Business and personal lives are becoming increasingly globalized, and the lines between national and international activity can be hazy at best. This can be especially true in areas like technology that allow for communication and transactions to occur in real-time across borders. With technological and global expansion comes the risk associated with data breaches. Data breach risk has become apparent with events such as the Edward Snowden leak, and numerous data breaches at large, multinational corporations. In such situations, the public turns to the law to provide guidance and relief.
International Law, however, is wholly inadequate to deal with the technology and privacy issues as it relates individual rights. My rationale is threefold and is rooted in the main limitations of International Law generally.
First, under International Law, private rights don’t exist in the sense that we understand them to exist in U.S. or other domestic law regimes. It is not an individual who can sue another country for relief due to some wrong he or she has suffered. Rather, an individual must petition his or her government to bring an action on his or her behalf against the foreign country. This is hard to do in and of itself; even if one is able to get a case brought, he or she has no express right to any relief that is granted. The U.S. may elect to deliver any damages received to the individual, but in general it is the U.S.’s (or representative country’s) money to with as it pleases. This is a huge drawback from a plaintiff’s perspective. If an individual brings a case under International Law, it is unlikely that the individual will personally recover anything in the event the case is heard. Further, even if the case is heard under International Law and the country representing the plaintiff chooses to return any damages/monetary relief received directly to the plaintiff, there is still the major problem of getting decisions under international law to be enforced in the first place.
What good is a right without a remedy? Turns out not very good at all. Imagine you are a U.S. plaintiff suing a Russian business under international law. Let’s assume you have cleared the hurdle of filling suit. You have been awarded $1 million. But now the U.S. must seek to enforce this punishment against the Russian company. Under U.S. law, enforcement would be relatively easy. However, there’s a huge problem in International Law of actually enforcing international court decisions. So you may win the case, but be left with nothing but a judgment to show for it.
Finally, much of international law comes in the form of customary law, that is, law that only gains its force from its existence in “custom” over an unspecified period of time. If international privacy laws are created, it will take time for them to truly gain effect. Given the rapid change that occurs in the technology realm, it is almost impossible to imagine the development of international law regarding technology and privacy that can be customary. Even if there’s some customary agreement, it likely won’t be able to deal with the latest technology and privacy issues.
All that being said, talking about technological and privacy issues at an international level can be beneficial if only for the reason that it brings the issue to the forefront across the globe. This spurs discussion about more efficient potential solutions to these issues. So while I am of the opinion that international law itself is inadequate to deal with the privacy and technology issues of the modern world, I do think these are important issues that need to be solved in an internationally cooperative manner.
———————————————————————————————————————————-
Neil Patel is an editor on the Michigan Telecommunications and Technology Law Review, and a member of the University Michigan Law School class of 2016.