A Comparative Study of the Extraterritorial Enforcement of Data Protection Rules in the EU, US and Japan

Globalization and the Internet have dramatically increased the international transfer of data and information. Consequently, personal data protection has become crucial in such cross-border data transfers. Personal data collected in one’s home country but processed by foreign entities must be subjected to data protection. Such regulations and rules for the international transfer of personal data are usually carried out through the laws of each country. There are two types of data protection rules associated with the cross-border transfer of personal data: restriction of cross-border data transfers and extraterritorial application of data protection rules. This article focuses on the latter type of laws and discusses the relationship between law enforcement and sovereignty. It also provides an approach for improving the rules for extraterritorial enforcement in Japan, comparing it with analogous regulations from the EU and the US