Towards a global framework for cross-border data flows and privacy protection