adequacy decision, but only after “80 rounds of negotiations played out over 300 hours” taking place between April 2016 and January 2019.<sup>228</sup> Only one country is currently being considered for an adequacy decision—the Republic of Korea.<sup>229</sup> An adequacy decision is not the exclusive means to transfer personal data outside the European Union. The GDPR permits a variety of mechanisms for cross-border transfer of personal data, from Standard Contractual Clauses and Binding Corporate Rules to newer possibilities for certifications and codes of conduct.<sup>230</sup> These mechanisms are likely to prove more realistic possibilities for developing countries than the hope for a favorable adequacy decision.

One possible alternative model might lie in the EU-US Privacy Shield, which was carefully negotiated between the United States and the European Commission to protect the privacy of European Union residents when their information is transferred to the United States. The Privacy Shield represents a kind of streamlined GDPR. Companies that certified that they would comply with the extensive set of rules set forth in the Privacy Shield were allowed to receive that data. Some 5,300 companies signed up, certifying compliance. On July 16, 2020, the Court of Justice of the European Union struck down the EU-US Privacy Shield on the ground that it did not provide sufficient legal rights to European residents to challenge U.S. foreign surveillance.<sup>231</sup> If that issue can be resolved (through, for example, extending legal rights to challenge surveillance to foreigners), the Privacy Shield might serve as a useful model for other nations to permit interoperability. Experts we spoke with affirmed that companies took compliance with the Privacy Shield seriously. While the Privacy Shield was designed to facilitate cross-border transfer of data from the European Union to the United States,<sup>232</sup> it represents a workable attempt to meet core European Union concerns with data privacy in a way that companies seem to manage. Its principles thus could well serve as a model for national privacy laws themselves. Companies seeking to comply with the Privacy Shield must (1) publish a privacy policy with certain specified information; (2) provide option to opt-out (opt-in for sensitive data) for disclosures to third parties or for uses for a materially different purpose than that for which the data was provided; (3) enter into contracts to protect data when sharing data with third parties or agents; (4) take reasonable and appropriate measures to protect security of data; (5) limit processing to authorized purposes; (6) provide rights to access, correct, amend, or delete; and (7) provide recourse for complaints.<sup>233</sup> In addition, companies must abide by 16 supplementary principles.

***

Getting data privacy law right is critical for every country in the twenty-first century. Our study shows that even the United States and the EU do not expend sums far outside the reach of many developing nations to enforce data privacy law. Indeed, the smallest European nations spend only halfa-million dollars annually for their data privacy authority. Furthermore, while costs of compliance for private businesses vary significantly, developing states could take steps such as relaxed mandates for small and medium-sized businesses, or ex post facto liability rules for negligent or intentional abuses

> 228 Martin Braun, Frederic Louis, Itsiq Benizri, _The European Commission Adopts Adequacy Decision On Japan,_ WilmerHale (Jan 24, 2019), <u>https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-andcybersecurity-law/20190124-the-european-commission-adopts-adequacy-decision-on-japan.</u>

> 229 https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-dataprotection/adequacy-decisions_en.

> 230 See GDPR, arts 44-49. Indeed, our survey respondents indicated that they rely principally on standard contractual clauses for cross-border data transfer from the EU. Privacy Survey, at 23.

> 231 _See_ Chander, _supra_ note 52.

> 232 Aaditya Mattoo & Joshua P. Meltzer, _International Data Flows and Privacy: The Conflict and Its Resolution_ , 21 23 J. INT’L EC. L. 769, 771 (2018) (“the EU–US Privacy Shield offers a way of resolving the conflict between regulatory heterogeneity and international data flows”).

> 233 Privacy Shield Framework, _Privacy Shield Overview_ , https://www.privacyshield.gov/program-overview.

41