Risk and Its Effect on Complying with International Privacy LawsTeaching Constitutional Law in the United Kingdom: A United States' Perpsective

• Author: Donald Lee Buresh, Ph.D., Esq.
• Position: Morgan State University
• Pages: 449-528

e Indonesian Journal of International & Comparative Law

ISSN: 2338-7602; E-ISSN: 2338-770X

http://www.ijil.org

© 2021 e Institute for Migrant Rights Press

I thank Profs. Robert Munro and Thomas Hemstock for their insights in helping me

in the course of this research. I also thank Prof. Amy Apostol and Dean Anthony

Haynes for their detail comments regarding cybersecurity and privacy. Finally,

I thank Leizza Alcantara for her thorough editing. The contributions of these

individuals have been invaluable.

risk and its EffECt on Complying

with intErnational privaCy laws

Donald Lee Buresh, Ph.D., Esq.

Morgan State University

Email: LoganSquareDon@sbcglobal.net

is study aimed to qualitatively examine whether, on an international level, compli-

ance risks were being adequately addressed by a comprehensive compliance private or

legal framework. e paper provided a historical background on global compliance, the

state of compliance in the United States, and General Data Protection Regulation im-

plementation compliance. e article employed a qualitative legal research methodology

that was both doctrinal and non-doctrinal, where the doctrinal research was theoretical,

while the non-doctrinal was empirical. e literature review examined the calculation

of risk factors, the types of risk factors, and the types of mitigation strategies. e treatise

outlined the General Data Protection Regulation, followed by a discussion of Costeja

González, Schrems I, and Schrems II cases. e study examined the data privacy laws of

various Latin American and Caribbean countries. Other countries’ privacy laws include

Canada, Australia, New Zealand, and the People’s Republic of China. As prescribed by

the European Commission, an adequate country was dened, and it was shown that

the United States is currently not an adequate country. e reason is likely because the

United States takes a sectoral approach to privacy and does not have a comprehensive

federal privacy law. e adequacy of the countries previously evaluated was discussed.

e paper concluded that to minimize compliance risk when dealing with personally

identiable information, it is in the best interest of a nation to pass and enforce a com-

prehensive privacy law similar to the General Data Protection Regulation.

Keywords: General Data Protection Regulation, Compliance Risk, Adequate Coun-

try, Risk Mitigation, Regulatory Compliance.

IX Indonesian Journal of International & Comparative Law 449-528 (October 2022)

450

Buresh

INTRODUCTION

e eect of a breach of condential or personal information can dev-

astate an organization. e legal landscape is littered with companies

victimizing computer hackers, typically intending to steal condential

or personally identiable information for prot or just because they

can.1 Even when an organization has tried to protect valuable infor-

mation, the federal government and foreign governments can and has

imposed draconian restrictions on corporate behavior aer a breach,

such as demanding that entities adhere to stringent compliance re-

quirements for as long as 20 years.2 us, these situations are the basis

for this compliance risk analysis and mitigation strategies that attempt

to alleviate them.

is introductory section is broken up into three subsections.

e rst subsection states the problem under consideration. e

second subsection expresses the research question by listing the null

hypothesis that on an international level, compliance risks are not

being adequately addressed by a comprehensive compliance private or

legal framework, whereas the alternative hypothesis posits that on an

international level, compliance risks are being adequately addressed by

using comprehensive private or legal frameworks. e nal subsection

denes four terms used throughout this essay: compliance, compliance

risk, mitigation strategy, and compliance framework.

A. Statement of the Problem

is treatise aimed to examine, on an international level, whether

compliance risks are being adequately addressed by a comprehensive

1. Donald L. Buresh, e Solar Winds Cyber-Attack, the Federal and Private Sector

Response, and the Recommendations and Lessons Learned, 4 I. J.  I. S.

R.  R. 10, 3469-79 (Oct. 2022), available at http://journalijisr.com/issue/

solar-winds-cyber-attack-federal-and-private-sector-response-and-recommendations-

and-lessons; Donald L. Buresh, e Everalbum, Inc. Case, or How the Federal Trade

Commission Protected Consumer Rights Regarding the Collection, Use, Storage,

Dissemination, and Destruction of Facial Recognition Data, 4 I. J.  S. S.

 H. R. , - (Oct. ), DOI: 10.47191/ijsshr/v4-i10-38; Donald

L. Buresh, e Application of the Federal Trade Commission Privacy and Safeguards

Rules to the In the Matter of Tax Slayer, L.L.C. Case, 4 I. J.  S. S.  H.

R/ 9, 2512-20 (Sep. 2021), DOI: 10.47191/ijsshr/v4-i9-33.

2. Id.

451

Risks and Its Eects on Complying with International Privacy Laws

Buresh

compliance private or legal framework. e research aimed to investigate

whether there is a signicant dierence in mitigation strategies used

by dierent countries. A qualitative examination was required because

compliance risks and the frameworks employed vary extensively and

are challenging to assess quantitatively. What was evident from a study

of the literature review was that this perspective is novel and worthy of

investigation.

B. Research Question

e research question guiding this study is: On an international

level, whether compliance risks are being adequately addressed by a

comprehensive compliance private or legal framework? e data were

analyzed to explore the following hypotheses:

H0: On an international level, compliance risks are not being

adequately addressed by a comprehensive compliance private

or legal framework.

H1: On an international level, compliance risks are being

adequately addressed by a comprehensive compliance private

or legal framework.

e procedures used in this paper were qualitative, where the

dierent compliance risks were specied, and various international

regulations and risk frameworks were analyzed to determine what

compliance risks were adequately covered.

C. Denition of Terms

e four critical terms dened herein include compliance, compliance

risk, mitigation strategy, and compliance framework.

Compliance. According to the Merriam-Webster Dictionary, compliance

is the “act or process of complying to a desire, demand, proposal, or

regimen or to coercion.”3 e Cambridge English Dictionary denes

compliance as “the act of obeying an order, rule, or request” or, in the

law, “the fact of obeying a particular law or rule, or of acting according to

3. Compliance, M-W D (n.d.), available at https://www.

merriam-webster.com/dictionary/compliance.