1. The Three Global Models

Model 1: EU - Whitelist / Adequacy Model - Strictest
Under GDPR Chapter V, you CANNOT transfer personal data outside EEA unless you have one of:

• Art 45 Adequacy Decision: EU says that country's law is essentially equivalent. Only 15 countries have it - US now has partial adequacy under Data Privacy Framework 2023.
• Art 46 Safeguards: Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), with Transfer Impact Assessment (TIA).
• Art 49 Derogation: Explicit consent, contract necessity - last resort.

Model 2: India - Blacklist / Negative List Model - Most Permissive
Under Section 16 DPDP Act 2023 read with Rule 15 DPDP Rules 2025: Personal data may be transferred outside India to any country or territory except those specifically restricted by Central Government through notification. Default is YES, unless blacklisted.

As of April 2026, no restricted list notified. So India permits cross-border flows broadly, unlike earlier Data Localisation drafts. BUT Rule 15 adds condition: You must meet requirements Central Govt may specify by general or special order regarding making data available to any Foreign State or entity under its control. This targets CLOUD Act type demands.

Plus sectoral localisation still exists: RBI requires payment data storage in India, IRDAI insurance data in India.

Model 3: US - No General Restriction, But Extraterritorial Access
US has no law restricting private company transferring data out. Instead it claims power to ACCESS data stored anywhere via CLOUD Act.

Conflict = EU says you can't send data to US without protection, US says you must give data stored in EU to US police.

2. Landmark Case Laws - You Must Know

CASE 1: The Foundation - Schrems I & Schrems II - Invalidating US Transfers

Schrems I - C-362/14, 2015: Safe Harbour Invalid
Austrian student Max Schrems filed complaint against Facebook Ireland transferring his data to US under Safe Harbour. CJEU held US mass surveillance under FISA 702 does not provide adequate protection and effective judicial remedy. Safe Harbour invalidated.

Schrems II - C-311/18 Data Protection Commissioner v Facebook Ireland & Schrems, 16 July 2020: Privacy Shield Invalid - MOST IMPORTANT CASE

Same complainant. After Safe Harbour, companies used Privacy Shield + SCCs.

CJEU Held:

1. Privacy Shield invalid - US law does not provide level of protection essentially equivalent to GDPR because surveillance under FISA 702 and EO 12333 is disproportionate and no actionable judicial remedy for EU citizens before US court. This invalidated transfer mechanism used by 5,300+ US companies.
2. SCCs valid but not enough alone - Data exporter must assess whether third country law impairs SCC protection and add supplementary measures like encryption.

Impact: Every company transferring EU data to US must now do TIA. Led to EDPB guidance: No grace period, transfers now illegal if relying on Privacy Shield.

Resulting Law: EU-US Data Privacy Framework adopted July 2023 giving new adequacy, but already challenged by NOYB as Schrems III.

CASE 2: Enforcement Cases - Fines Prove Extraterritoriality

a) Meta Platforms Ireland - DPC Ireland, 2023-05-12: €1.2 Billion
Largest GDPR fine ever. Meta relied on SCCs to transfer Facebook EU data to US after Schrems II without sufficient supplementary measures. DPC ordered suspension of transfers.

b) Clearview AI Cases - 2022-2024: €100M+ total
US facial recognition company scraped 30bn public photos, built biometric database including EU citizens. Claimed no EU establishment so GDPR doesn't apply.

Held: GDPR Art 3(2) applies - offering services to / monitoring people in EU.

• France CNIL 2022: €20M
• Italy Garante 2022: €20M + deletion order
• Greece 2023: €20M
• Netherlands AP 2024: €30.5M for illegal database
• UK ICO 2023: £7.5M
  Proves non-EU AI companies face direct enforcement.

c) Uber - Dutch DPA 2024: €290M for unlawful EU->US transfers of driver data without adequate safeguards.

CASE 3: The US Access Conflict - Microsoft Ireland Case

Microsoft Corp. v. United States, 2nd Circuit 2016, Supreme Court 2018

Facts: US DOJ got warrant under Stored Communications Act for emails stored in Dublin, Ireland datacenter for drug trafficking case. Microsoft refused, saying warrant doesn't reach outside US, MLAT should be used.

2nd Circuit: Held warrant under SCA does NOT reach data held outside US territorial borders. Government cannot compel disclosure of emails stored in Ireland.

Congressional Response: While appeal pending in Supreme Court, US Congress passed CLOUD Act March 2018 - Clarifying Lawful Overseas Use of Data Act.

CLOUD Act Sec 103: Provider must disclose data regardless of whether communication is located within or outside US, based on possession, control, custody.

Supreme Court then dismissed case as moot.

Principle: Territorial location of data is irrelevant. If US company controls it, US can compel it. Direct conflict with GDPR Art 48 - foreign government order not enforceable unless under MLAT.

This is why India added Rule 15 - to block Indian data fiduciaries from handing data to foreign state under CLOUD Act without govt permission.

CASE 4: AI Training Data Cases - Newest Frontier

Garante v. OpenAI - Italy March 2023
Garante banned ChatGPT for lack of legal basis for training on Italian personal data and no age verification. OpenAI had to add privacy notice, opt-out. Later fined €15M in 2024 for no legal basis + breach notification failure.

EDPB Opinion 2024 on AI Models: GDPR applies to AI model training - any model trained on EU personal data, regardless of location, must meet lawful basis and transfer rules.

CASE 5: Indian Pre-DPDP Case Law

Justice K.S. Puttaswamy v. Union of India (2017) 10 SCC 1 - Supreme Court declared privacy fundamental right under Art 21. Basis for DPDP Act.

RBI Payment Data Localisation Circular April 2018 - All payment system data must be stored in India only. Upheld in challenges. Foreign companies like Visa, Mastercard forced to localize.

5. How to Comply Today - Practical Framework

For a company in Noida serving EU customers:

1. Map: Where personal data goes? EU -> India? India -> US?
2. EU->India: Is India adequate? No. So need SCCs + TIA. Since India has no adequacy, assess if Indian Govt access under Sec 16 DPDP or IT Act 69A impairs protection.
3. India->Outside: Check blacklist notification under Sec 16. As of now none. But check RBI, SEBI, IRDAI sectoral rules. Plus check if foreign state request - need Govt approval under Rule 15.
4. US->India: If US parent demands Indian user data, you face CLOUD Act vs DPDP Rule 15 conflict. Need to refuse and notify Indian Govt.