When the Court of Justice of the European Union invalidated the EU–US Privacy Shield (Schrems II, 2020), it exposed the absence of any stable institutional structure for protecting personal data across borders. Against this backdrop, Eichenhofer (2021) proposed three pathways toward a Global Governance of Internet Privacy — substantive harmonization of US with EU data-protection standards, coordination of transnational data processing modeled on the EU's European Data Protection Board, and a mutual-assistance agreement for enforcement — while conceding that none was designed, and that harmonization is 'not particularly realistic'. The question concerns what later literature has done with that problem. Developments since 2021 — the 2023 EU–US Data Privacy Framework and its partial judicial validation in Latombe (2025, under appeal), the polycentric network governance (rule-making spread across many interacting centers rather than a single sovereign, as described in the political-science literature), the slow ratification of Convention 108+, and the trade-law interfacing of data flows — address adjacent slices but leave the core untouched: no work supplies the concrete legal instruments, institutional frameworks, and enforcement mechanisms the pathways require, a feasibility analysis engaging political resistance and divergent enforcement priorities, an effectiveness assessment, or a reasoned determination of whether such incremental cooperation suffices for genuine global governance or whether an additional comprehensive multilateral treaty regime is needed. The problem is formulated at its original generality, with the transatlantic case as primary example and extension to other third countries included.

Background

The legal problem this question grows out of is the clash between two regulatory cultures for personal data. The European Union (EU) protects privacy and data protection as fundamental rights (Articles 7 and 8 of the EU Charter of Fundamental Rights), implemented by the General Data Protection Regulation (GDPR), a comprehensive statute that restricts transfers of personal data to non-EU countries unless the destination ensures an 'essentially equivalent' level of protection — typically certified by a formal 'adequacy decision' of the European Commission. The United States, by contrast, regulates privacy sectorally and consumer-protection-style, with strong First Amendment speech protections and permissive national-security surveillance law. In Schrems II (Case C-311/18, 16 July 2020), the Court of Justice of the European Union invalidated the EU–US Privacy Shield, the second successive transatlantic transfer agreement, holding inter alia that US surveillance programs and the lack of an effective judicial remedy for EU data subjects did not meet the equivalence standard; the first such agreement (Safe Harbor) had fallen in Schrems I (2015).

Underneath the litigation lies a structural gap. Classical international law governs jurisdiction through territoriality (the Permanent Court of International Justice's 1927 Lotus judgment, which grounds a state's regulatory jurisdiction in its territory), yet data flows cross borders instantly, and neither the effect principle (jurisdiction over foreign conduct that produces effects at home) nor the protective principle (jurisdiction over foreign conduct threatening essential state interests) yields a settled rule allocating regulatory authority over data processing. No supranational data-protection authority exists; the global architecture consists of private technical self-regulation (e.g., the Internet Engineering Task Force, the standards body for Internet protocols, and the Internet Corporation for Assigned Names and Numbers (ICANN), which manages core Internet resources), a horizontal layer of international institutions operating mostly through soft law (non-binding instruments), and one binding regional treaty open to accession by non-members: the Council of Europe's Convention 108, whose modernized version (Convention 108+) had not gathered the ratifications needed to enter into force.

Eichenhofer's 2021 article in DuD (Datenschutz und Datensicherheit) took Schrems II as the occasion to describe this fragmented landscape through the lens of 'Global Governance' — the political-science concept of polycentric, network-like rule-making that integrates states, firms, and civil society rather than a single sovereign — and to sketch three pathways toward a Global Governance of Internet Privacy: (1) harmonization of US data-protection standards with EU standards, including implementation of privacy into technology ('privacy by design', meaning data-protection safeguards engineered into systems from the design stage rather than added later); (2) improved coordination of transnational data processing, modeled on the cooperation mechanism of the European Data Protection Board (EDPB, the body through which the EU's national data protection authorities jointly issue guidance and settle disputes); and (3) a bilateral mutual-assistance agreement for enforcement, analogous to mutual legal assistance treaties in criminal law (treaties by which authorities investigate and enforce on each other's behalf). The author presented these as 'milestones' rather than worked-out solutions, expressly calling the harmonization option 'not particularly realistic' because it would require the US to strongly regulate data processing and accept economic losses, and leaving open the concrete legal instruments, institutional frameworks, enforcement mechanisms, feasibility (including US tech-company resistance and divergent enforcement priorities between EU and US regulators), and effectiveness of the remaining options — as well as whether incremental cooperation of this kind can constitute genuine global governance at all, or whether an additional comprehensive multilateral treaty regime would be required — and how the analysis extends beyond the transatlantic example to other third countries.

Problem Statement

The problem, in the generality of the source, is to design and evaluate the institutional pathways from the currently fragmented, largely soft-law landscape toward a genuine Global Governance of Internet Privacy, taking transatlantic EU–US data flows as the primary example and extending to other third countries. The four parts below are jointly required, and none may be omitted. Specifically:

  1. For each of the three pathways proposed by Eichenhofer (2021) — (a) harmonization of US data-protection standards with EU standards, including implementation of privacy by design; (b) improved coordination of transnational data processing modeled on the EDPB cooperation mechanism; (c) a bilateral mutual-assistance agreement for enforcement, analogous to mutual legal assistance treaties in criminal law — specify the concrete legal instruments (legislation, bilateral or multilateral agreements, treaty provisions), institutional frameworks, and enforcement mechanisms that would make it operational, including how jurisdictional conflicts over transborder data processing would be resolved.
  2. Assess the feasibility of each pathway, engaging at least the obstacles Eichenhofer (2021) identifies or implies: the economic and constitutional cost of US regulatory rapprochement, political resistance from US technology companies, and the divergent enforcement priorities of EU data protection authorities and US regulators.
  3. Assess the effectiveness of each pathway against the objective of a genuine global governance structure for internet privacy — that is, whether the pathway could actually stabilize cross-border data protection rather than reproduce the ad hoc, judicially fragile compromises that collapsed in Schrems I and II.
  4. Determine, with reasons, whether the incremental pathways of coordination and bilateral mutual assistance are sufficient to constitute genuine global governance of internet privacy, or whether an additional comprehensive multilateral treaty regime — such as a binding multilateral data-protection treaty, a global data protection authority, or mandatory dispute resolution — is required; and identify how the analysis transfers beyond the transatlantic example to other third countries.

The determinations in parts 3 and 4 depend on what counts as genuine global governance of internet privacy and as effectiveness.

References

  1. Eichenhofer, J. (2021). Stand und Perspektiven einer Global Governance der Internet Privacy. Datenschutz und Datensicherheit – DuD, 45(3), 159–162. DOI: 10.1007/s11623-021-1410-9. https://doi.org/10.1007/s11623-021-1410-9
  2. Schmitz-Berndt, S. (2023). European Union ∙ EDPB Opinion on the European Commission's Draft Adequacy Decision regarding the EU-U.S. Data Privacy Framework: Is the Scene Set for Schrems III? European Data Protection Law Review, 9(1), 61–67. DOI: 10.21552/edpl/2023/1/11. https://doi.org/10.21552/edpl/2023/1/11
  3. Corrales Compagnucci, M. (2026). The EU–US Data Privacy Framework Upheld at First Instance: Latombe v Commission and the Limits of Adequacy Review. European Data Protection Law Review, 12(1), 132–137. DOI: 10.21552/edpl/2026/1/15. https://doi.org/10.21552/edpl/2026/1/15
  4. Jansen, R., & Reijneveld, M. (2022). Council of Europe ∙ Convention 108+, the GDPR, and Data Processing in the National Security Domain. European Data Protection Law Review, 8(3), 423–430. DOI: 10.21552/edpl/2022/3/14. https://doi.org/10.21552/edpl/2022/3/14
  5. de Terwangne, C. (2022). Privacy and data protection in Europe: Council of Europe's Convention 108 and the European Union's GDPR. In G. González, R. Van Brakel, & P. De Hert (Eds.), Research Handbook on Privacy and Data Protection Law (pp. 10–35). Cheltenham: Edward Elgar Publishing. DOI: 10.4337/9781786438515.00007. https://doi.org/10.4337/9781786438515.00007
  6. Burri, M. (2023). Cross-border data flows and privacy in global trade law: has trade trumped data protection? Oxford Review of Economic Policy, 39(1), 85–97. DOI: 10.1093/oxrep/grac042. https://doi.org/10.1093/oxrep/grac042
  7. Yakovleva, S. (2024). Cross-Border Data Flows. In Governing Cross-Border Data Flows in the Digital Economy: GDPR, Trade Agreements, and International Data Transfers. Oxford: Oxford University Press, pp. 1–26. DOI: 10.1093/oso/9780192899248.003.0001. https://doi.org/10.1093/oso/9780192899248.003.0001
  8. Yakovleva, S. (2024). Reconciling Data Privacy and Global Data Flows the EU Way. In Governing Cross-Border Data Flows in the Digital Economy: GDPR, Trade Agreements, and International Data Transfers. Oxford: Oxford University Press, pp. 187–252. DOI: 10.1093/oso/9780192899248.003.0004. https://doi.org/10.1093/oso/9780192899248.003.0004
  9. Medzini, R., & Epstein, D. (2024). Privacy Governance from a Polycentric Perspective. In Global Digital Data Governance. London: Routledge, pp. 165–183. DOI: 10.4324/9781003388418-12. https://doi.org/10.4324/9781003388418-12
  10. Liu, J. (2025). Ruling the Data Flows: Data Cognition in Global Cross-Border Data Flows Governance. Politics and Governance, 13, Article 10460. DOI: 10.17645/pag.10460. https://doi.org/10.17645/pag.10460
  11. Tropina, T. (2024). 'This is not a human rights convention!': the perils of overlooking human rights in the UN cybercrime treaty. Journal of Cyber Policy, 9(2), 200–220. DOI: 10.1080/23738871.2024.2419517. https://doi.org/10.1080/23738871.2024.2419517
  12. Kloza, D., & Mościbroda, A. (2014). Making the case for enhanced enforcement cooperation between data protection authorities: insights from competition law. International Data Privacy Law, 4(2), 120–138. DOI: 10.1093/idpl/ipu010. https://doi.org/10.1093/idpl/ipu010
  13. CJEU 16 July 2020 – C-311/18 EU-US Privacy Shield Agreement: Legality of Data Transfers to Non-EU Countries – Schrems II (case annotation). GRUR International, 70(3), 299–312 (2021). DOI: 10.1093/grurint/ikab012. https://doi.org/10.1093/grurint/ikab012