Party Autonomy in Determining the Law Applicable to Non-contractual Obligations concerning Cross-Border Data Transfers

TL;DR

This paper explores how party autonomy can determine the applicable law for non-contractual obligations in cross-border data transfers, addressing jurisdictional challenges in cloud computing and AI contexts.

Contribution

It proposes aligning the law governing non-contractual obligations with the contractual law chosen by parties, enhancing legal certainty in complex digital environments.

Findings

Party autonomy can effectively determine applicable law in cross-border data liability cases.

Aligning non-contractual obligations with contractual law overcomes jurisdictional identification issues.

This approach improves foreseeability and legal certainty for parties involved in cross-border data transfers.

Abstract

(1)Cross-border data transfers have become a matter of daily occurrence against the backdrop of the development of cloud computing and artificial intelligence. Consequently, where a data leak gives rise to civil liability, the determination of that liability inevitably assumes an international dimension involving foreign elements. (2)As is starkly demonstrated by secret sharing technology in cloud computing, fragments of data may be presumed to be distributed across multiple jurisdictions on a global scale. This renders traditional private international law measures -- predicated on the identification of a physical location -- inadequate for the purposes of determining the applicable law, a difficulty that is particularly acute in relation to non-contractual obligations. (3)Bearing in mind the typical scenario encountered in practice -- in which a Data Subject brings a claim for damages against a SaaS (Software as a Service) provider, which in turn seeks recourse against an IaaS (Infrastructure as a Service) or PaaS (Platform as a Service) provider -- a characteristic feature of such cases is the concurrence of contractual and non-contractual obligations. Taking this feature into account, it is possible to determine the applicable law governing non-contractual obligations through party autonomy -- by aligning it with the law governing the contractual obligation as selected by the parties, an approach that may be termed private ordering. This serves to overcome the difficulties associated with the identification of a physical location and, at the same time, contributes to ensuring the foreseeability of the parties.