Thesis title: L'applicazione extraterritoriale del GDPR tra diritto europeo e diritto internazionale
This research examines whether and to what extent the extraterritorial application of the General Data Protection Regulation (GDPR) can be justified under public international law. Having identified the limits that international law places on the exercise of extraterritorial jurisdiction, the study applies these limits to the GDPR, highlighting significant issues regarding its compatibility with international law. The central legal question that emerges is whether the European Union is acting in violation of international law by applying the GDPR extraterritorially, or whether such application can be justified on alternative normative grounds within the international legal framework.
To address this question, the research analyses the legislative practices of twelve non-EU states. The findings reveal that all of the examined jurisdictions have enacted domestic data protection laws with extraterritorial scope. This suggests a growing normative tendency among states to extend their jurisdiction over data protection beyond territorial boundaries. The study therefore assesses whether, despite its heterogeneity, this practice may acquire legal significance under international law, or whether it should be regarded as merely factual and non-normative.
The final part of the research focuses on the possible existence of opinio juris. The analysis shows that no state has formally objected to the extraterritorial application of the GDPR. Interpreted in light of the International Court of Justice's jurisprudence, this absence of protest may be viewed as acquiescence by states to the EU's extraterritorial claim. According to the claim-and-acquiescence theory of customary law formation, the convergence between such acquiescence and the progressive legislative alignment observed among states could contribute to the gradual emergence of a customary norm concerning the extraterritorial application of data protection laws.
While no consolidated customary norm can yet be identified, the results suggest a significant evolution in the general principles of international law regarding jurisdiction in the digital environment. An increasing number of states appear to recognise the legitimacy and necessity of extraterritorial data protection regimes. Consequently, the EU’s approach under the GDPR does not violate international law, but rather aligns with an emerging practice that contributes to the development of a new customary norm capable of addressing the specific challenges of the digital age.