The Brussels effect is the process of unilateral regulatory globalisation caused by the European Union who de facto (but not necessarily de jure ) externalizes its laws outside its borders through market mechanisms. Through the Brussels effect, regulated entities, especially corporations, end up complying with EU laws even outside the EU for a variety of reasons. The effect is named after the city of Brussels, the de facto capital of the European Union, used as a metonym for the European Union.
The term Brussels effect was coined in 2012 by Professor Anu Bradford of Columbia Law School [1] [2] [3] and named after the similar California effect that can be seen within the United States. [4]
The combination of market size, market importance, [1] relatively stringent standards and regulatory capacity [5] of the European Union can have the effect that firms trading internationally find that it is not economically, legally or technically practical to maintain lower standards in non-EU markets. Non-EU companies exporting globally can find that it is beneficial to adopt standards set in Brussels uniformly throughout their business. [6] [7]
The California effect and the Brussels effect are a form of "race to the top" where the most stringent standard has an appeal to companies operating across multiple regulatory environments as it makes global production and exports easier. [8] [9] [10] The effects are the opposite of the Delaware effect, a race to the bottom where jurisdictions can purposefully choose to lower their regulatory requirements in an attempt to attract businesses looking for the least stringent standard. [11]
Scholars could so far not empirically verify the limits of the Brussels Effect in international law, especially World Trade Organization (WTO) law. [12] Furthermore, for the Brussels effect to occur, it was shown that not all prerequisites identified by Bradford have to occur cumulatively. [13] Research has indicated that the EU's regulatory power varies substantially depending on the context of the regulation involved. [14] [15]
The October 2000 $42 billion proposed acquisition of US-based Honeywell by US-based General Electric was blocked by the EU antitrust authorities on the grounds of risking a horizontal monopoly in jet engines. The merger could not proceed because, despite the American Department of Justice having already approved the merger between these two US-based entities, it was not legally possible to let the acquisition proceed in one important market, but not in another. [1] [16]
US-based multinational Dow Chemical announced in 2006 it would comply with the EU's Registration, Evaluation, Authorisation and Restriction of Chemicals (REACH) regulation for the production and use of chemical substances across its global operation. [1] [17] [18]
In 2012 the EU included aviation into its existing Emission Trading Scheme. This means that any airline, regardless of their country of origin, has to purchase emissions permits for any flights within the European Economic Area. [19] The cost of complying with EU aviation emission regulation puts pressure on manufacturers to design airplanes with improved efficiency and reduced emissions. As major airlines would not likely purchase airplanes specifically to fly outside the EEA, the EU's stricter aviation standards have an impact on global airplane fleets, regardless of the jurisdiction of the airline. [1] [20]
With the introduction of the Data Protection Directive in 1995 the EU had opted for a strict top-down approach to data privacy. [21] Its successor, the EU's General Data Protection Regulation (GDPR), was adopted on 14 April 2016 and had a global effect. [22] [23] In 2017, during negotiations for a new Japan-EU trade deal, Japan set up an independent agency to handle privacy complaints to conform with the EU's new privacy regulation. [24]
Facebook announced in April 2018 that it would implement parts of the GDPR globally. [25] [26] Sonos announced in April 2018 that it would implement the GDPR globally, [27] and Microsoft announced in May 2018 that it would implement GDPR compliance for all its customers globally. [28]
The Brussels effect can be observed in two regulatory frameworks that regulate the exploitation of natural resources, the Conflict Minerals Regulation and Country by Country Reporting Rules for payments to governments. [29] [ clarification needed ]
In October 2022 the European Parliament adopted a directive which required many consumer electronic devices – notably mobile phones – to adopt USB-C as a universal charger by 2024. [30] This was seen as being particularly applicable to Apple and its iPhone product range which had, until then, rejected standardisation. [31] The expectation was that, due to the EU's large marketplace, the EU-specific regulation would nonetheless result in a change in how products were manufactured for sale in other countries (to ensure a single global product), and that other jurisdictions would adopt equivalent legislation. [32]
The Data Protection Directive, officially Directive 95/46/EC, enacted in October 1995, was a European Union directive which regulated the processing of personal data within the European Union (EU) and the free movement of such data. The Data Protection Directive was an important component of EU privacy and human rights law.
Personal data, also known as personal information or personally identifiable information (PII), is any information related to an identifiable person.
Information privacy, data privacy or data protection laws provide a legal framework on how to obtain, use and store data of natural persons. The various laws around the world describe the rights of natural persons to control who is using their data. This includes usually the right to get details on which data is stored, for what purpose and to request the deletion in case the purpose is not given anymore.
A cybersecurity regulation comprises directives that safeguard information technology and computer systems with the purpose of forcing companies and organizations to protect their systems and information from cyberattacks like viruses, worms, Trojan horses, phishing, denial of service (DOS) attacks, unauthorized access and control system attacks. While cybersecurity regulations aim to minimize cyber risks and enhance protection, the uncertainty arising from frequent changes or new regulations can significantly impact organizational response strategies.
TrustArc Inc. is a privacy compliance technology company based in Walnut Creek, California. The company provides software and services to help corporations update their privacy management processes so they comply with government laws and best practices. Their privacy seal or certification of compliance can be used as a marketing tool.
Privacy law is a set of regulations that govern the collection, storage, and utilization of personal information from healthcare, governments, companies, public or private entities, or individuals.
The Chief Privacy Officer (CPO) is a senior level executive within a growing number of global corporations, public agencies and other organizations, responsible for managing risks related to information privacy laws and regulations. Variations on the role often carry titles such as "Privacy Officer," "Privacy Leader," and "Privacy Counsel." However, the role of CPO differs significantly from another similarly-titled role, the Data Protection Officer (DPO), a role mandated for some organizations under the GDPR, and the two roles should not be confused or conflated.
Pseudonymization is a data management and de-identification procedure by which personally identifiable information fields within a data record are replaced by one or more artificial identifiers, or pseudonyms. A single pseudonym for each replaced field or collection of replaced fields makes the data record less identifiable while remaining suitable for data analysis and data processing.
Data portability is a concept to protect users from having their data stored in "silos" or "walled gardens" that are incompatible with one another, i.e. closed platforms, thus subjecting them to vendor lock-in and making the creation of data backups or moving accounts between services difficult.
The General Data Protection Regulation, abbreviated GDPR, is a European Union regulation on information privacy in the European Union (EU) and the European Economic Area (EEA). The GDPR is an important component of EU privacy law and human rights law, in particular Article 8(1) of the Charter of Fundamental Rights of the European Union. It also governs the transfer of personal data outside the EU and EEA. The GDPR's goals are to enhance individuals' control and rights over their personal information and to simplify the regulations for international business. It supersedes the Data Protection Directive 95/46/EC and, among other things, simplifies the terminology.
The Transatlantic Trade and Investment Partnership (TTIP) was a proposed trade agreement between the European Union (EU) and the United States, with the aim of promoting trade and multilateral economic growth. According to Karel de Gucht, European Commissioner for Trade between 2010 and 2014, the TTIP would have been the largest bilateral trade initiative ever negotiated, not only because it would have involved the two largest economic areas in the world but also "because of its potential global reach in setting an example for future partners and agreements".
In the regulation of algorithms, particularly artificial intelligence and its subfield of machine learning, a right to explanation is a right to be given an explanation for an output of the algorithm. Such rights primarily refer to individual rights to be given an explanation for decisions that significantly affect an individual, particularly legally or financially. For example, a person who applies for a loan and is denied may ask for an explanation, which could be "Credit bureau X reports that you declared bankruptcy last year; this is the main factor in considering you too likely to default, and thus we will not give you the loan you applied for."
The ePrivacy Regulation (ePR) is a proposal for the regulation of various privacy-related topics, mostly in relation to electronic communications within the European Union. Its full name is "Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC ." It would repeal the Privacy and Electronic Communications Directive 2002 and would be lex specialis to the General Data Protection Regulation. It would particularise and complement the latter in respect of privacy-related topics. Key fields of the proposed regulation are the confidentiality of communications, privacy controls through electronic consent and browsers, and cookies.
NOYB – European Center for Digital Rights is a non-profit organization based in Vienna, Austria established in 2017 with a pan-European focus. Co-founded by Austrian lawyer and privacy activist Max Schrems, NOYB aims to launch strategic court cases and media initiatives in support of the General Data Protection Regulation (GDPR), the proposed ePrivacy Regulation, and information privacy in general. The organisation was established after a funding period during which it has raised annual donations of €250,000 by supporting members. Currently, NOYB is financed by more than 4,400 supporting members.
The gathering of personally identifiable information (PII) refers to the collection of public and private personal data that can be used to identify individuals for various purposes, both legal and illegal. PII gathering is often seen as a privacy threat by data owners, while entities such as technology companies, governments, and organizations utilize this data to analyze consumer behavior, political preferences, and personal interests.
A data protection officer (DPO) ensures, in an independent manner, that an organization applies the laws protecting individuals' personal data. The designation, position and tasks of a DPO within an organization are described in Articles 37, 38 and 39 of the European Union (EU) General Data Protection Regulation (GDPR). Many other countries require the appointment of a DPO, and it is becoming more prevalent in privacy legislation.
A data economy is a global digital ecosystem in which data is gathered, organized, and exchanged by a network of companies, individuals, and institutions to create economic value. The raw data is collected by a variety of factors, including search engines, social media websites, online vendors, brick and mortar vendors, payment gateways, software as a service (SaaS) purveyors, and an increasing number of firms deploying connected devices on the Internet of Things (IoT). Once collected, this data is typically passed on to individuals or firms, often for a fee. In the United States, the Consumer Financial Protection Bureau and other agencies have developed early models to regulate the data economy.
The right of access, also referred to as right to access and (data) subject access, is one of the most fundamental rights in data protection laws around the world. For instance, the United States, Singapore, Brazil, and countries in Europe have all developed laws that regulate access to personal data as privacy protection. The European Union states that: "The right of access occupies a central role in EU data protection law's arsenal of data subject empowerment measures." This right is often implemented as a Subject Access Request (SAR) or Data Subject Access Request (DSAR).
Anu H. Bradford is a Finnish-American author, law professor, and expert in international trade law. In 2014, she was named the Henry L. Moses Distinguished Professor of Law and International Organization at the Columbia Law School. She is the author of The Brussels Effect: How the European Union Rules the World. In 2024, she was awarded the Stein Rokkan Prize for Comparative Social Science Research for her book Digital Empires: The Global Battle to Regulate Technology.
The General Personal Data Protection Law, is a statutory law on data protection and privacy in the Federative Republic of Brazil. The law's primary aim is to unify 40 different Brazilian laws that regulate the processing of personal data. The LGPD contains provisions and requirements related to the processing of personal data of individuals, where the data is of individuals located in Brazil, where the data is collected or processed in Brazil, or where the data is used to offer goods or services to individuals in Brazil.
{{cite journal}}: Cite journal requires |journal= (help)