTRACT: Data processing and transferring activities by businesses often result in increased risks to the rights and freedoms of data subjects, whereas the prescriptive and right-based approach, the dominating approach employed by lawmakers, fails to protect personal data as expected due to its inherent defects in managing risks. Accordingly, the risk-based approach, which endows businesses to calibrate their obligations of protecting personal data in terms of risks to enhance compliance with the principles and rules of personal data protection law, is introduced to the national and regional legislation as well as the international trade law to better manage risks so as to enhance the effectiveness of personal data protection. This paper investigates the backgrounds, meanings, functions, and advantages of the risk-based approach to personal data protection, and its embodiments in the EU, US, and China legislation, as well as in the international trade law such as USMCA and WTO members’ consolidated negotiating texts produced in the Joint Statement Initiative on e-commerce. The paper then explores the mysterious and complicated “necessary and proportionate” test inherently contained in the risk-based approach, and whether data localization measures could pass such a test.