The Final Frontier of Data Privacy: Servers in Space and at Sea

NOTE: Can be Privacy AND International

As data centers face increasing opposition on land, companies are exploring alternative locations for data infrastructure, including Earth’s orbit, the Moon, and the sea, which may also offer technical advantages, including, for example, the potential for more energy-efficient cooling. Each environment raises questions that privacy regimes probably never anticipated: when data is stored or processed beyond traditional national territory, do privacy laws still apply? If so, which laws apply? And can they effectively be enforced? Francesca Giannoni-Crystal of Crystal & Giannoni-Crystal, LLC, examines how the GDPR and U.S. state privacy laws may apply when processing occurs in orbit, on the Moon, at sea, or on the seabed. The discussion also covers the international law frameworks governing outer space and maritime areas, including the jurisdictional bases that apply depending on where and how data infrastructure is deployed. Under the GDPR, the analysis centers on the principal bases for application under Article 3. For U.S. state privacy laws, the focus turns to breach notification obligations and how applicability can depend on the residence of affected individuals rather than the location of the infrastructure. Enforcement is another matter, and the program explores the gap between prescriptive jurisdiction and enforcement jurisdiction. Attorneys will leave better equipped to identify when privacy regimes attach to unconventional data infrastructure and to raise compliance issues early, while a project is still on the drawing board.