13 - International Trade Law and Data Ethics

Summary

Governments increasingly adopt various measures to achieve compliance with data ethics principles to reduce misuse of data-driven technologies and promote good digital and data governance. However, some of these measures restrict cross-border trade in digital technologies and services, thereby implicating various obligations contained in international trade agreements. This chapter investigates if international trade agreements (focusing on the General Agreement on Trade in Services (GATS) of the World Trade Organization (WTO)) provide sufficient policy space to governments to implement data ethics-related measures, despite their potential trade-restrictive impact. It argues that general exceptions (GATS art. XIV) can be interpreted in an evolutionary manner to cover several data ethics concerns. However, in doing so, WTO tribunals are likely to face uncertainties due to the regulatory diversity across countries. In particular, examining the core rationale underlying data ethics-related measures, determining their technological efficacy and identifying the least burdensome and trade-restrictive means to realise policy goals enshrined in data ethics frameworks remain highly challenging. In light of these uncertainties, this chapter recommends that the WTO must better accommodate evolving norms, standards and best practices on data ethics of other international institutions and relevant transnational and multistakeholder bodies.

I Introduction

The global economy is constantly being reshaped because of the rapid growth of data-driven services and technologies. The complementary relationship of big data analytics and artificial intelligence (AI)¹ holds the potential to generate significant economic and social benefits.² However, such data-driven services can also be misused by companies, governments and cyber-criminals in different ways, resulting in increased privacy and security breaches; disinformation campaigns; and biased algorithmic decision-making that disempower users of such technologies/services.³ These misuses often result because of deficiencies/loopholes in how data-driven services collect, process, transfer and share data, as well as the technical design of their algorithms or computer programs, thereby raising strong concerns regarding the ethics of data management and data-driven technologies. In response to these concerns, several governments and private initiatives have formulated data ethics frameworks that regulate data-driven technologies.⁴ Similarly, scholars have started evaluating how data ethics principles can act as a ‘moral compass’ in determining ‘good’ digital regulation and governance.⁵ Some governments have translated these ethical frameworks applicable to data-driven services and technologies into binding laws and regulations (or ‘data ethics-related measures’).

In some cases, data ethics-related measures can have a trade-restrictive impact. For instance, in order to protect personal privacy, governments could restrict the cross-border transfer and processing of personal data that could be burdensome and inefficient, especially for foreign companies. Governments may also demand mandatory access to vital technical information of companies such as the source code and algorithms of their data-driven technologies so as to ensure they are robust, fair and non-discriminatory. Further, as platforms increasingly use automated processes to moderate online content,⁶ governments might desire to scrutinise these algorithms to ensure compliance with domestic censorship laws. Such measures may be more burdensome for foreign companies, especially if they prejudice the safety and integrity of their proprietary technologies. Governments may also prescribe specific domestic standards for data-driven services, which may or may not be compatible with global standards.⁷ Such measures can interfere with the cross-border supply of digital services and technologies and thus act as trade barriers.⁸ However, to date, neither scholars nor policy experts have examined the interface of international trade law and data ethics. For instance, the World Trade Report 2018 of the World Trade Organization (WTO), which focused on AI, mentioned the word ‘ethics’ only once.⁹

Given these gaps in the existing literature, this chapter addresses whether international trade agreements, such as the WTO’s General Agreement on Trade in Services (GATS), provide sufficient policy space to governments to implement data ethics-related measures, despite their possible trade-restrictive effect. More specifically, this chapter explores the role of general exceptions in GATS (art. XIV) in delineating WTO members’¹⁰ policy space to implement data ethics-related measures. Section II discusses the key principles of data ethics common to various policy frameworks, including the protection of human rights; algorithmic accountability; and ethical design. Further, this section highlights examples of government measures intended to implement these data ethics principles, and if and when such measures have a trade-restrictive impact.

Section III examines the interface of international trade law and data ethics in light of the general exceptions in GATS art. XIV. This section argues that GATS art. XIV contains relevant defences for data ethics-related measures. For instance, members may argue that their measures are necessary to achieve compliance with domestic laws, including privacy laws (GATS art. XIV(c)(ii)) or to protect public morals or maintain public order (GATS art. XIV(a)). An evolutionary interpretation of GATS art. XIV can cover several data ethics concerns. However, regulatory diversity across countries and the evolving nature of data ethics frameworks set out a difficult test for assessing the limits of GATS art. XIV, especially examining the core rationale underlying data ethics-related measures, and identifying the least burdensome and trade-restrictive means to realise policy goals enshrined in data ethics frameworks.

Ultimately, applying international trade agreements to data ethics-related measures offers both possibilities and challenges. For instance, WTO panels¹¹ can meaningfully apply GATS art. XIV to accommodate data ethics principles within the WTO framework, including by referring to relevant private/transnational technical standards on data-driven services and international/multi-stakeholder norms on data ethics and governance. Similarly, using both technological and legal evidence, panels can apply the necessity test in GATS art. XIV to curtail protectionist measures that governments have disguised as being necessary for implementing data ethics principles. However, panels also face the challenge of balancing dynamic domestic and transnational interests related to ethical data governance. In order to better engage with these possibilities and challenges, this chapter recommends that the WTO should open itself to policy developments in data governance as well as remain abreast of technological advances, especially in the designing and verification of digital technologies and services.

II Implementing Data Ethics Principles and Their Trade Repercussions

Across the world, governments are developing frameworks and high-level principles on data ethics, particularly for AI-driven sectors.¹² Subsection A of this section discusses certain key principles common to these frameworks such as protection of human rights, including individual privacy; algorithmic accountability; and ethical design. It also provides examples of measures that governments impose when intending to realise these principles. Subsection B then highlights the potential trade-restrictive impact of certain data ethics-related measures.

A Key Principles of Data Ethics

The fundamental component of all data ethics frameworks is the protection of human rights.¹³ Several international and regional instruments highlight the importance of a human rights-centric approach in data governance.¹⁴ Similarly, individual governments specifically recognise the importance of protecting human rights in the use of data-driven technologies.¹⁵ The essence of a human rights-centric approach involves increasing individual control over personal data, and ensuring that all data is used, processed and shared in a manner compliant with fundamental human rights.

In this regard, the human rights-centric approach entails protecting individuals against discrimination, promoting digital access and inclusion, and safeguarding individual privacy.¹⁶ From the perspective of data ethics, privacy is essential at all stages of data management, from ensuring informed consent of individuals in the collection of their personal data to increasing human control over all aspects of data processing, including the choice not to be subject to profiling and automated decision-making. The emergence of big data analytics also raises concerns around group privacy (although it remains debatable if this falls within the scope of personal privacy).¹⁷ Unsurprisingly, various domestic laws and regulations now deal with privacy concerns, including data protection laws.¹⁸

Data-driven technologies can be used to breach human rights other than the right to privacy in various ways. For example, AI algorithms using training data with sensitive variables such as gender and race often generate biased outcomes or decisions that adversely affect the fundamental rights of minority groups.¹⁹ Big data analytics can be used to identify and then persecute political minorities or dissidents.²⁰ Further, governments increasingly use automated algorithms to filter content online, potentially harming the right to freedom of expression and access to information.²¹

A human rights-centric approach in data governance has implications for both governments and the private sector. For instance, governments are required to respect, protect and fulfil human rights²² by ensuring fair and non-discriminatory use of data-driven technologies for public functions; protecting individuals from potential harms and misuses of data-driven technologies by private sector entities, including enforcement of regulations requiring transparent and non-discriminatory data practices by private entities; and ensuring that private companies provide appropriate remedies to affected individuals. Governments may also require businesses to change specific practices in data management and processing to ensure compliance with a human rights-centric approach in data governance. However, the structural mechanisms by which governments hold the private sector accountable for complying with human rights norms may vary across countries. This difference is attributable to varying perceptions among countries regarding how human rights should be formulated and enforced domestically.

A human rights-centric approach in the governance of data-driven technologies necessitates algorithmic accountability. This means that companies should be held responsible for how their algorithms function, including the decisions taken using them. For instance, in AI-driven technologies, huge datasets (known as training data) are used for predictive analytics and generating decisions in various areas including healthcare, credit reporting, law enforcement, retail and marketing. Several experts argue that increasing algorithmic accountability requires data-driven technologies to be transparent and explainable (i.e. the computer programmers must be able to explain how their algorithms/designs use and process data to generate certain results).²³ This can facilitate rectifying algorithms that generate unfair or discriminatory outcomes.²⁴ Algorithms can be explained at a systemic level (i.e. the logic of an algorithm) or at an individual level (i.e. how the algorithm decides in a specific case),²⁵ although this distinction remains debatable.²⁶

Significant debate exists regarding the extent to which algorithms are or can be explainable and what regulatory mechanisms are needed to achieve the same. Certain experts argue that the transparency of source code/algorithms allows understanding the decision-making rule of the algorithms, but not their functionality in every random set of circumstances.²⁷ Therefore, they suggest that alternative technological mechanisms must be explored to achieve stronger algorithmic accountability such as verification programs that ex ante check if algorithms meet certain specifications (e.g. if they comply with the rule of law), and holding designers/technology companies accountable if and when a program fails to meet those specifications.²⁸ Others argue that explainability can be achieved through transparency and adequate regulatory inspection of algorithms.²⁹ On a different note, some experts emphasise that policymakers must be concerned about how data scientists build their datasets and the possible deficiencies in that process rather than solely concentrating on algorithmic accountability.³⁰

While it is outside the scope of this chapter to explore these arguments in detail, the diversity of perspectives on algorithmic accountability, including transparency, leads to differing regulatory approaches across countries. This is important because governments are increasingly advocating that transparency and explainability of algorithms is a means to achieving accountability in data-driven technologies.³¹ However, certain governments also acknowledge the limitations of transparency and explainability mechanisms in ensuring algorithmic accountability.³² Separately, governments may be concerned about the potential trade-offs between transparency and accuracy of algorithms.

The General Data Protection Regulation (GDPR) of the European Union (EU) arguably incorporates important elements of data ethics.³³ GDPR arts 44 and 45 limit data transfers to outside the EU to ensure that all personal data of EU residents is processed according to the highest data protection standards. GDPR art. 12 imposes an obligation on the data controllers to provide concise, transparent, easily understandable and accessible information to individuals regarding how they use personal data, including the extent to which they may use or rely upon personal data for automated decision-making.³⁴ GDPR art. 22 provides an individual the right not to be subjected to a decision solely based on automated decision-making or profiling,³⁵ if such a decision has ‘legal effects’ or ‘significantly affects’ the concerned individuals. However, significant debate exists regarding whether GDPR art. 22 incorporates a right to explainability of algorithms, for instance, those used in AI technologies.³⁶

More recently, other domestic laws have started focusing on data ethics. For instance, the Digital Republic Act in France requires that all algorithmic decision-making by governments should be fully explainable.³⁷ In the USA, certain senators have proposed an Algorithmic Accountability Act, requiring companies to scrutinise their algorithms for potential risks and biases, thereby enabling greater algorithmic accountability.³⁸ Finally, certain regional trade agreements include provisions requiring the parties to adopt basic frameworks on data protection.³⁹ The recently concluded Digital Economy Partnership Agreement between New Zealand, Singapore and Chile includes a specific provision requiring the parties to endeavour to adopt ethical AI governance frameworks, although it only vaguely refers to ‘internationally recognised principles or guidelines’.⁴⁰

Another key element in data ethics is ethical design, which is an extension of a human rights-centric approach in data governance. In practice, ethical design requires that all suppliers of data-driven technologies devise and implement technical designs and standards compliant with human rights. For example, privacy-by-design and security-by-design measures require digital service suppliers to use digital technologies and implement corporate policies that, by default, ensure data privacy and security. This can be instrumental in protecting personal data and increasing trust in data-driven technologies. Further, as ethical design focuses on technologically robust solutions, it promotes more reliable and sustainable outcomes in comparison to prescriptive data localisation measures or mandatory use of indigenous technical standards. GDPR art. 25 requires all digital service suppliers in the EU to adopt EU data protection principles by design and by default.

In practice, however, implementing ethical design is difficult. This challenge arises as the appropriate standards and benchmarks in the digital sector remain controversial, both in terms of regulatory practices and industry practices. For instance, with respect to privacy, considerable debate exists regarding whether the GDPR should be considered a global standard.⁴¹ Similarly, technical standards developed by leading digital powers such as the USA and China are often market competitors, especially for AI-driven services.⁴² Further, while laws and regulations tend to be ambiguous in their meaning (e.g. what is personally identifiable information in a privacy law), engineering models are highly dependent on precision of definitions in designing robust and reliable technologies.⁴³

B Trade Implications of Data Ethics-Related Measures

As discussed in Section I, certain data ethics-related measures may be trade-restrictive as they hinder the cross-border supply of digital services, thereby breaching members’ obligations in WTO agreements. Some examples include: (i) restrictions on data processing or transfers; (ii) prescribing specific technical standards for digital services and products; and (iii) requiring digital technology providers to submit their algorithms, source code and other vital technical information for government scrutiny/audit.

Governments may impose restrictions on cross-border data flows/processing or even require local storage and processing of data in sensitive sectors, to safeguard individual privacy rights. Some data protection laws even restrict the use of personal data for profiling. In other cases, regulatory approvals may be required to process sensitive data outside of the borders of a country. These measures typically increase costs, especially for foreign companies, lacking local data storage or processing capabilities.⁴⁴ When the regulatory requirements for trans-border data transfers/processing are administered in an unfair or unreasonable manner, they may be inconsistent with domestic regulation provision in GATS art. VI. Further, data processing restrictions may affect the development and accuracy of AI technologies as they prevent data accumulation on a global scale, especially affecting foreign, multi-national suppliers. Such measures may be considered discriminatory against foreign services or service suppliers, potentially breaching national treatment obligation in GATS art. XVII. Under the GDPR, digital service suppliers in the EU face several restrictions in transferring and processing personal data of EU residents abroad (except for a select group of countries that the EU identifies as having an adequate framework of data protection).⁴⁵ This restriction on the transfer of personal data to non-EU countries may be inconsistent with the most favoured nation obligation in GATS art. II.

As data-driven services have become common, several governments have started prescribing domestic technical standards, especially in AI-related sectors. These technical standards may be imposed for a variety of reasons, including ensuring that digital technologies are robust and secure, thereby reducing the chances of misuse of data. In the future, governments may prescribe standards that they consider compliant with ethical design requirements. However, if such prescribed standards are incompatible with competitive global standards or extremely onerous to implement, they create barriers for foreign services and service suppliers. In such scenarios, domestic technical standards may violate disciplines on domestic regulation under GATS art. VI.

Requirements imposed on digital technology providers to submit their algorithms and source code for government scrutiny/audit could have an underlying data ethics rationale, but such measures could also be trade-restrictive.⁴⁶ For instance, such measures may restrict entry of foreign competitors in domestic markets, thereby breaching national treatment obligation contained in GATS art. XVII. Additionally, such measures can prejudice the security/reputation of global data operations of digital suppliers, thereby violating obligations on domestic regulation in GATS art. VI. For instance, governments can implement such measures unreasonably or unfairly to deliberately harm the commercial interests of foreign players, including sharing their vital technical information with domestic competitors.⁴⁷

Additionally, in rare scenarios, countries may implement extreme measures banning a certain kind of data-driven technology to prevent abuse of human rights. For example, given the potential dangers and abuses of facial recognition technology, a government could potentially ban commercial software facilitating facial recognition, especially from foreign companies. Such measures may be in conflict with obligations on market access and non-discrimination under GATS.

III Defending Data Ethics-Related Measures under GATS General Exception

Although data ethics-related measures can violate obligations contained in WTO treaties, governments can argue that they protect vital public interests, including protecting privacy and addressing other ethical concerns regarding the processing and sharing of data, under the general exceptions contained in GATS art. XIV. While a significant amount of scholarship has discussed the justification of privacy laws under GATS art. XIV(c)(ii),⁴⁸ the role of GATS art. XIV(a) (the public morals/public order exception) in facilitating other public interests related to data ethics such as protecting against discrimination, facilitating technical robustness and security of technologies, and ensuring appropriate online content moderation remains unexplored. Therefore, after highlighting the relevance of GATS art. XIV(c)(ii) and GATS art. XIV(a) in justifying data ethics-related measures in subsection A of this section, subsection B focuses on how GATS art. XIV(a) applies to data ethics-related measures. Finally, subsection C discusses the various possibilities and challenges involved in accommodating data ethics-related measures within the WTO/GATS framework.

This section argues that GATS art. XIV can play a role in preserving the policy space necessary for members to impose data ethics-related measures. For instance, under GATS art. XIV(c)(ii), members may argue that certain data ethics-related measures are necessary to achieve compliance with domestic laws, especially data protection/privacy laws. Similarly, under the public morals/public order exception in GATS art. XIV(a), panels have generally interpreted ‘public morals’ broadly in line with domestic values/culture; thus, data ethics-related measures can generally qualify under GATS art. XIV(a). However, to ensure a holistic assessment under GATS art. XIV, panels must adopt a cautious, well-reasoned and coherent standard of review in evaluating the necessity of data ethics-related measures under GATS art. XIV. This would entail panels considering both the possibility of accommodating data ethics principles within the GATS framework (e.g. through a meaningful interpretation and application of the exception) and the challenge of balancing (often conflicting) domestic and international perspectives on data governance (e.g. in conducting a holistic weighing and balancing test on the various regulatory means adopted to achieve a data ethics-related policy objective). The ability of the WTO to remain open to relevant policy and technological developments related to data-driven technologies (including relevant multi-stakeholder/transnational norms and standards) will be crucial in ensuring that the GATS framework can support genuine and legitimate data ethics-related measures.

A Applying General Exceptions to Justify Data Ethics-Related Measures

1 Relevance of GATS Art. XIV(c)(ii)

GATS art. XIV(c)(ii) is likely to be relevant in justifying data ethics-related measures aimed at protecting individual privacy. Under GATS XIV(c)(ii), a measure violating GATS obligations can be justified if: (a) it is implemented to secure compliance with domestic ‘laws and regulations’,⁴⁹ including those ‘relat[ing] to’ (ii) the protection of the privacy of individuals in relation to the processing and dissemination of personal data and the protection of confidentiality of individual records and accounts; (b) the above ‘laws and regulations’ are consistent with WTO law; and (c) the measure is necessary to secure compliance with these laws and regulations.⁵⁰

GATS art. XIV(c)(ii) can be interpreted in an evolutionary manner to cover privacy concerns.⁵¹ For instance, ‘protection of privacy of individuals’ in GATS art. XIV(c)(ii) could potentially cover measures preventing unauthorised online surveillance of individuals or indiscriminate use of personal data by companies without informed user content. Similarly, data processing outside one’s borders may be restricted to prohibit illegal third-party use of personal data. Under GATS art. XIV(c)(ii), members must also demonstrate that the domestic law the measure seeks to achieve compliance with should be consistent with WTO law. While privacy laws are not per se inconsistent with WTO law, certain elements such as discriminatory or ambiguous conditions for cross-border data transfers may violate WTO law.⁵² Group privacy concerns arguably do not fall under this exception as deidentified/anonymised data is not generally considered ‘personal data’, although this data can be used to discriminate against specific groups of individuals. These concerns are more likely to be addressed under GATS art. XIV(a), as discussed next.

2 Relevance of GATS Art. XIV(a)

When data ethics-related measures do not specifically relate to personal privacy or achieving compliance with other domestic laws, they are more likely to be justified under GATS art. XIV(a) that allows measures: (a) necessary to protect public morals or to maintain public order. The public order exception may be invoked only where a genuine and sufficiently serious threat is posed to one of the fundamental interests of society. Further, members may rely on GATS art. XIV(a) in addition to GATS art. XIV(c)(ii) in justifying their data ethics-related measures.

The terms ‘public morals’ and ‘public order’ are distinct. However, panels have generally taken the view that ‘to the extent that both concepts seek to protect largely similar values, some overlap may exist’.⁵³ ‘Public order’ is defined as ‘a genuine and sufficiently serious threat’ to ‘one of the fundamental interests of society’.⁵⁴ Public morals is an undefined term; therefore, panels could theoretically interpret public morals with reference to international norms or the domestic values/culture of the country or both. Although this conflict between international/universal values and domestic values remains debatable,⁵⁵ WTO tribunals have generally shown an inclination to consider local values in determining the meaning of ‘public morals’. In fact, in the US – Gambling dispute, the panel held that ‘public morals’ in GATS art. XIV(a) ‘denotes standards of right and wrong conduct maintained by or on behalf of a community or nation’, and such standards ‘can vary in time and space, depending upon a range of factors, including prevailing social, cultural, ethical and religious values’.⁵⁶

The WTO tribunals have generally applied GATS art. XIV(a) in a broad, flexible and evolutionary manner.⁵⁷ For instance, in China – Publications and Audiovisual Products, the Appellate Body (AB) held that censorship of printed and digital content fell within the scope of ‘public morals’ in GATS art. XIV(a).⁵⁸ In US – Gambling, ‘public morals’ was interpreted to cover public morals and public order concerns related to online gambling (including money laundering).⁵⁹ In EC – Seals, the AB held that the term ‘public morals’ covered animal welfare concerns.⁶⁰ In Brazil – Taxation, the panel held that a measure imposed to bridge the digital divide and promote social inclusion in Brazil fell within the scope of ‘public morals’.⁶¹ In Colombia – Textiles, the panel held that a domestic tariff intended to combat money laundering in Colombia fell within the scope of ‘public morals’.⁶²

Governments have significant freedom in deciding how to define and achieve public morality and public order. In EC – Seals, the panel identified two steps in assessing measures under the public morals exception: first, if the stated policy concern actually existed in the society and, second, if it fell within the scope of ‘public morals’.⁶³ However, in the same dispute, the AB held that it is not necessary for the tribunal to identify the existence of a specific risk to public morals⁶⁴ or identify the exact content of public morals at issue (thus implying that variations of public morals exist depending on the member’s values).⁶⁵ Further, members have the right to set different levels of protection to address identical moral concerns.⁶⁶ Arguably, a similar standard of review may apply when members impose measures necessary for maintaining public order. Although the requirement of a genuine and serious threat is a high threshold, members are likely to have sufficient discretion in determining the fundamental interest of their society. For instance, a member desiring to control the domestic internet activities of their residents could argue that restricting data transfers/processing is required for maintaining ‘public order’.

Given the flexible interpretation of GATS art. XIV(a), data ethics-related measures are likely to fall within the scope of this provision. First, governments could argue that algorithmic accountability and ethical design are important elements of domestic public policy such as protecting social order and protecting consumers from harm. Second, the adoption of a human rights-centric approach can be a defining element of a society’s public morals and constitute a fundamental public interest. For example, in order to protect minority groups from algorithmic discrimination, a government must be able to scrutinise the algorithms/source code, thereby qualifying under ‘public morals’ and ‘public order’. Third, privacy is considered to be a ‘moral’ issue in many societies because of its connection with socio-cultural and religious values.⁶⁷ For example, sexual preferences and religious affiliation are considered highly intimate information in many societies. Finally, certain governments may argue that their data ethics-related measures are connected to human rights recognised in international instruments and declarations of the international policy community on data governance.⁶⁸ While panels are unlikely to accept public morals or public order exception as a basis for enforcing international human rights,⁶⁹ they are likely to attempt to interpret GATS art. XIV(a) in a manner that respects human rights and international public policy.

B Applying the Public Morals/Public Order Exception to Data Ethics-Related Measures

If a data ethics-related measure qualifies under GATS art. XIV(a) or GATS art. XIV(c)(ii), the panel must examine its necessity to achieve the underlying policy objective under a ‘weighing and balancing test’. This subsection focuses on the necessity of data ethics-related measures to protect public morals or maintain public order in accordance with the ‘weighing and balancing test’.

The first step in this test is assessing the contribution of the measure to the policy objective under GATS art. XIV – that is, the nexus between the measure and the policy objective under GATS art. XIV⁷⁰ – for instance, by looking at the design, content, structure and expected operation of the data ethics-related measure.⁷¹ For example, if a member requires companies to provide their source code or algorithms to verify them for bias (e.g. discriminating against minorities) or other privacy loopholes (particularly, group privacy concerns), the panel will examine if this requirement contributes to protecting public morals or maintaining public order under GATS art. XIV(a). From a technological perspective, this assessment can be difficult as the efficacy of transparency/disclosure of algorithms and source code to understand the underlying logic and discriminatory outcomes in algorithmic decision-making remains debatable.⁷² For complex AI, such disclosure requirements can also be counterproductive; for example, in autonomous vehicles, requiring access to the algorithms could compromise the security of the digital technologies. As explainability of algorithms improves with technological developments (especially the development of explainable AI or XAI), panels can make better assessments by seeking additional expert technical evidence on relevant issues.

Similarly, questions may arise regarding whether restrictions on cross-border data flows contribute to achieving the key principles of data ethics. Several studies indicate that severe restrictions on data flows are generally ineffective in enhancing the privacy or security of data-driven technologies.⁷³ Similarly, locating data within one’s borders does not automatically increase control or access to data. To the contrary, such measures increase the possibility of unauthorised surveillance and violation of human rights as well as interfering with the development of a healthy and competitive domestic digital market, especially when few companies (potentially state-controlled) own all the domestic data centres. However, easy access to local data servers may facilitate easier regulatory enforcement (e.g. pursuing action against companies that fail to comply with data ethics-related measures).

To facilitate a higher standard of data ethics, members may impose domestic regulations requiring technology companies to comply with internationally recognised technical standards, or adopt designs that protect privacy and security by default and/or use certification mechanisms to verify compliance with these ethical design requirements.⁷⁴ In comparison to blatant cross-border data transfer restrictions, these requirements appear more effective in facilitating digital inclusion, preventing disinformation campaigns and ensuring technologically robust solutions. Therefore, such measures are more likely to contribute to protecting public morals and maintaining public order.

The next step under the weighing and balancing test is assessing the trade-restrictiveness of the data ethics-related measure; that is, the restrictive impact of the measure on international commerce.⁷⁵ This step involves an assessment not only of the sector affected directly by the measure but also other sectors. For example, as data-driven services are used across several industries, restrictions on cloud computing services (e.g. mandatory compliance with domestic technical standards or data/security certifications) can potentially impact several sectors.⁷⁶

Finally, in applying the weighing and balancing test, panels will take into account any alternative less trade-restrictive measures proposed by the complainant. The key factors examined are whether such alternatives are reasonably available to and feasible to implement.⁷⁷ Further, any proposed alternatives must achieve an equivalent level of protection of the stated policy objective as the imposed measure.⁷⁸ With regard to regulating certain aspects of the digital sector, self-regulatory (or market-driven) approaches may be more effective and efficient than highly prescriptive laws and regulations.⁷⁹ For example, rather than imposing specific technical standards, competitive standards developed by the industry in sectors such as AI are more likely to be transparent and secure. Similarly, instead of restricting data-driven technologies through unreasonable regulations on data processing, countries could recognise market-driven verification mechanisms that certify compliance with robust standards on ethical design.

Despite the growing popularity of these market-driven mechanisms, panels are likely to consider them as, at best, complementary measures rather than alternatives to prescriptive laws and regulations.⁸⁰ This is because countries may be concerned about the robustness of the representativeness of private/multi-stakeholder standards, especially when developed without sufficient government oversight.⁸¹ This would be the case even if the private/multi-stakeholder standards are robust and generally considered industry best practices. Further, verification/certification mechanisms could be very difficult and expensive for developing countries to adopt and monitor and thus not feasible. Therefore, at least in the current scenario, most market-driven or self-regulatory alternatives to data ethics-related measures are likely to fail to satisfy the threshold in GATS art. XIV. The same argument could also be made for technological mechanisms to ensure greater algorithmic accountability (as discussed in subsection A, Section II). In such cases, panels are likely to find more prescriptive measures such as mandatory disclosure of source code/algorithms compliant with GATS art. XIV.

If a trade-restrictive measure provisionally satisfies the necessity test under GATS art. XIV(a), it must further be consistent with the chapeau:

Subject to the requirement that such measures are not applied in a manner which would constitute a means of arbitrary or unjustifiable discrimination between countries where like conditions prevail, or a disguised restriction on international trade in services, nothing in this Agreement shall be construed to prevent the adoption or enforcement by any Member of measures.

The chapeau prevents members from abusing exceptions contained in the subsections of GATS art. XIV and ensures that members implement all measures in good faith.⁸² It requires an enquiry into the ‘design, architecture, and revealing structure of a measure’⁸³ to assess if the measure violates the GATS art. XIV chapeau in ‘its actual or expected application’.⁸⁴ For example, if a measure deliberately prohibits foreign service suppliers from obtaining licences or authorisations to provide their services on grounds that their algorithms or technical standards do not meet the adequate threshold (irrespective of the quality and robustness of the standard/algorithms), then it might be inconsistent with the GATS art. XIV chapeau. Another example of a potential violation is, when governments illegally share vital technical information regarding foreign digital technologies with domestic competitors, making it harder for foreign companies to compete in that market and further causing potential intellectual property losses.

C Data Ethics and International Trade Law: Possibilities and Challenges

The previous subsections indicate that although GATS art. XIV can justify data ethics-related measures, several questions remain unanswered regarding the extent to which GATS art. XIV provides sufficient policy space for members to impose data ethics-related measures. For instance, should panels place any limits in defining ‘public morals’ or ‘public order’ under GATS art. XIV(a) in accommodating data ethics concerns? Given the technological and policy uncertainty, what standard of review should panels adopt under GATS art. XIV in reviewing data ethics-related measures? Should panels be completely deferential to the risk assessment made by governments in relation to their data ethics-related measures or should they conduct a more substantive assessment? What tools should the panels use in this assessment? How will the growth of new technological mechanisms such as XAI or market-driven standards and verification mechanisms impact the assessment of data ethics-related measures under GATS art. XIV?

Data ethics-related measures are typically nuanced in nature. To understand these measures holistically, governments must focus on both their legal/policy implications and technological impact. Thus, in assessing data ethics-related measures under GATS, panels must follow a well-reasoned, cautious and coherent standard of review that looks at both the technological and legal evidence. However, given the limited technical expertise of panels, they should refrain from engaging in a de novo review of data ethics-related measures and cautiously use technical expert opinions.

In applying this standard of review, two routes are possible. First, in assessing whether certain data ethics-related measures relate to GATS art. XIV, panels can, in addition to considering local values and policy preferences of members, pay regard to developments in the international/multi-stakeholder policy community on data governance. This route is not entirely unrealistic given that data ethics issues implicate several transnational policy concerns and not just domestic concerns. Further, such an approach is also helpful given the critical role of multi-stakeholder institutions in promoting data ethics, as discussed in subsection A, Section II. In Brazil – Taxation, for instance, the panel considered not only the importance of the digital divide as a domestic policy objective within Brazil, but also discussed its relationship with the Millennium Development Goals.⁸⁵ However, this route is politically and legally challenging in circumstances where local values conflict with international/multi-stakeholder norms. WTO tribunals do not have the capacity or mandate to determine the appropriate data ethics frameworks for individual members. Therefore, if a country considers that certain international/multi-stakeholder norms are not aligned with its policy preferences, trade tribunals must not interfere, even when those international/multi-stakeholder norms can lead to better outcomes for data ethics. This limitation, however, may lead to scepticism towards the WTO; that is, the panels cannot make decisions that clearly support a human rights-centric approach in data governance.

The second route is adopting a more stringent weighing and balancing test in assessing data ethics-related measures under GATS art. XIV(a).⁸⁶ The necessity test can be effective in detecting discriminatory or unnecessarily trade-restrictive measures.⁸⁷ For example, looking at the technical aspect of the measure (i.e. inviting expert evidence on whether a data ethics-related measure is actually capable of achieving important policy goals) is less controversial than examining the moral elements of the measure, which often implicates sensitive political or cultural questions. This approach, however, does not necessarily allow panels to consider innovations in the digital sector such as the potential role of technological mechanisms in the verification of data-driven technologies. For instance, engineers and computer scientists designing data-driven services can build ex ante verification mechanisms that ensure that the program/algorithm meets the specifications in domestic laws and processes.⁸⁸ Panels are unlikely to consider such mechanisms as a viable less trade-restrictive alternative under GATS art. XIV, especially when the defendant governments do not consider them as effective as regulatory access to source code/algorithms. Similarly, panels are unlikely to consider strict scrutiny/audits of training data by the private companies themselves a fool-proof mechanism to ensure fair and transparent outcomes in algorithmic decision-making, especially when governments restrict automated decision-making in risky and sensitive sectors.⁸⁹ However, as such market-based, technological mechanisms become more fit-for-purpose and reliable, they could be considered as more viable and qualify as potential candidates as less trade-restrictive alternatives under GATS art. XIV. Such mechanisms are also likely to be considered credible if they are developed and implemented by the private sector in collaboration with regulatory bodies, especially for countries with sufficient resources to hold private companies accountable for their poor data ethics practices.⁹⁰

In the long run, the WTO needs to respond to the predominantly decentralised nature of data governance. For example, the WTO needs to adopt new rules and institutional mechanisms that allow collaboration between governments, technology companies and relevant multi-stakeholder or transnational organisations dealing with data governance. An important example in this regard is the development of technical standards on AI software by the private sector. Currently, GATS does not provide sufficient room for such standards for services.⁹¹ However, at domestic/regional levels, several governments are coordinating with the private sector on certain aspects of data governance such as development of AI standards. These multi-stakeholder mechanisms could eventually grow transnationally (especially among like-minded countries) and can be facilitated through WTO committees. Eventually, such a broad-based approach could ensure that the WTO plays a more meaningful role in promoting good global data ethics practices and robust digital technologies.

IV Conclusion

This chapter investigated whether the general exceptions in GATS provide adequate policy space to governments to impose data ethics-related measures. In evaluating data ethics-related measures under GATS art. XIV, panels can take into account both international norms and best practices as well as local values or socio-cultural preferences, especially if they are aligned with each other. This chapter also demonstrates that panels can adopt a well-reasoned, cautious and coherent standard of review in assessing the necessity of data ethics-related measures under GATS art. XIV by holistically looking at both legal and technological evidence in each step of the weighing and balancing test. However, the possibility of panels considering a wider range of private sector-driven or multi-stakeholder mechanisms as alternatives to prescriptive data ethics-related measures, especially new verification technologies and technical standards, currently remains limited. Therefore, moving forward, the WTO framework must better co-opt international/multi-stakeholder norms and standards applicable to data-driven services so as to remain more open and responsive to the dynamic policy developments in data governance.