The free movement of personal data is already provided for in primary law [Tile I.16]. In the GDPR, it is anchored in a central position and stands as a regulatory objective on an equal footing with data protection:
Art. 1 I: “This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.”
Art. 1 III: “The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.”
The free movement of data is mentioned in numerous provisions of the GDPR:
Articles: 1 I/III, 4 Nr. 24, 35 VI, 51 I and 98 GDPR
Recitals: 3, 5, 6, 9, 10, 12, 13, 16, 19, 21, 53, 101, 112, 123, 166 and 170 GDPR
Different data protection regulations in the EU Member States are seen as a barrier to trade. The GDPR is intended to harmonise data protection law within the EU. This should not only serve to protect individual rights and freedoms, but also to reduce trade barriers, i.e. the cross-border movement of data and thus the internal market. The free movement of data is often referred to as the fifth fundamental freedom (alongside the free movement of goods, people, services and capital).
The free movement of data also plays a major role in international trade law. In addition, the GDPR also recognises other reasons that speak for the international exchange of data:
Rec. 112 (1): “Those derogations should in particular apply to data transfers required and necessary for important reasons of public interest, for example in cases of international data exchange between competition authorities, tax or customs administrations, between financial supervisory authorities, between services competent for social security matters, or for public health, for example in the case of contact tracing for contagious diseases or in order to reduce and/or eliminate doping in sport.”
The EU has also adopted a Regulation on a framework for the free flow of non-personal data (Free Flow of Data Regulation).