Cloud-based technologies, big data, statistical signal processing algorithms, and Artificial Intelligence (AI) technologies are expected to play an increasingly important role in the medical field. Big data and AI-technologies rely on the cloud for data storage as well as for computational power and thus need effective and robust legal frameworks for international data transfer. Because of inconsistent data protection regulations, this is not always simple to achieve as it can be illustrated in the United States (US)-European Union (EU) context. Due to the lack of general data protection law at the federal level, the US currently does not have a general ‘adequacy decision’ from the European Commission to enable EU-US cross-border data transfers without the need for additional data protection safeguards under the General Data Protection Regulation. As a fallback, a ‘limited adequacy’ decision was adopted in 2016 on the so-called ‘EU-US Privacy Shield Framework’. This framework protects the fundamental rights of natural persons in the EU and allows the free transfer of personal data to companies that are certified under the EU-US Privacy Shield. However, the EU-US Privacy Shield has been recently contested at the Court of Justice of the European Union (CJEU). This paper analyses the EU-US Privacy Shield Framework, the associated legal challenges, and how these might affect organisations deploying or implementing cloud-based medical technologies relying on cross-border data transfers from EU data subjects.
Timo Minssen, Professor of Law at the University of Copenhagen (UCPH), Founding Director of UCPH's Center for Advanced Studies in Biomedical Innovation Law (CeBIL). Claudia Seitz, Visiting Professor of Law at the University of Ghent, Faculty of Law and Criminology, Lecturer at the University of Basel, Faculty of Law, Center for Life Sciences Law (CLSL) and Lecturer at the University of Bonn, Faculty of Law, Centre for the Law of Life Sciences. Mateo Aboy, Senior Research Scholar at the LML (University of Cambridge, UK), affiliated Professor & Fellow at the CeBIL (University of Copenhagen), and Visiting Scholar at the Petrie-Flom Center (Harvard Law School). Marcelo Corrales Compagnucci, Post Doc, Center for Advanced Studies in Biomedical Innovation Law (CeBIL). For Correspondence: <mailto:timo.minssen@jur.ku.dk>. Acknowledgement: The research for this paper was supported by a Novo Nordisk Foundation grant for a scientifically independent Collaborative Research Program in Biomedical Innovation Law (grant agreement number NNF17SA0027784)
