Hostname: page-component-78c5997874-lj6df Total loading time: 0 Render date: 2024-11-13T07:51:06.406Z Has data issue: false hasContentIssue false
  • English
  • Français

Applying WTO and FTA Disciplines to Data Localization Measures

Published online by Cambridge University Press:  03 September 2018

SUSANNAH HODSON Open the ORCID record for SUSANNAH HODSON [Opens in a new window]
SUSANNAH HODSON*
Affiliation:
Australian National University, Australia
*
Email: susannah.j.hodson@gmail.com.
Get access Rights & Permissions [Opens in a new window]

Abstract

The last decade has seen a proliferation of measures requiring data to be stored within national borders. Such restrictions, known as ‘data localization measures’, disrupt digital trade and run counter to the borderless reality of the internet. But the effectiveness of existing WTO rules to adequately discipline data localization measures remains inconclusive. In the absence of meaningful progress at the multilateral level, FTA negotiations are developing new models to address such barriers. This article compares how data localization measures would be disciplined under the General Agreement on Trade in Services (GATS) and the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) framework. It argues that the CPTPP represents a significant advance on the GATS and strikes an appropriate balance between facilitating businesses’ growing need to transfer and store data across national borders while preserving governments’ right to regulate in the public interest.

Type
Review Article
Information
World Trade Review , Volume 18 , Issue 4 , October 2019 , pp. 579 - 607
Copyright
Copyright © Susannah Hodson 2018 

Access options

Get access to the full version of this content by using one of the access options below. (Log in options will check for institutional or personal access. Content may require purchase if you do not have access.)

References

1 In its 2017 Information Economy Report, UNCTAD estimated that global e-commerce amounted to $25.3 trillion in 2015, 90% of which comprised business-to-business e-commerce and 10% of which comprised business-to-consumer sales. UNCTAD, ‘Information Economy Report 2017’ (2017) xiii, http://unctad.org/en/PublicationsLibrary/ier2017_en.pdf (accessed 5 March 2018).

2 Michael Mandel, ‘Data, Trade and Growth’, Progressive Policy Institute (Policy Brief, 24 April 2013), www.progressivepolicy.org/wp-content/uploads/2014/04/2014.04-Mandel_Data-Trade-and-Growth.pdf (accessed 5 March 2018).

3 While there is no universally accepted definition of ‘data localization’, this article interprets the term as measures which require certain data to be physically stored on servers or data centres within a country's territory.

4 Daniel Castro and Alan McQuinn, ‘Cross-Border Data Flows Enable Growth in All Industries’, Information Technology and Innovation Foundation (February 2009) 9.

5 Asia Cloud Computing Association, Cloud Readiness Index 2016 (2016) 14.

6 Neha Mishra, ‘Data Localisation Laws in a Digital World’ (4 December 2015) Public Sphere, 137, www.publicspherejournal.com/wp-content/uploads/2016/02/06.data_protection.pdf (accessed 5 March 2018).

7 Information Technology Industry Council Press Release, ‘Snapshot of Data Localisation Measures’ (19 January 2017), www.itic.org/public-policy/SnapshotofDataLocalizationMeasures1-19-2017.pdf (accessed 28 May 2018).

8 Australia has restrictions in place relating to personally identifiable health records and Canada has provincial restrictions relating to personal information. For an analysis of the data localization measures throughout the world, see Information Technology Industry Council Press Release, ‘Snapshot of Data Localisation Measures’ (29 July 2016), www.itic.org/public-policy/SnapshotofDataLocalizationMeasures7-29-2016.pdf (accessed 5 March 2018).

9 Nigel Cory, ‘Cross Border Data Flows: Where are the Barriers and What do They Cost?’, Information Technology and Innovation Foundation (1 May 2017), https://itif.org/publications/2017/05/01/cross-border-data-flows-where-are-barriers-and-what-do-they-cost (accessed 30 May 2018).

10 See James Fontanella-Khan, ‘Data Protection Ruled Out of EU-US Trade Talks’, Financial Times (5 November 2013). For a comparison of EU and US data protection laws, including the EU's new General Data Protection Regulation 2016/679 (May 2018), see DLA Piper ‘Data Protection Laws of the World: Full Handbook’ (1 June 2018), www.dlapiperdataprotection.com (accessed 3 June 2018).

11 Government Regulation 82/2012 (Indonesia). See also Arianto Patunru and Sjamsu Rahardja, ‘Trade Protectionism in Indonesia: Bad Times and Bad Policy’, Lowy Institute (May 2015).

12 Castro and McQuinn, ‘Cross-Border Data Flows Enable Growth in All Industries’, supra n. 4, 9.

13 Peng, Shin-Yi and Liu, Han-Wei, ‘The Legality of Data Residency Requirements: How Can the Trans-Pacific Partnership Help?’, 2 Journal of World Trade (2017) 183, 195Google Scholar.

14 Free Trade Agreement between the United States of America and the Republic of Korea, signed 30 June 2007 [2012] (entered into force 15 March 2012); Comprehensive and Progressive Agreement for Trans-Pacific Partnership, signed 8 March 2018 (not yet entered into force); Third Review of the Australia – Singapore Free Trade Agreement, signed 13 October 2016 [2017] (entered into force 1 December 2017).

15 Comprehensive and Progressive Agreement for Trans-Pacific Partnership, signed 8 March 2018 (not yet entered into force). The revised CPTPP incorporates the provisions of the original TPP (including the E-Commerce Chapter) mutatis mutandis except for a very limited number of provisions which have been suspended following the late withdrawal by the United States. The TPP data provisions remain unchanged in the CPTPP text.

16 See, e.g., Chander, Anupam and Le, Uyen, ‘Data Nationalism’, 64 Emory Law Review (2015) 677Google Scholar; Peng and Liu, ‘The Legality of Data Residency Requirements’, supra n. 13; Tuthill, Lee, ‘Cross-Border Data Flows: What Role for Trade Rules?’, in Sauvé, Pierre and Roy, Martin (eds.), Research Handbook on Trade in Services (Elgar Online, 2016) 357Google Scholar; Mishra, ‘Data Localisation Laws in a Digital World’, supra n. 6; Selby, John, ‘Data Localization Laws: Trade Barriers or Legitimate Responses to Cybersecurity Risks, or Both?’, 25(3) International Journal of Law and Information Technology (2017) 213Google Scholar; Burri., Mira ‘The Regulation of Data Flows through Trade Agreements’, 48 Georgetown Journal of International Law (2017) 407Google Scholar.

17 The two WTO disputes which have considered the applicability of the GATS to internet services are: Panel Report, United States – Measures Affecting the Cross-Border Supply of Gambling and Betting Services, WT/DS285/R, adopted 10 November 2004, para. 6.287 (US–Gambling); Panel Report, China – Measures Affecting Trading Rights and Distribution Services for Certain Publications and Audiovisual Entertainment Products, WT/DS363/R, adopted 12 August 2009, para. 412 (China–Publications and Audiovisual Products).

18 Sacha Wunsch-Vincent, ‘WTO E-Commerce and Information Technologies: From the Uruguay Round through the Doha Development Agenda: A Report for the UN IDT Task Force’, Markle Foundation (2005) 47–51, www.iie.com/publications/papers/wunsch1104.pdf (accessed 5 March 2018).

19 WTO, ‘Declaration on Electronic Commerce’, WT/MIN(98)/DEC/2, adopted 20 May 1998.

20 Wunsch-Vincent, ‘WTO E-Commerce and Information Technologies’, supra n. 18, 10.

21 WTO, ‘Declaration on Electronic Commerce’, WT/MIN(98)/DEC/2, adopted 20 May 1998.

22 Wunsch-Vincent, ‘WTO E-Commerce and Information Technologies’, supra n. 18, 319–320.

23 Work Programme on Electronic Commerce, Non-Paper from the United States, JOB/GC/94, circulated 4 July 2016; Work Programme on Electronic Commerce, Non-Paper on Trade Policy, the WTO and the Digital Economy from Canada, Chile, Colombia, Côte d'Ivoire, the European Union, the Republic of Korea, Mexico, Paraguay, and Singapore, JOB/GC/97/Rev.1, circulated 22 July 2016; Work Programme on Electronic Commerce, Non-Paper from Brazil, JOB/GC/98, circulated 20 July 2016. See Marilia Maciel, ‘E-Commerce in the WTO: the Next Arena of Internet Policy Discussions?’, Diplomacy Blog (20 September 2016), www.diplomacy.edu/blog/e-commerce-wto-next-arena-internet-policy-discussions (accessed 5 March 2018).

24 See Maciel, ‘E-Commerce in the WTO’, supra n. 23. See also Dan Cooper, ‘Brazil Enacts Marco Civil Internet Civil Rights Bill’, Inside Privacy (28 April 2014), www.insideprivacy.com/international/brazil-enacts-marco-civil-internet-civil-rights-bill/ (accessed 5 March 2018).

25 Work Programme on E-Commerce, Statement by the Africa Group WT/MIN(17)/21, circulated 6 December 2017.

26 Given that data can be integrated into goods such as smartphones, the GATT is also relevant to disciplining data transfers; however, for expediency this article does not assess the possible application of other WTO agreements to data localization measures. Hosuk Lee-Makiyama advocates that the goods and services aspects of data transfers should be considered under a single horizontal framework. See Hosuk Lee-Makiyama, ‘Cross-Border Data Flows in the Post Bali Agenda’, in Simon Evenett and Alejandro Jara, Building on Bali (VOX ebook, 18 December 2013) 165.

27 Article 1.1 of the GATS.

28 While it is also arguable that internet services can fall within consumption abroad (‘mode 2’), in US–Gambling the Panel considered online gambling services fell within mode 1; Panel Report, US–Gambling, paras. 3.43, 6.415, 6.666.

29 Cory and Atkinson, ‘Financial Data does not Need or Deserve Special Treatment in Trade Agreements’, supra n. 9, 2.

30 See also Daniel Crosby, ‘Analysis of Data Localization Measures under WTO Services Trade Rules and Commitments’, E15 Initiative Policy Brief (March 2016) 2.

31 Panel Report, US–Gambling, para. 6.287.

32 Panel Report, US–Gambling, para. 6.285.

33 Ibid. para. 6.287. The Panel's reference to technological neutrality was not referred to by the Appellate Body in its review of this decision; Appellate Body Report, US– Gambling, WT/DS285/AB/R, adopted 7 April 2005.

34 Ibid. para. 6.285.

35 Ibid. para. 6.285 footnote 846.

36 Appellate Body Report, China–Publications and Audiovisual Products, paras. 408, 412.

37 Panel Report, US–Gambling, Annex E-1 Executive Summary of the Oral Statement of the United States at the Second Substantive Meeting, para. 3.

38 Panel Report, China–Certain Measures Affecting Electronic Payment Services, WT/T/DS413/R, adopted 16 July 2012, para. 7.182 (China–Electronic Payment Services).

39 Panel Report, China–Electronic Payment Services, para. 7.180. See also Crosby, ‘Analysis of Data Localization Measures under WTO Services Trade Rules and Commitments’, supra n. 30, 4.

40 Ibid. para. 7.184.

41 Ibid. para. 7.184.

42 Wu, Tim, ‘The World Trade Law of Internet Filtering’, 7 Chicago Journal of International Law (2006) 263, 281–282Google Scholar.

43 Lee-Makiyama, ‘Cross-Border Data Flows in the Post Bali Agenda’, supra n. 26, 165.

44 WTO, Work Programme on Electronic Commerce – Progress Report to the General Council, WT/GC/103, adopted 27 July 1999, 3.

45 Burri, Mira et al. , ‘The Protection and Promotion of Cultural Diversity in a Digital Networked Environment: Mapping Possible Advances to Coherence’, in Cottier, Thomas and Delimatsis, Panagiotis, eds., The Prospects of International Trade Regulation (Cambridge University Press, 2011) 369, 369–393Google Scholar.

46 The W/120 breaks down this sector into the following subsectors:

  1. i.

    i. Consultancy services related to the installation of computer hardware (CPC 841).

  2. ii.

    ii. Software implementation services (CPC 842).

  3. iii.

    iii. Data processing services (CPC 843).

  4. iv.

    iv. Database services (CPC 844).

  5. v.

    v. Maintenance and repair services of office machinery and equipment including computers (CPC 845).

  6. vi.

    vi. Other computer services, including data preparation services (CPC 849).

For analysis of members’ commitments on ‘computer and related services’, see Crosby, ‘Analysis of Data Localization Measures under WTO Services Trade Rules and Commitments’, supra n. 30, 11–16.

47 Wu, ‘The World Trade Law of Internet Filtering’, supra n. 42, 282, 283. See also, Erixon, Fredrik, Hindley, Brian, and Lee-Makiyama, Hosuk, Protectionism Online: Internet Censorship and International Trade Law, ECIPE (2009) 16, 10Google Scholar.

48 Central Product Classification 7523.

49 WTO, Work Programme on Electronic Commerce – Progress Report to the General Council, WT/GC/103, adopted 27 July 1999, 3.

50 Burri, Mira, ‘The Governance of Data and Data Flows in Trade Agreements: The Pitfalls of Legal Adaptation’, 51, UC Davis Law Review (2017) 51, 84Google Scholar.

51 See Panel Report, US–Gambling, para. 6.287; WTO, Work Programme on Electronic Commerce – Progress Report to the General Council, WT/GC/103, adopted 27 July 1999, 33.

52 Appellate Body Report, US–Gambling, para. 251.

53 Panel Report, Mexico–Measures Affecting Telecommunications Services, WT/DS204/R, adopted 2 April 2004, para. 4.124 (Mexico–Telecoms).

54 Panel Report, Mexico–Telecoms, para. 7.294.

55 Panel Report, China–Electronic Payment Services, para. 7.700.

56 Appellate Body Report, Korea–Various Measures on Beef, WT/DS161/AB/R, adopted 11 December 2000, para. 137 (Korea–Various Measures on Beef).

57 Ibid. paras. 163, 166.

58 Panel Report, China–Publications and Audiovisual Products, para. 7.1131, endorsing Appellate Body Report, United States–Tax Treatment for ‘Foreign Sales Corporations’ (Article 21.5), WT/DS108/AB/RW, adopted 14 January 2002, para. 215 (US–Foreign Sales Corporations).

59 Panel Report, US–Gambling, para. 6.461.

60 Appellate Body Report, European Communities – Measures Prohibiting the Importation and Marketing of Seal Products, WT/DS400/AB/R, adopted 22 May 2014, para. 5.199 (EC–Seals).

61 Ibid. para. 5.200.

62 Weber, Rolf H., ‘Regulatory Autonomy and Privacy Standards under the GATS’, 7, Asian Journal of WTO and International Health Law and Policy (2012) 1, 30Google Scholar.

63 European Parliament and Council Directive 95/46/EC of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data 1995 OJ L 281 (European Communities).

64 Selby, ‘Data Localization Laws’, supra n. 16, 218.

65 Appellate Body Report, Korea–Various Measures on Beef, paras. 163, 166.

66 Ibid. para. 166.

67 Appellate Body Report, US–Gambling, para. 306.

68 Nigel Cory and Robert Atkinson, ‘Financial Data does not Need or Deserve Special Treatment in Trade Agreements’, Information Technology and Innovation Foundation (2016), www2.itif.org/2016-financial-data-trade-deals.pdf (accessed 5 March 2018).

69 For an overview of the data localization measures which have been introduced by China and Russia, see Chander and Le, ‘Data Nationalism’, supra n. 16.

70 Van den Bossche, Peter and Zdouc, Werner, The Law and Policy of the World Trade Organization (Cambridge University Press, 2014) 595Google Scholar.

71 Alford, Roger P., ‘The WTO Self-Judging Security Exception’, Utah Law Review (2011) 697, 699Google Scholar.

72 Ibid. 727.

73 Mitchell, Andrew and Hepburn, Jarrod, ‘Don't Fence Me In: Reforming Trade and Investment Law to Better Facilitate Cross-Border Data Flows’, 19 Yale Journal of Law and Technology (2017) 182, 205Google Scholar; Alford, ‘The WTO Self-Judging Security Exception’, supra n. 71, 699.

74 GATT, United States: Export Restrictions (Czechoslovakia), Report of the Panel (8 June 1949) GATT Doc CP3/SR22 - II/28, 3; cited in Van den Bossche and Zdouc, above n. 80, 597.

75 Peng, Shin Yi, ‘Cybersecurity Threats and the WTO National Security Exceptions’, 18 Journal of International Economic Law (2015) 449, 450, 453Google Scholar. See also Mitchell and Hepburn, ‘Don't Fence Me In’, supra n. 73, 205.

76 Alford, ‘The WTO Self-Judging Security Exception’, supra n. 71, 727.

77 Panel Report, US–Gambling, para. 6.287; Appellate Body Report, China–Publications and Audiovisual Products, para. 412.

78 See Burri, ‘The Regulation of Data Flows Through Trade Agreements’, supra n. 16, 417.

79 The first FTA containing an e-commerce chapter was the Australia – Singapore Free Trade Agreement, signed 17 February 2003 [2003] (entered into force 28 July 2003).

80 Article 14.14 of the CPTPP E-Commerce Chapter.

81 Articles 14.14, 14.17 and 14.16 of the CPTPP E-Commerce Chapter.

82 Article 15.8 of the E-Commerce Chapter of the Free Trade Agreement between the United States of America and the Republic of Korea, signed 30 June 2007 [2012] (entered into force 15 March 2012) states: ‘Recognizing the importance of the free flow of information in facilitating trade, and acknowledging the importance of protecting personal information, the Parties shall endeavor to refrain from imposing or maintaining unnecessary barriers to electronic information flows across borders.’

83 Third Review of the Australia – Singapore Free Trade Agreement, signed 13 October 2016 [2017] (entered into force 1 December 2017).

84 European Commission, ‘Trade Policy in Focus: Trade in Services Agreement’, http://ec.europa.eu/trade/policy/in-focus/tisa/ (accessed 2 June 2018).

85 Department of Foreign Affairs and Trade, Australia, Trade in Services Agreement, http://dfat.gov.au/trade/agreements/trade-in-services-agreement/pages/trade-in-services-agreement.aspx (accessed 4 March 2018).

86 Inside US Trade, ‘Leak Reveals TISA Parties at odds over Language on Cross-Border Data Flows’, World Trade Online (30 January 2017).

87 This is part of the standard FTA practice of economies, including Australia, Canada, the European Union, Japan, the Republic of Korea, and the United States, amongst others.

88 White House (United States) ‘Presidential Memorandum Regarding Withdrawal of the United States from the Trans-Pacific Partnership Negotiations and Agreement’ (Press Release, 23 January 2017), www.whitehouse.gov/the-press-office/2017/01/23/presidential-memorandum-regarding-withdrawal-united-states-trans-pacific (accessed 5 March 2018).

89 The ratification provisions contained in Article 30.4 of the TPP require at least six of the original signatories accounting for 85% of the combined GDP to ratify, effectively precluding the TPP's entry into force without the USA, which accounts for approximately 62% of the total GDP of TPP signatories.

90 Kaori Kaneko and Takashi Umekawa, ‘Trans-Pacific Trade Pact, Without the US, to be Signed in March’, Reuters (23 January 2018).

91 Article 3 of the CPTPP.

92 Paragraph 2 of Article 14.11.

93 Paragraph 2 of Article 14.13.

94 Article 31 of the Vienna Convention on the Law of Treaties states: ‘A treaty shall be interpreted in good faith in accordance with the ordinary meaning to be given to the terms of the treaty in their context and in light of its object and purpose.’

95 Paragraph 3 of Article 14.2 of the CPTPP E-Commerce Chapter.

96 Cory and Atkinson, ‘Financial Data does not Need or Deserve Special Treatment in Trade Agreements’, supra n. 9, 1, 5; Baker Donelson, ‘Data Localization and the CPTPP: Financial Institutions Beware’ (20 April 2016).

97 Cory and Atkinson, ‘Financial Data does not Need or Deserve Special Treatment in Trade Agreements’, supra n. 9, 5.

98 Inside US Trade, ‘Treasury Floats Financial Services Data Fix For CPTPP’, The Howard Baker Forum (25 May 2016).

99 Paragraph 3 of Articles 14.11 and 14.13 state: ‘Nothing in this Article shall prevent a Party from adopting or maintaining measures inconsistent with paragraph 2 to achieve a legitimate public policy objective, provided that the measure:

  1. a.

    a. is not applied in a manner which would constitute a means of arbitrary or unjustifiable discrimination or a disguised restriction on trade; and

  2. b.

    b. does not impose restrictions on the use or location of computing facilities greater than are required to achieve the objective.’

100 Peng and Liu, ‘The Legality of Data Residency Requirements’, supra n. 13, 196.

101 Ibid.

102 Ibid. 195.

103 The Appellate Body has found that the ‘necessary’ test in Article XIV of the GATS imposes a relatively high standard which involves a comparison with reasonably available WTO-consistent alternatives; Appellate Body Report, US–Gambling, para. 317. See also Mitchell and Hepburn, ‘Don't Fence Me In’, supra n. 73, 210.

104 See Burri, ‘The Regulation of Data Flows through Trade Agreements’, supra n. 16, 433; Mitchell and Hepburn, ‘Don't Fence Me In’, supra n. 73, 210.

105 Article 29.7 states: ‘Nothing in this Agreement shall be construed to require a Party to furnish or allow access to information, the disclosure of which would be contrary to its law or would impede law enforcement, or otherwise be contrary to the public interest, or which would prejudice the legitimate commercial interests of particular enterprises, public or private.’

106 Article 29.2 states: ‘Nothing in this Agreement shall be construed to:

  1. a.

    a. require a Party to furnish or allow access to any information the disclosure of which it determines to be contrary to its essential security interests; or

  2. b.

    b. preclude a Party from applying measures that it considers necessary for the fulfilment of its obligations with respect to the maintenance or restoration of international peace or security, or the protection of its own essential security interests.’

107 Alford, ‘The WTO Self-Judging Security Exception’, supra n. 71, 699.

108 The horizontal/general exceptions in the GATS and the CPTPP are not identical. The differences are outlined in section 3.3.2.

109 The security exceptions in the GATS and the CPTPP are not identical. The differences are outlined in section 3.3.2.

110 Panel Report, US–Gambling, para. 6.287.

111 Peter Sutherland and others, ‘Report by the Consultative Board to Director-General Supachai Panitchpakdi, The Future of the WTO: Addressing Institutional Challenges in the New Millennium’ (2004) 15, www.wto.org/english/thewto_e/10anniv_e/future_wto_e.htm (accessed 5 March 2018).

112 Cory and Atkinson, ‘Financial Data does not Need or Deserve Special Treatment in Trade Agreements’, supra n. 9, 2.

113 Panel Report, US–Gambling, para. 6.287. Appellate Body Report, China–Publications and Audiovisual Products, para. 412.

114 See Burri, ‘The Regulation of Data Flows through Trade Agreements’, supra. n. 16, 417.

115 See e.g., Lee-Makiyama, ‘Cross-Border Data Flows in the Post Bali Agenda’, supra n. 26, 165; Susan Ariel Aaronson, At the Intersection of Cross-Border Information Flows and Human Rights: CPTPP as a Case Study, Institute for International Economic Policy (May 2016) 3, 4.