In accordance with the European strategy for data, the European Union (EU) aims to enhance the free flow of data and increase trust in data sharing mechanisms within the internal market. This ambition, however, contrasts with the EU’s more ‘protective’ approach to the governance of cross-border data flows. The high standard of data protection in the EU has resulted in a number of restrictions on transfers of personal data outside the European Economic Area (EEA). This article explores whether and to what extent the data protection rationale impacts EU law-making on international transfers of protected non-personal data. To do so it establishes divergences and convergences between the legal design of cross-border data transfers under the General Data Protection Regulation (GDPR) and the Data Governance Act (DGA). It also critically engages with the phenomenon of GDPR mimesis, according to which new EU regulatory initiatives for technology and digital life imitate the regulatory system established by the GDPR. This article argues that EU rules on non-personal data transfers have some similarities with the GDPR international data transfers regime but that the resemblance should not be overstated. The article critically assesses GDPR mimesis as a new regulatory phenomenon and, paradoxically, provides reasons why it has benefits.
Keywords: General Data Protection Regulation | Data Governance Act | GDPR Mimesis | Non-Personal Data Transfers