Regulatory Interoperability

After this lesson, the reader should understand:

• 01Identify the interoperability layers: identity, vocabulary, semantics.
• 02Handle conflicting obligations across jurisdictions.
• 03Explain why equivalence is a decision, not a computation.

Two regulators, one system

A system must satisfy two regimes whose obligations conflict. What does the artifact layer contribute?

It makes the conflict explicit and locatable — a named condition in one artifact against a named condition in another — rather than a dispute between two compliance teams reading two documents. The artifact layer does not resolve the conflict; resolution remains a political and legal act. What it changes is that the resolution can be recorded once and applied consistently. A real instance makes the point sharper. A cloud provider subject to United States law receives an order to disclose data it stores in Europe. The CLOUD Act lets US authorities compel a provider to produce data in its control regardless of where it is stored^[1]. The GDPR's Article 48 says that a foreign court's or authority's order to transfer personal data is recognised only where it rests on an international agreement^[2], such as a mutual legal assistance treaty. Expressed as artifacts, the conflict is two named conditions on the same action: 'disclose' is required by one and, absent an agreement, not authorised by the other. No evaluation resolves that. What the artifact layer gives the provider is a precise statement of where it stands, and an escalation to the people who can decide — counsel, and ultimately governments negotiating the agreement that would dissolve the conflict. Equivalence is the subtler case, and it shows why the framework calls it a decision^[3]. When the European Commission decides that a country's data protection is adequate, transfers to it may flow as if it were inside the Union. That decision is an act of authority, and it can be withdrawn: in 2020 the Court of Justice struck down the EU–US Privacy Shield in the Schrems II judgment^[4], and transfers that had been lawful the day before lost their basis overnight. An equivalence expressed as an artifact therefore needs everything any other authority needs — an issuer, a version, an effective period, and the ability to be revoked — because the one thing equivalence decisions reliably do is change. The strongest objection is that all this machinery entrenches fragmentation: the real fix is harmonisation, one rule for everyone. Harmonisation is real where it happens, but it is slow, partial, and often undesirable — regimes differ because societies weigh privacy, security, and commerce differently, and those differences are choices, not defects. Interoperability is how plural regimes coexist. Its limit is that mapping between legal concepts is lossy. 'Personal data' under the GDPR and 'personal information' under California's privacy law overlap heavily without being the same set^[5], and any mapping between them is itself an interpretation, which needs an owner and a version like every other.

• Who arbitrates conflicts between artifacts of different issuers?
• Can equivalence decisions themselves be expressed as artifacts?
• What is the minimum shared vocabulary for cross-border evaluation?
• If an equivalence decision can be struck down overnight, what should happen to decisions made in reliance on it?
• Who should own a mapping between two jurisdictions' definitions of the same concept?

No responses yet. Be the first to answer one of the questions above.

Map one obligation across two jurisdictions.

1. 01Express the obligation as conditions in both regimes.
2. 02Identify differences in definitions.
3. 03Identify any direct conflict.
4. 04Propose the resolution rule and who would issue it.
5. 05Find one case that falls inside one regime's definition and outside the other's.