Trade agreements

Trade agreements have emerged as a new source of both data protection law and guidance on managing the potential confl ict between data protection law and cross-border data fl ows. There is a range in

the types of agreements – from simple bilateral free trade agreements to complex regional and global agreements.

One diffi culty in examining these agreements is that during the negotiation phase the documents are not available for public review.

However, one example of a relevant agreement that has now been made public is the Trans-Pacifi c Partnership Agreement (TPP).

Twelve countries - Australia; Brunei Darussalam;

Canada; Chile; Japan; Malaysia; Mexico; New Zealand;

Peru; Singapore; the United States; and Viet Nam – have joined the Trans-Pacifi c Partnership Agreement (TPP). The agreement was signed in October 2015.

Its primary aim is to establish a new free trade area; it will be a binding agreement once all 12 countries have ratifi ed it.

The TPP is unlike most of the other data protection instruments discussed in this study, in that it does not really impose any signifi cant positive requirements for data protection, but it does address the issue of balancing data protection laws against trade considerations. Specifi cally, it imposes limits on the extent of data protection regulation that signatories can provide in their national laws.

Article 14.8 requires parties to “adopt or maintain a legal framework that provides for the protection of the personal information of the users of electronic commerce”. A note to the Article states that “for greater certainty, a Party may comply with the obligation in this paragraph by adopting or maintaining measures such as a comprehensive privacy, personal information or personal data protection laws, sector-specifi c laws covering privacy, or laws that provide for the enforcement of voluntary undertakings by enterprises relating to privacy”. There are no further requirements and the impact of this requirement is likely to be very limited.

Article 14.11 concerns ‘Cross-Border Transfer of Information by Electronic Means’. It requires that cross-border transfers of personal information be allowed when the transfer relates to the business practices of an organization in a TPP member country.

Importantly, this article only allows restrictions on cross-border transfers if they satisfy four requirements:

i(i) the law must be necessary “to achieve a legitimate public policy objective” – this appears to be very straightforward requirement;

CHAPTER III : Regional initiatives 37

(ii) the law must not be “applied in a manner which would constitute a means of arbitrary or unjustifi able discrimination” – this requirement basically states that the restriction must apply to everyone, meaning that foreign companies will be subject to the same legal restrictions as domestic companies;

(iii) the law must not be “a disguised restriction on trade” – this is new wording and is the most interesting rule in the TPP. The result is that any business affected by a cross-border transfer restriction can challenge the law as a “disguised restriction on trade”. This would be a diffi cult task for anything other than the most extreme restriction. This clause appears to establish a new balance between privacy protection and trade restrictions, and in the future this wording may become a common part of international agreements.

(iv) the law must “not impose restrictions on transfers of information greater than are required to achieve the objective”. This clause could be very subjective in practice, and may provide some room for disputes.

If a restriction on cross-border transfers goes too far, and breaches one of these four tests, it could be challenged under the TPP dispute resolution procedures.

As stated earlier, the TPP establishes a new approach to balancing privacy protection and trade. The four-part test may prove successful, and it would not be a surprise if the same (or similar) wording appeared in other international trade agreements.

Other signifi cant agreements that are under conside-ration include the TiSA and the TTIP.

The Trade in Services Agreement (TiSA) is a potential trade agreement between 50 parties, including the European Union (and therefore its members), Japan, the United States and a very diverse range of other countries. The agreement aims to remove tariffs and other trade barriers in the global trade of services such as banking, health care and transport.

The text of the agreement is secret, but it appears that at least some provisions on data protection will be included in the agreement. The involvement of the EU in TiSA means that it is unlikely that national data protection requirements will be signifi cantly weakened, but wording similar to the TPP may appear in the fi nal

text, setting out a ‘test’ for balancing data protection requirements against the cross-border fl ow of data.

The Transatlantic Trade and Investment Partnership (TTIP) is a potential free trade agreement between the European Union and the United States. It covers goods, services, investments and industry sector regulation. The text is secret and it is unclear whether data protection will be included.

The strengths and limitations of international trade agreements:

The strengths of international trade agreements include:

 they have the potential to engage with a very wide range of countries – in theory there are no regional limitations, although regional agreements are now more common than global agreements;

 they are binding on the parties and they have the potential to drive interoperability; and

 they have the potential to address the balance between data fl ows and data protection.

The limitations of international trade agreements include:

 negotiations are complex and secretive;

 consumer and civil society stakeholders are often excluded from the development of trade agreements;

 they contain complex dispute resolution procedures and there is a history of signifi cant disputes and confl icts.

Overall, trade agreements have enormous potential for infl uence on national laws. However, they also have enormous potential for confl ict or legal challenges, and there is a long history of international disputes relating to trade agreements. In the future, it is possible that data protection law will be infl uenced by disputes brought under these agreements – so the content of the agreements is vital.

Lessons learned from the regional initiatives The regional initiatives have been the key driver for data protection regulation (particularly the EU initiatives). Some potential exists for fragmentation and divergence with the large number of competing initiatives, and their lack of comprehensive coverage.

Some interesting crossovers are developing (for

example the ongoing cooperation between the EU and APEC concerning binding corporate rules); this type of collaboration needs to be developed further.

Some regional initiatives (OECD, The Commonwealth) are still based on voluntary principles and model laws, and their relevance today is diminishing. The current priority is on implementing and enforcing (and where possible harmonizing) actual regulations, although principles and model laws have provided some very useful guidance in the past.

The emergence of trade agreements as a key factor in data protection regulation is a new development, which

has the potential to highlight the trade implications of data protection.

The following table shows the position of each of the seven regional frameworks on a ‘spectrum’ for each of the key themes of this study (note that the EU is split between the EU Directive and the EU GDPR).

Table 3. Strengths and limitations of the main regional frameworks in addressing key challenges in the development and implementation of data protection laws.

Table 3. Strengths and limitations of the main regional frameworks in addressing key challenges in the develop-ment and impledevelop-mentation of data protection laws

Very weak Weak Moderate Strong

Addressing gaps in