Jurisdiction under public international law, that is, a State’s authority to make, apply or enforce law, has long been rooted in the Westphalian notion of a State having sovereign authority within its own physical territorial boundaries. The current socio-technological landscape has witnessed temporal and spatial shifts, which have changed how the States exercise jurisdiction.

Governments, companies and individuals are handling ever more digitised personal data, so it is increasingly important to ensure this data is protected. The EU, compared to most non-EU States, strongly advocates the importance of protecting personal data. EU data protection law is often considered the strictest and certainly the most influential in the world. There is an extraterritorial character to this law that throws into question traditional notions of public international law jurisdiction, wherein legislative authority is limited by territory.

Whereas EU data protection law reflects its being a fundamental right in the Union, the US’ information privacy laws are rooted in the marketplace. This research offers ways to approach transatlantic jurisdictional conflicts with the underlying goal of mitigating them. It explores how the EU’s characterisation of data protection as a fundamental right conditions how it may, does and should exercise extraterritorial jurisdiction.