537See Sect. 3.2.4. Christopher Kuner submits that adequacy decisions do not provide a watertight standard of data protection. Kuner (2009), p. 271. While this submission is not wrong, the new rules under the GDPR improve compliance with the right to continuous protection for personal data. The criteria for adequate protection are more detailed and the periodic review mechanism ensures consistency over time.

providing appropriate safeguards instead of an adequacy decision as the legal basis for transfers of personal data is low because instruments providing appropriate safeguards also allow structural, systemic, and continuous cross-border flows of personal data. The interference with the MFN treatment obligation based on adequacy decisions versus appropriate safeguards should therefore satisfy the necessity test in Article XIV(c)(ii) GATS.

Aaditya Mattoo and Joshua P. Meltzer do not share this conclusion. They argue instead that

the Privacy Shield may be used to show that such flexible negotiated agreements are able to achieve the EU's desired level of privacy protection in a way that is less trade restrictive than the Commission's relatively rigid approach to determining the (lack of) adequacy of India's privacy regime.538

This submission cannot be supported. In cases in which the compliance of a measure with its objective is high and the trade restrictiveness is low, necessity can be assumed without resorting to reasonably available alternatives. In addition, Decision (EU) 2016/1250, the Privacy Shield adequacy decision, was invalidated exactly because it did not achieve the EU's desired level of protection.

Should the adjudicative bodies of the WTO nevertheless resort to an assessment of alternative measures and suggest that special framework adequacy decisions, such as the Privacy Shield, constitute a measure that is less inconsistent with the GATS, the EU could argue that such special frameworks do not constitute a measure that is reasonably available in all cases.539 The adoption of special framework adequacy decisions could be impossible in cases in which the WTO members have a level of protection for personal data that is much lower than in the EU.

However, it is possible that the WTO adjudicative bodies would find that special framework adequacy decisions would still be available for other WTO members. The AB held in China – Publications and Audiovisual Products that

an alternative measure should not be found not to be reasonably available merely because it involves some change or administrative costs [...] Rather, in order to establish that an alternative measure is not 'reasonably available', the respondent must establish that the alternative measure would impose undue burden on it, and it must support such an assertion with sufficient evidence.540

The EU could argue that negotiating that many special framework adequacy decisions would be an undue burden. Again, it is possible that the WTO adjudicative bodies would find that efforts to adopt special framework adequacy decisions are not an undue burden for the EU, but a legitimate change to the adequacy-based system of data transfers that comes with certain administrative costs. In that case, the interference with the MFN treatment obligation would not satisfy the necessity test in

538Mattoo and Meltzer (2018), p. 782.

539I showed that special framework adequacy decisions also violate the MFN treatment obligation and the domestic regulation obligation. See Sects. <IP_ADDRESS> and <IP_ADDRESS>.2.

540WTO AB Report, China – Publications and Audiovisual Products, paras 326–327, with reference to WTO AB Report, US – Gambling, para. 308.

Article XIV(c)(ii) GATS. Nevertheless, it must be underlined one more time that necessity should be assumed here because the compliance of the measure with its objective is high and trade restrictiveness is low.

## <IP_ADDRESS>.1.2 Appropriate Safeguards Versus Derogations

The second interference with the MFN treatment obligation in Article II GATS occurs when services and service suppliers in WTO members cannot rely on adequacy decisions or the instruments providing appropriate safeguards and have to use the derogations for their transfers of personal data. The first task to justify the interference is demonstrating that the measure in question is designed to secure compliance with laws that are not in themselves inconsistent with the GATS.541 The instruments providing appropriate safeguards in Article 46 GDPR are intended to secure compliance with the other provisions of the GDPR and the right to continuous protection for personal data in Article 8 CFR.542 Consequently, the instruments providing appropriate safeguards may be considered as attempting to secure compliance with laws consistent with WTO law. Importantly, the AB underlined in Argentina – Financial Services that

[a] measure can be said 'to secure compliance' with laws or regulations when its design reveals that it secures compliance with specific rules, obligations, or requirements under such laws or regulations, even if the measure cannot be guaranteed to achieve such result with absolute certainty.543

This is especially important with regard to the instruments providing appropriate safeguards because the compliance with the right to continuous protection of personal data in Article 8 CFR heavily depends on the awareness of the data exporter and the supervisory authorities' use of their corrective powers and, therefore, cannot be guaranteed to achieve such result with absolute certainty.

The second task to justify the interference is to verify that the measure in question is necessary to secure such compliance.544 The instruments providing appropriate safeguards must be attributed a lower level of compliance with the right to continuous protection of personal data than adequacy decisions because the responsibility for compliance lies with the data exporter and control over the compliance is decentralized.545 At the same time, the effect on trade restrictiveness between appropriate safeguards and the derogations is greater than between adequacy decisions and appropriate safeguards because structural, systemic, and continuous crossborder flows of personal data are not possible with the derogations. This may result

541WTO Panel Report, Argentina – Financial Services, paras 7.592–7.593; WTO AB Report, Argentina – Financial Services, para. 6.202.

542Yakovleva and Irion (2016), p. 206. But see Weber (2012), pp. 40–41.

543WTO AB Report, Argentina – Financial Services, para. 6.203 [footnote omitted].

544WTO Panel Report, Argentina – Financial Services, paras 7.592–7.593; WTO AB Report, Argentina – Financial Services, para. 6.202; see Sect. <IP_ADDRESS>.1.

545See Sect. 3.3.4.

in a zero quota for certain services.546 This interference with the MFN treatment obligation therefore requires an additional analysis to determine if there are reasonably available alternative measures that are consistent with the GATS and still achieve the same level of protection for personal data.

Some scholars have submitted—without going into much detail—that the necessity of data transfer rules could be successfully challenged if the complaining party claims that there are less restrictive alternatives, such as the principle of accountability, which has been adopted in Canada and many Asia-Pacific Economic Community (APEC) states.547 It is important to bear in mind, however, that this interference with the MFN treatment obligation takes place because the instruments providing appropriate safeguards cannot guarantee the right to continuous protection of personal data that is transferred from the EU to a WTO member. Consequently, the principle of accountability cannot constitute an alternative measure because it is not the legal mechanism for data transfers that is the problem. Rather, it is the level of protection for personal data in the non-EU WTO member that is the problem. Should a level of protection that is essentially equivalent to that guaranteed within the EU not be available for the transfer of personal data to the non-EU WTO member, then the principle of accountability would not be sufficient in itself to comply with the right continuous protection of personal data.548

Carla Reyes has argued that using technology to enforce data protection laws would increase compliance and decrease the impact on international trade.549 It is unclear however to what extent technological measures would be considered as reasonably available alternatives by the WTO adjudicative bodies. Should the adjudicative bodies choose to consider technological measures as reasonably available measures, then the EU may attempt to show that technological measures do not allow it to achieve the level of protection it requires and, therefore, cannot be a genuine alternative.550 The EDPB already provided guidance on the limitations of technological solutions to comply with the right to continuous protection of personal data in Article 8 CFR.551 For example, the EDPB stated that if a data exporter transfers personal data to a cloud service provider which requires access to the data in the clear in order to execute the task assigned and the power granted to the public authorities of the recipient country to access transferred data (such as for surveillance purposes) goes beyond what is necessary and proportionate in a democratic society, then the "current state of the art [is] incapable of envisioning an effective technical

546This is the case for digital services such as cloud computing services, social network services, IoT maintenance services, and digital lodging arrangement platform services that cannot be supplied without systematic, structural, and continuous cross-border flows of personal data. See Sect <IP_ADDRESS>.

547Velli (2019), p. 889; Mishra (2019), pp. 16–17; Yakovleva and Irion (2016), pp. 206–207; cp. Kuner (2009), pp. 269–272.

548Mishra (2019), p. 17; Bennett (2012), pp. 40–43.

549Reyes (2011), p. 33.

550Cp. WOT AB Report, Brazil – Retreaded Tyres, para. 156 (on Article XX GATT).

551EDPB (2020), pp. 26–27.

measure to prevent that access from infringing on data subject rights." 552 The EDPB added that in the given scenario,

where unencrypted personal data is technically necessary for the provision of the service by the processor, transport encryption and data-at-rest encryption even taken together, do not constitute a supplementary measure that ensures an essentially equivalent level of protection if the data importer is in possession of the cryptographic keys.553

This assessment must be taken into account by the WTO adjudicative bodies when they consider technological measures as reasonably available alternatives. It is difficult to say if the WTO adjudicative bodies would deviate from the guidelines provided by the EDPB. The explicit reference to the EU's desired level of protection in the guidelines––an essentially equivalent level of protection––indicates that a deviation would have to be justified with great effort and in-depth technological assessments, also with regard to the regime of government access to the transferred personal data in the respective WTO member. There is much to suggest that such technological measures would not be considered reasonably available alternatives. The interference with the MFN treatment obligation should therefore satisfy the necessity test in Article XIV(c)(ii) GATS.

#### <IP_ADDRESS>.2 Chapeau

Any interference with the MFN treatment obligation based on adequacy decisions (Sect. <IP_ADDRESS>.2.1) and appropriate safeguards (Sect. <IP_ADDRESS>.2.2) must also satisfy the chapeau requirements of Article XIV GATS.

## <IP_ADDRESS>.2.1 Adequacy Decisions Versus Appropriate Safeguards

The examination under the chapeau requires an assessment of whether the conditions prevailing in the countries between which the measure allegedly discriminates are the same. The AB has underlined that only conditions that are relevant for the purpose of establishing arbitrary or unjustifiable discrimination in the light of the specific character of the measure should be considered.554 In particular, conditions relating to the policy objective under the applicable subparagraph of Article XIV GATS are relevant.555 It can be assumed that for the purposes of privacy in the digital sphere, the same conditions prevail in all WTO members. The impact of the processing of personal data of individuals can be expected to be the same regardless of the physical location of the individual. Similarly, the AB confirmed the panel's finding in Brazil – Retreaded Tyres "that the health impact of remoulded tyres imported from MERCOSUR countries and their European counterparts can be

552Ibid.

553Ibid., 27.

554WTO AB Report, EC – Seal Products, para. 5.299 (on Article XX GATT).

555Ibid., para. 5.300 (on Article XX GATT).

expected to be comparable." 556 In contrast, Neha Mishra focuses on the "regulatory culture of privacy" in different WTO members to establish same conditions.557 The reports of the WTO adjudicative bodies, however, do not support such a focus on the regulatory culture when establishing same conditions for the purposes of the chapeau.

In cases in which the same conditions prevail, the analysis of whether discrimination is arbitrary or unjustifiable within the meaning of the chapeau must focus on the cause of the discrimination, or the rationale put forward to explain its existence.558 The AB relied on a number of factors in making this determination:

(i) a 'rigid and unbending requirement' that countries exporting shrimp into the United States must adopt a regulatory programme that is essentially the same as the United States' programme; (ii) the fact that the discrimination resulted from the failure to take into account different circumstances that may occur in the territories of other WTO Members, in particular, specific policies and measures other than those applied by the United States that might have been adopted by an exporting country for the protection and conservation of sea turtles; and (iii) the fact that, while the United States negotiated seriously with some WTO Members exporting shrimp into the United States for the purpose of concluding international agreements for the protection and conservation of sea turtles, it did not do so with other WTO Members.559

In addition, one of the most important factors in the assessment of arbitrary or unjustifiable discrimination is the question of whether the discrimination can be reconciled with—or is rationally related to—the policy objective with respect to which the measure has been provisionally justified under the paragraphs of Article XIV GATS.560 In US – Shrimp, the AB highlighted that the measure treated shrimp caught using methods identical to those employed in the US differently from shrimp caught in the US or other certified countries, solely because they have been caught in the waters of countries that have not been certified by the US.561 The AB found that this discrimination was "difficult to reconcile with the declared policy objective of protecting and conserving sea turtles." 562 Another important factor in the assessment of arbitrary or unjustifiable discrimination is the question of whether the application of the measure at issue allows for any inquiry into the appropriateness

556WTO AB Report, Brazil – Retreated Tyres, para. 217 (on Article XX GATT); WTO Panel Report, Brazil – Retreaded Tyres, para. 7.270 (on Article XX GATT).

557Mishra (2019), pp. 19–20.

558WTO AB Report, EC – Seal Products, para. 5.303 (on Article XX GATT) with reference to WTO AB Report, Brazil – Retreaded Tyres, para. 226 (on Article XX GATT).

559Ibid., para. 5.305 (on Article XX GATT) with reference to WTO AB Report, US – Shrimp, paras 163–164, 166, 172 and 177 (on Article XX GATT).

560Cp. ibid., para. 5.306 (on Article XX GATT).

561WTO AB Report, US – Shrimp, para. 176 (on Article XX GATT).

562Ibid. (on Article XX GATT).

of the regulatory program given the conditions prevailing in the concerned countries.563

An interference with the MFN treatment obligation based on adequacy decisions seems to satisfy many of the factors for finding arbitrary or unjustifiable discrimination. Third countries must adopt a regulatory program for the protection of personal data that is essentially the same as in the EU and there is not much flexibility regarding the level of protection for personal data when it comes to regular adequacy decisions. In this regard, it is important to note that all WTO members should have the same opportunities to obtain an adequacy decision.

First, the assessment must be the same for all WTO members. This is why many adequacy decisions underline in the recitals that

any decision based on Article 25(6) of Directive 95/46/EC should be made and enforced in a way that does not arbitrarily or unjustifiably discriminate against or between third countries where like conditions prevail, nor constitute a disguised barrier to trade, regard being had to the Community's present international commitments.564

However, as has been noted, there are some content-related inconsistencies between the different existant adequacy assessments.565 This could be problematic under the standards of the chapeau depending on the extent of these inconsistencies. In spite of this, the mandatory review process in Article 45(9) GDPR of the older adequacy decisions under the GDPR addresses such inconsistencies because the legal requirements in the GDPR are much more detailed than they were in Directive 95/46/EC. The GDPR simply does not leave room for such inconsistencies anymore.

Second, the EU must undertake a serious, good faith effort to assess the level of a country's data protection measures when formally asked for an adequacy decision by a WTO member. Here, the AB also underlined that

rigorous compliance with the fundamental requirements of due process should be required in the application and administration of a measure which purports to be an exception to the treaty obligations of the Member imposing the measure and which effectively results in a suspension pro hac vice of the treaty rights of other Members.566

In US – Shrimp the AB criticized the US for not providing formal notice for a denied application nor an explanation of the reasons for the denial.567 This was compounded by the fact that the US further offered no formal legal procedure for reviewing or appealing a denial.

I would argue that an assessment of a country's level of protection for personal data by an independent EU institution such as the Article 29 WP or the EDPB would

```
565See Sect. <IP_ADDRESS>.
```
563WTO AB Report, EC – Seal Products, para. 5.337 (on Article XX GATT) with reference to WTO AB Report, US – Shrimp, para. 165 (on Article XX GATT); WTO AB Report, US – Gasoline, 27 (on Article XX GATT); cp. Kuner (2017), p. 34; Bhagwati (2004), pp. 153–158.

564This is an example taken from Recital (4) Commission Decision 2003/821/EC of 21 November 2003 on the adequate protection of personal data in Guernsey, [2003] OJ L 308/27.

566WTO AB Report, US – Shrimp, para. 182 (on Article XX GATT). 567Ibid., para. 183 (on Article XX GATT).

constitute a serious, good faith effort to assess the level of data protection in a third country. An external non-governmental assessment—such as the ones conducted by the Research Centre on IT and Law at the University of Namur (CRID) for Burkina Faso, Mauritius, Tunisia, and Morocco in 2010—might not be enough because the findings are not legitimated by an official governmental institution. At the same time, an opinion of the Article 29 WP or the EDPB cannot be reviewed or appealed. Nevertheless, it provides a detailed explanation of the reasons for the denial of an adequacy finding that should be sufficient.

It is necessary to distinguish the situation adjudicated in US – Shrimp from hypothetical situations concerning the EU's personal data protection regime. The effect of the measure in US – Shrimp was "a rigid and unbending standard by which United States officials determine whether or not countries will be certified, thus granting or refusing other countries the right to export shrimp to the United States." 568 In contrast to this, the interferences with the MFN treatment obligation caused by EU adequacy decisions still allow structural, systematic, and continuous cross-border flows of personal data on the basis of Article 46 GDPR and cannot be construed as an export prohibition.569 The trade restrictive effect of the measure is not comparable in the EU case and therefore the implicit due process standards of the chapeau should be satisfied. As long as every WTO member asking for an adequacy decision receives an assessment by the EDPB, the interference with the MFN treatment obligation caused by EU adequacy decisions does not amount to arbitrary or unjustifiable discrimination under the chapeau. 570

With regard to the prohibition on disguised restrictions on trade, the AB acknowledged that it is often difficult to prove the hidden factors marking a disguised protectionist measure: "Although it is true that the aim of a measure may not be easily ascertained, nevertheless its protective application can most often be discerned from the design, the architecture, and the revealing structure of a measure." 571

An interference with the MFN treatment obligation based on adequacy decisions could be considered a disguised restriction on trade if WTO members interested in obtaining an adequacy decision do not receive any kind of assessment of their level of protection for personal data. In sum, I find that there is no disguised restriction on

568WTO AB Report, US – Shrimp, para. 163 (on Article XX GATT).

569Where the instruments providing appropriate safeguards in Article 46 GDPR are not available, a potential export prohibition for digital services that require structural, systematic, and continuous transfers of personal data could be reconciled with the policy objective of protecting privacy under Article XIV(c)(ii) GATS.

570Should the WTO adjudicative bodies not follow the assessment submitted here, the European Commission would potentially need to start issuing negative adequacy decisions subject to judicial review. Such negative adequacy decisions would have negative consequences for the use of the instruments in Article 46 GDPR because the decision would consist of an official determination that the level of protection for personal data is not essentially equivalent to that guaranteed within the EU. Complainants should thus be aware that a negative adequacy decision could require data controllers and supervisory authorities to suspend or ban all data transfers from the EU to third countries with a negative adequacy decision.

571WTO AB Report, Japan – Alcoholic Beverages II, 29 (on Article XX GATT).

international trade in cases in which a third country is subject to an assessment of the EDPB.

The chapeau analysis will be different when a special framework adequacy decision—such as the invalidated Decision (EU) 2016/1250, the Privacy Shield adequacy decision—is in force. Currently, there are no special framework adequacy decisions in force, but the EU started the process of adopting a new special framework adequacy decision for the US covering the Transatlantic Data Privacy Framework.572 The AB clarified in US – Shrimp (Article 21.5 – Malaysia) that the chapeau does not require the conclusion of an agreement in order to avoid arbitrary or unjustifiable discrimination.573 Rather, it is simply necessary that all countries be provided with similar opportunities.574 Accordingly, the EU is bound to provide all countries with similar opportunities to negotiate a special framework adequacy decision if the EU adopts a new one. The standard of a good faith effort to negotiate a special framework adequacy decision would need to be assessed against the efforts made in the special framework adequacy decisions in force, or former special framework decisions.575 Comparable resources must be invested, and comparable energy must be devoted.576 This would set a high standard given the efforts made by the European Commission to negotiate the Privacy Shield or the Transatlantic Data Privacy Framework with the US. Should the EU once again adopt a special framework adequacy decision, it would amount to an interference with the MFN treatment obligation if the EU does not provide all WTO members with similar opportunities.577

## <IP_ADDRESS>.2.2 Appropriate Safeguards Versus Derogations

The interference with the MFN treatment obligation based on the instruments providing appropriate safeguards in Article 46 GDPR amounts to an export prohibition for certain services.578 Such an interference with the MFN treatment obligation may occur in cases in which supervisory authorities in EU member states make use of their corrective powers to ban or suspend data transfers in order to safeguard the right to continuous protection for personal data in Article 8 CFR. In these cases, the EU would be able to make a prima facie case that there is no arbitrary or unjustifiable discrimination for two reasons. First, the interference with the MFN treatment obligation can be reconciled with the measure's policy objective under Article XIV(c)(ii) GATS. Second, the due process requirements are fulfilled because

572European Commission (2022a); European Commission (2022b).

573WTO AB Report, US – Shrimp (Article 21.5 – Malaysia), para. 134 (on Article XX GATT). 574Ibid., para. 122 (on Article XX GATT).

575Ibid., para. 133 (on Article XX GATT), with reference to WTO Panel Report, US – Shrimp (Article 21.5 – Malaysia), para. 5.71 (on Article XX GATT).

576Ibid., para. 122 (on Article XX GATT).

577Bygrave (2002), p. 198.

578See Sect. <IP_ADDRESS>.

any decision of supervisory authorities can be subject to judicial review. Nevertheless, two scenarios are imaginable that could still lead to arbitrary or unjustifiable discrimination:

Should a complainant be able to show the existence of either scenario, it might be possible to rebut the EU's prima facie case of consistency. In such cases, interferences with the MFN treatment obligation based on the instruments providing appropriate safeguards in Article 46 GDPR would amount to arbitrary or unjustifiable discrimination under the chapeau.

With regard to the standard of disguised restriction on trade, the the EU could make a prima facie case for compliance by referring to the independence of supervisory authorities according to Article 8(3) CFR.580 Where supervisory authorities use their corrective powers in reaction to a complaint lodged with them, there cannot be a disguised restriction on international trade. Where they use their corrective powers on their own initiative, a complainant would have to show that the relevant decision was not motivated by the protection of the right to continuous protection for personal data in Article 8 CFR.

579See Sect. <IP_ADDRESS>.3.

580See Sect. <IP_ADDRESS>.

#### <IP_ADDRESS> Interference with the Domestic Regulation Obligation

One aspect of the EU regulation of data transfers that interferes with the domestic regulation obligation in Article VI GATS can be provisionally justified under the privacy exception in Article XIV(c)(ii) GATS (Sect. <IP_ADDRESS>.1), but it does not satisfy the requirements of the chapeau in Article XIV GATS (Sect. <IP_ADDRESS>.2).

#### <IP_ADDRESS>.1 Privacy Exception

Interferences with the domestic regulation obligation must be provisionally justified under the privacy exception in Article XIV(c)(ii) GATS. The first type of interference occurs because special framework adequacy decisions are usually negotiated with a WTO member that would otherwise not qualify for an adequacy decision (Sect. <IP_ADDRESS>.1.1). The second type of interference occurs when the use of corrective powers by different EU member supervisory authorities results in a fragmentation of conditions for the use of instruments providing appropriate safeguards in Article 46 GDPR across the EU (Sect. <IP_ADDRESS>.1.2).

#### <IP_ADDRESS>.1.1 Interference Based on Special Framework Adequacy Decisions

The first type of interference has a significant impact on the overall administration of the EU regulation of data transfers because it essentially introduces an additional legal mechanism for data transfers that is not available to all WTO members. To justify this interference, it must be demonstrated that the respective measure is designed to secure compliance with the GDPR and the right to continuous protection of personal data in Article 8 CFR.581 The ECJ has invalidated both of the special framework adequacy decisions that the European Commission has negotiated so far. The most important reason for the invalidations was that the decisions did not comply with the right to continuous protection for personal data in Article 8 CFR. It is therefore not even entirely clear whether these special framework adequacy decisions would have satisfied the first standard.

Furthermore, it must be demonstrated that the respective measure is necessary to secure compliance with the GDPR and the right to continuous protection of personal data in Article 8 CFR.582 This requires a weighing and balancing test. It must take into account the importance of the objective pursued, the measure's contribution to that objective, and the trade restrictiveness of the measure.583 Securing compliance

581WTO AB Report, Argentina – Financial Services, para. 6.202; WTO Panel Report, Argentina – Financial Services, paras 7.592–7.593; see Sect. <IP_ADDRESS>.1.

582Ibid.

583WTO Panel Report, Argentina – Financial Services, paras 7.659, 7.661 with reference to, among others, WTO AB Report, EC – Seal Products, para. 5.169 (on Article XX GATT) and WTO AB Report, US – Gambling, paras 306–307.

with the right to continuous protection for personal data is of the utmost importance because it is a constituent part of the fundamental right to data protection in Article 8 CFR. If a special framework adequacy decision is actually found to secure compliance with the right to continuous protection for personal data, it can be assumed that its contribution to that objective is high. Moreover, the trade restrictiveness of special framework adequacy decisions is not very high because instruments providing appropriate safeguards also allow structural, systemic, and continuous crossborder flows of personal data. If a specific special framework adequacy decision actually complies with the right to continuous protection of personal data in Article 8 CFR, the interference with the MFN treatment obligation should satisfy the necessity test in Article XIV(c)(ii) GATS.

## <IP_ADDRESS>.1.2 Interference Based on Corrective Powers of Supervisory Authorities

The second type of interference with the domestic regulation obligation occurs when the use of corrective powers by supervisory authorities results in a fragmentation among EU member states of the conditions for data transfers using instruments providing appropriate safeguards in Article 46 GDPR. Supervisory authorities must use their corrective powers to safeguard the right to continuous protection of personal data. The corrective powers are designed to secure compliance with the right to continuous protection of personal data. This objective is of the utmost importance.584 While the use of the corrective powers is essential for the compliance with the right to continuous protection of personal data, the trade restrictiveness of a fragmentation among EU member states as regards the conditions for data transfers with instruments providing appropriate safeguards is quite high. Consequently, reasonably available alternative measures must be assessed.

The ECJ has addressed the issue of fragmentation in in Schrems 2. 585 Here the Court highlighted that the voluntary consistency mechanism in Article 64(2) GDPR enables supervisory authorities to request an opinion from the EDPB when deciding whether to suspend or ban data transfers to a third country.586 The ECJ also emphasized the possibility for the EDPB in Article 65(1)(c) GDPR to adopt a legally binding decision, should a supervisory authority not follow an opinion of the EDPB.587 However, the consistency mechanism in Article 64(2) GDPR is not a water-tight solution because it is voluntary. A requirement to use the mandatory consistency mechanism in Article 64(1) GDPR would be a reasonably available alternative measure that is consistent with the GATS because it guarantees the impartial application of these powers and preserves for the EU its right to achieve the desired level of data protection. Supervisory authorities must already communicate a draft decision to the EDPB for an opinion when they approve BCRs based on

584Mishra (2019), p. 14.

585ECJ, Schrems 2, para. 147.

586Ibid.

587Ibid.

Article 64(1)(f) GDPR. The list for the mandatory consistency mechanism in Article 64(1) GDPR would have to be extended with decisions to ban or suspend data transfers according to Article 58(2)(f) and (j) GDPR. Should the use of corrective powers by supervisory authorities lead to an interference with Article VI:1 GATS because the voluntary consistency mechanism could not prevent the fragmentation among EU member states for the use of instruments providing appropriate, it cannot be considered necessary for the purposes of Article XIV(c)(ii) GATS.

#### <IP_ADDRESS>.2 Chapeau

Any interference with the domestic regulation obligation in Article VI GATS based on special framework adequacy decisions must also be justified under the chapeau of Article XIV GATS. The analysis of whether discrimination is arbitrary or unjustifiable within the meaning of the chapeau must focus on the cause of the discrimination, or the rationale put forward to explain its existence.588 I have shown above that an interference with the MFN treatment obligation in Article II GATS based on special framework adequacy decisions amounts to arbitrary or unjustifiable discrimination in cases in which other WTO members do not have similar opportunities to negotiate such a special framework for an adequacy decision. The same is true for the interference with the impartiality standard in Article VI:1 GATS. As long as special framework adequacy decisions are in force and the EU does not provide all WTO members with similar opportunities to negotiate such a solution, the interference with the domestic regulation obligation based on special framework adequacy decisions constitutes arbitrary and unjustifiable discrimination and cannot be justified under the chapeau of Article XIV GATS.

#### <IP_ADDRESS> Interference with the Market Access Obligation

Interferences with the market access obligation in Article XVI:2(a) and (c) GATS can be provisionally justified under the privacy exception in Article XIV(c)(ii) GATS (Sect. <IP_ADDRESS>.1) and the EU can also make a prima facie case of consistency with the chapeau of Article XIV GATS (Sect. <IP_ADDRESS>.2).

#### <IP_ADDRESS>.1 Privacy Exception

There is an interference with the market access obligation in Article XVI:2(a) and (c) GATS in cases in which supervisory authorities restrict the cross-border flow of

588WTO AB Report, EC – Seal Products, para. 5.303 (on Article XX GATT) with reference to WTO AB Report, Brazil – Retreaded Tyres, para. 226 (on Article XX GATT).

personal data and structural, systematic, and continuous cross-border flows of personal data are a necessary element of the cross-border supply of a service covered by the EU's market access commitments.589 First, it must be demonstrated that the respective measure is designed to secure compliance with the GDPR and the right to continuous protection of personal data in Article 8 CFR.590 I have concluded above that the use of corrective powers by supervisory authorities is designed to secure compliance with the right to continuous protection for personal data in Article 8 CFR.591

Second, it must be demonstrated that the respective measure is necessary to secure compliance with the GDPR and the right to continuous protection of personal data in Article 8 CFR. The weighing and balancing test must take into account the importance of the objective pursued, the measure's contribution to that objective, and the trade restrictiveness of the measure.592 The objective of securing compliance with the right to continuous protection for personal data is of the utmost importance and the use of corrective powers by supervisory authorities is essential for compliance with the right to continuous protection for personal data. Nevertheless, the trade restrictiveness of the interference with the market access obligation in Article XVI:2(a) and (c) GATS is high because the use of corrective powers results in a zero quota for the services at issue. Consequently, reasonably available alternative measures must be assessed.

In contrast to the interference with the domestic regulation obligation, the mandatory consistency mechanism in Article 64(1) GDPR does not constitute a reasonably available alternative measure that could mediate the interference with Article XVI:2(a) and (c) GATS. Nor could the principle of accountability constitute an alternative measure.593 In addition, the corrective powers in Article 58(2)(f) and (j) GDPR already foresee temporary measures in cases where non-compliance with the right to continuous protection for personal data can be improved. I conclude that there are no reasonably available alternative measures and that therefore the use of corrective powers by supervisory authorities can be provisionally justified under the privacy exception in Article XIV(c)(ii) GATS.

589This is the case for digital services such as cloud computing services, social network services, IoT maintenance services, and digital lodging arrangement platform services that cannot be supplied without systematic, structural, and continuous data transfers. See Sect. <IP_ADDRESS>.

590WTO AB Report, Argentina – Financial Services, para. 6.202; WTO Panel Report, Argentina – Financial Services, paras 7.592–7.593; see Sect. <IP_ADDRESS>.1.

591See Sect. <IP_ADDRESS>.1.

592WTO Panel Report, Argentina – Financial Services, paras. 7.659, 7.661 with reference to, among others, WTO AB Report, EC – Seal Products, para. 5.169(on Article XX GATT) and WTO AB Report, US – Gambling, paras 306–307.

593See Sect. <IP_ADDRESS>.1. Neha Mishra also argued that a WTO panel will most likely refrain from considering the accountability principle due to the absence of international standards on data privacy and cybersecurity. Mishra (2019), p. 18.

#### <IP_ADDRESS>.2 Chapeau

Interferences with the market access obligation in Article XVI:2(a) and (c) GATS must also be justified under the chapeau of Article XIV GATS. The analysis of whether discrimination is arbitrary or unjustifiable within the meaning of the chapeau must focus on the cause of the discrimination, or the rationale put forward to explain its existence.594 The EU would be able to make a prima facie case that there is no arbitrary or unjustifiable discrimination for two reasons. First, the use of the corrective powers by supervisory authorities can be reconciled with the policy objective under Article XIV(c)(ii) GATS. Supervisory authorities make use of their corrective powers to ban or suspend data transfers in cases in which data exporters infringe the right to continuous protection for personal data in Article 8 CFR. Second, the due process requirements are satisfied because all decisions of the supervisory authorities are subject to judicial review.

Nevertheless, two scenarios could still lead to arbitrary or unjustifiable discrimination. First, when a complainant successfully shows that supervisory authorities in different EU member states maintain different regimes for services and service suppliers for the same WTO member. Second, when a complainant successfully shows that a single supervisory authority in an EU member state selectively uses its corrective powers to discriminate against certain WTO members.

The EU would also be able to make a prima facie case that there is no disguised restriction on trade by referring to the independence of supervisory authorities according to Article 8(3) CFR.595 Only when a complainant can successfully show that the use of the corrective powers by supervisory authorities is not motivated by the protection of the right to continuous protection for personal data can there be a finding of disguised restrictions on international trade.

#### <IP_ADDRESS> Interference with the National Treatment Obligation

Finally, the aspects of the EU regulation of data transfers that interfere with the national treatment obligation in Article XVII GATS can also be provisionally justified under the privacy exception in Article XIV(c)(ii) GATS (Sect. <IP_ADDRESS>.1) and the chapeau of Article XIV GATS (Sect. <IP_ADDRESS>.2).

#### <IP_ADDRESS>.1 Privacy Exception

Interferences with the national treatment obligation must be provisionally justified under the privacy exception in Article XIV(c)(ii) GATS. The first interference is

594WTO AB Report, EC – Seal Products, para. 5.303 (on Article XX GATT) with reference to WTO AB Report, Brazil – Retreaded Tyres, para. 226 (on Article XX GATT). 595See Sect. <IP_ADDRESS>.

based on the instruments providing appropriate safeguards in Article 46 GDPR because foreign service suppliers must comply with the conditions of their use in addition to the other rules in the GDPR (Sect. <IP_ADDRESS>.1.1). The second interference is based on the use of the corrective powers of supervisory authorities (Sect. <IP_ADDRESS>.1.2).

## <IP_ADDRESS>.1.1 Interference Based on Appropriate Safeguards

It must be demonstrated that the use of instruments providing appropriate safeguards in Article 46 GDPR is designed to secure compliance with the GDPR and the right to continuous protection of personal data in Article 8 CFR.596 These instruments must be attributed a lower level of compliance with the right to continuous protection of personal data than adequacy decisions. At the same time, the trade restrictiveness of an interference with the national treatment obligation is not very high. The use of the instruments in Article 46 GDPR is a regulatory burden, but they still allow structural, systematic, and continuous data transfers. It is thus not clear whether it is necessary to look into alternative measures that are reasonably available and achieve the same level of protection with respect to the objective pursued.

Should the adjudicative bodies of the WTO decide to look into alternative measures, it seems sensible to address the principle of accountability again with regard to the national treatment obligation.597 The scholars who submit that it could present a less restrictive alternative refer to a text by Christopher Kuner from 2009: "An Alternative Standard for International Data Transfers." 598 In this text, Kuner argues that it is necessary to investigate what legal mechanisms could ensure that data exporters remain accountable and responsible for data processing once personal data have been transferred outside the EU. He suggests that "[t]his might include reliance on liability concepts under national law, or use of data transfer mechanisms that are already recognized, such as BCRs or the use of standard contractual clauses for International Data Transfers." 599 This scholarship overlooks the fact that the instruments in Article 46 GDPR––which also existed under Directive 95/46/EC–– already work with the principle of accountability. The contractual solutions foreseen in Article 46 GDPR include liability concepts. For example, BCRs have to specify the liability by the data exporter established on the territory of an EU member state for any breaches of the BCRs by any member of the group of enterprises not established in the EU according to Article 47(2)(f) GDPR and Clause 6 of the standard data protection clauses adopted with Decision 2010/87/EU also entail

597I have argued above––concerning the MFN treatment obligation––that the principle of accountability would not be a reasonably available alternative measure that achieves the same level of protection with respect to the objective pursued in cases in which the right to continuous protection for personal data cannot be ensured with the instruments in Article 46 GDPR. See Sect. <IP_ADDRESS>.1. 598Velli (2019), p. 889; Yakovleva and Irion (2016), pp. 206–207. Kuner (2009), pp. 269–272.

599Kuner (2009), p. 270.

596WTO AB Report, Argentina – Financial Services, para. 6.202; WTO Panel Report, Argentina – Financial Services, paras 7.592–7.593; see Sect. <IP_ADDRESS>.1.

detailed rules on liability. I thus argue that there are no alternative measures that are reasonably available and achieve the same level of protection with respect to the right to continuous protection for personal data. The interference with the national treatment obligation based on instruments providing appropriate safeguards therefore satisfies the necessity test in Article XIV(c)(ii) GATS.

## <IP_ADDRESS>.1.2 Interference Based on Corrective Powers of Supervisory Authorities

The second interference with the national treatment obligation is based on the use of corrective powers by supervisory authorities. To justify this interference, it must be demonstrated that the respective measure is designed to secure compliance with the GDPR and the right to continuous protection of personal data in Article 8 CFR.600 Furthermore, it must be demonstrated that the respective measure is necessary to secure such compliance. The corrective powers are designed to secure compliance with the right to continuous protection of personal data but because of the trade restrictiveness of the decision of a supervisory authority to use corrective powers to suspend or ban data transfers to a third country is high, reasonably available alternative measures must be assessed.

I submit that there are no alternative measures that would achieve the same level of protection. The GDPR itself already entails a scaled set of corrective powers in Article 58(2)(f) and (j) GDPR. A supervisory authority may only suspend data transfers according; it may impose a temporary limitation or ban on data transfers; and it may impose a definitive limitation or ban on data transfers. The national treatment violation caused by the corrective powers of supervisory authority would therefore satisfy the necessity test in Article XIV(c)(ii) GATS.

#### <IP_ADDRESS>.2 Chapeau

Interferences with the national treatment obligation in Article XVII GATS based on appropriate safeguards (Sect. <IP_ADDRESS>.2.1) and the corrective powers of supervisory authorities (Sect. <IP_ADDRESS>.2.2) must also be justified under the chapeau of Article XIV GATS.601

## <IP_ADDRESS>.2.1 Interference Based on Appropriate Safeguards

The EU would be able to make a prima facie case that there is no arbitrary or unjustifiable discrimination in the interference with the national treatment obligation based on the instruments providing appropriate safeguards in Article 46 GDPR. The

600WTO AB Report, Argentina – Financial Services, para. 6.202; WTO Panel Report, Argentina – Financial Services, paras 7.592–7.593; see Sect. <IP_ADDRESS>.1.

601WTO AB Report, EC – Seal Products, para. 5.303 (on Article XX GATT) with reference to WTO AB Report, Brazil – Retreaded Tyres, para. 226 (on Article XX GATT).

interference can be reconciled with the policy objective under Article XIV(c)(ii) GATS. The transfer of personal data presents a risk for individuals in the EU because information about them leaves the EU where the GDPR applies and can be enforced. This is the rationale of the discrimination because in contrast, domestic services and service suppliers do not necessarily require data transfers.

The EU would also be able to make a prima facie case that there is no disguised restriction on international trade because services and service suppliers in the EU must also use these instruments when they transfer personal data to a third country. Accordingly, the interference with the national treatment obligation can be justified under the chapeau of Article XIV GATS.

## <IP_ADDRESS>.2.2 Interference Based on Corrective Powers of Supervisory Authorities

The EU would also be able to make a prima facie case that there is no arbitrary or unjustifiable discrimination in the interference with the national treatment obligation based on the corrective powers of supervisory authorities. Supervisory authorities make use of their corrective powers to ban or suspend data transfers where data exporters infringe the right to continuous protection for personal data in Article 8 CFR.

Nevertheless, a complainant could, as Svetlana Yakovleva and Kristina Irion suggest, try to rebut the prima facie case and argue that the EU applies double standards when it comes to foreign internet surveillance.602 Should supervisory authorities—and ultimately the ECJ—require a higher standard for internet surveillance in third countries than applicable for the EU member states, then the interference with the national treatment obligation based on the corrective powers of supervisory authorities would amount to arbitrary and unjustifiable discrimination. Such a double standard could not be reconciled with the policy objective with respect to which the measure has been provisionally justified under the paragraphs of Article XIV GATS. However, I showed above that there are no double standards for foreign internet surveillance and the EU member states are bound to comply with the same requirements as third countries.603

The EU would also be able to make a prima facie case that there is no disguised restriction on trade by referring to the independence of supervisory authorities according to Article 8(3) CFR.604 Only when a complainant can successfully show that the use of corrective powers by supervisory authorities is not motivated by the protection of the right to continuous protection on personal data can there be a finding of a disguised restriction on international trade. The interference with the national treatment obligation caused by the corrective powers of supervisory authorities can therefore be justified under the chapeau of Article XIV GATS.

602Yakovleva and Irion (2020b), p. 11.

603See Sect. 2.4.3.

604See Sect. <IP_ADDRESS>.

## 4.4.5 Summary

The justification of interferences with GATS obligations caused by the EU's fundamental rights-based regulation of personal data focuses on the general exceptions in Article XIV. The economic integration exception in Article V GATS could be relevant to justify interferences with the MFN treatment obligation if the EU concluded a trade agreement with every country that has an adequacy decision. The security exception in Article XIV bis GATS is only relevant in situations of heightened tension or crisis. Finally, the confidentiality exception in Paragraph 5(d) of the Annex on Telecommunications can only justify interferences with the provisions of the annex.

I find that most of the interferences with GATS obligations can be provisionally justified under the general exceptions in Article XIV GATS. Only one interference fails provisional justification under the privacy exception in Article XIV(c)(ii) GATS: The interference with the domestic regulation obligation in Article VI:1 GATS caused by a fragmented application of the corrective powers of different supervisory authorities among EU member states. The trade restrictiveness of such a fragmentation is high. Subjecting the decisions of supervisory authorities to a mandatory consistency mechanism in Article 64(1) GDPR could be a reasonably available alternative measure that is consistent with the GATS because it guarantees the impartial application of these powers and preserves for the EU its right to achieve its desired level of protection for personal data.

In addition, some of the provisionally justified interferences fail the assessment under the chapeau of Article XIV GATS:

## 4.5 Conclusion

The rules of the multilateral trading system of the WTO can be used as proxies to distinguish legitimate regulation from protectionism. When applied to the EU's fundamental rights-based regulation of data transfers, they allow for the legal assessment of the line between data protection and data protectionism. The analysis above shows that the regulation of data transfers is largely compatible with WTO law. Seven interferences with obligations in the GATS have been identified. Most of them are justifiable under the privacy exception in Article XIV(c)(ii) GATS. The history of the privacy exception shows that the EC negotiated the WTO's trade agreement on services with great foresight. The EC pushed for the adoption of a privacy exception during the negotiations of the GATS with a view to its future data protection framework. Nevertheless, some aspects of the EU system for data transfers need further attention because they may not be justifiable under the privacy exception in Article XIV(c)(ii) GATS.

The first aspect concerns the application of adequacy decisions. Adequacy decisions interfere with the MFN treatment obligation in Article II:1 GATS. The AB maintained that the chapeau of the general exceptions demands "rigorous compliance with the fundamental requirements of due process." 605 This includes formal notice for a denial of an application or an explanation of the reasons for the denial.606 This interference with the MFN treatment obligation would amount to arbitrary or unjustifiable discrimination under the chapeau should a WTO member ask the EU for an adequacy decision and not receive an assessment by the EDPB. In order to comply with WTO law, the European Commission must ask the EDPB for an assessment of the level of protection for personal data in a third country when a third country asks for an adequacy decision, or, alternatively, issue a negative adequacy decision itself.

The second aspect concerns special framework adequacy decisions such as the invalidated Decision (EU) 2016/1250, the Privacy Shield adequacy decision. Special framework adequacy decisions are often tailor-made solutions for countries that otherwise would not qualify for a regular adequacy decision. They interfere with the MFN treatment obligation and the impartiality standard of the domestic regulation obligation. Should a new special framework adequacy decision come into force, this interference would amount to arbitrary or unjustifiable discrimination under the chapeau if the EU does not provide all WTO members with similar opportunities to negotiate a special framework for an adequacy decision. To comply with WTO law, the European Commission will have to stop negotiating special framework adequacy decision unless it is ready to initiate such negotiations with all interested WTO members. Since the EU already works towards adopting a special framework

605WTO AB Report, US – Shrimp, para. 182 (on Article XX GATT).

606Ibid., para. 183 (on Article XX GATT).

adequacy decision for the Transatlantic Data Privacy Framework with the US, an unjustifiable violation of the MFN treatment obligation is foreseeable.607

The third aspect concerns the administration of the corrective powers of supervisory authorities. The ECJ confirmed that supervisory authorities must suspend or ban transfers of personal data in cases in which the right to continuous protection of personal data in Article 8 CFR cannot be guaranteed and the data exporter refuses to take action.608 The suspension or ban of data transfers may lead to an interference with the MFN treatment obligation and the market access obligation. These interferences amount to arbitrary or unjustifiable discrimination under the chapeau if the administration of the corrective powers is inconsistent. For example, when supervisory authorities in different EU member states maintain different regimes for services and service suppliers in the same WTO member, or when a supervisory authority in an EU member state selectively uses its corrective powers for data transfers to certain WTO members and not for data transfers to other WTO members where similar deficiencies regarding data protection exist, and the selective use of the corrective powers thereby undermines the right to continuous protection of personal data. Such a fragmented use of the corrective powers of supervisory authorities also interferes with the impartiality standard of the domestic regulation obligation. The interference does not satisfy the necessity test of the privacy exception. Currently, supervisory authorities are not obliged to coordinate the use of their corrective powers. They may use the voluntary consistency mechanism in Article 64(2) GDPR to ask for an opinion from the EDPB, which all supervisory authorities should then implement. A requirement to use the mandatory consistency mechanism in Article 64(1) GDPR would be a reasonably available alternative measure that is consistent with the GATS because it guarantees the impartial application of these powers and preserves for the EU its right to achieve the desired level of protection. This would require a change in the GDPR. Supervisory authorities must be aware that they are responsible for complying with WTO law and use their corrective powers accordingly.

With regard to the interferences with the market access obligation and the interferences with the national treatment obligation, it is important to note that allegations that the EU maintains a higher standard for internet surveillance in third countries than applicable for EU member states do not challenge the compliance of the regulation of data transfers with the chapeau of the general exceptions. There are no double standards for foreign internet surveillance. The EU member states are bound to comply with the same requirements as third countries in the assessment of their level of protection for personal data.609

From the perspective of WTO law, the design of the EU system for data transfers does not constitute data protectionism. However, the analysis has revealed that the European Commission and the supervisory authorities in the EU member states must

607European Commission (2022a); European Commission (2022b).

608ECJ, Schrems 2, para. 113.

609See Sect. 2.4.3.

make sure the system is applied without protectionist side effects. The Commission must treat third countries equally when it comes to adequacy assessments and the supervisory authorities must coordinate their corrective powers and use them consistently in the same or similar situations. Lastly, special framework adequacy decisions should not be adopted as WTO law would then require the EU to offer the same possibilities to all other WTO members.

## References

## Bibliography

Chander A (2020) Is data localization a solution for Schrems II? J Int Econ Law 23:1–14

Mathew B (2003) The WTO Agreements on telecommunications. Peter Lang, Bern

Oesch M (2018) Switzerland and the European Union. Schulthess, Zurich

## Jurisprudence

## Documents

Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

# Chapter 5 Restrictions on Data Transfers and Trade Agreements

In reaction to the stalemate in the multilateral trading system, international governance of digital trade has gradually shifted toward bilateral and regional trade agreements. This allowed countries to start to regulating cross-border flows of personal data outside the WTO framework. The first section of this chapter traces the development of data flow clauses in the trade agreements of the EU, the US, and other countries. It also looks at the negotiations of the big trade agreements in the late 2010s, such as the TTIP, the TiSA, and the TPP (Sect. 5.1). The second section outlines the scope for data flow clauses in the trade agreements of the EU based on different legal requirements stemming from the architecture of EU law, the GDPR, and other regulations. These requirements include the primacy of fundamental rights over international law with regard to the right to continuous protection of personal data in Article 8 CFR, the accommodation of the legal mechanisms for the transfer of personal data in the GDPR, the inclusion of cooperation mechanisms on the basis of Article 50 GDPR, and the ban of data localization requirements beyond data protection and privacy concerns. These legal requirements are necessary to consider when drafting data flow clauses for EU trade agreements (Sect. 5.2). The third section of this chapter offers and analyzes four potential designs for data flow clauses for EU trade agreements (Sect. 5.3). The fourth section is dedicated to the analysis of the EU model data flow clauses that the European Commission introduced as a template for future trade negotiations in 2018 (Sect. 5.4).

## 5.1 Data Flow Clauses in Trade Agreements

The first section of this chapter is dedicated to the development of data flow clauses in trade agreements over the last two decades.1 The EU was the first to address crossborder flows of personal data in its trade agreements. Over time, the EU tried

1 See generally Burri (2021), pp. 26–41.

© The Author(s) 2023

T. Naef, Data Protection without Data Protectionism, EYIEL Monographs - Studies in European and International Economic Law 28,

different methods to accommodate its data protection regime (Sect. 5.1.1). On the international plane, the development of data flow clauses was significantly influenced by the negotiations of the big trade agreements in the 2010s, such as the TTIP, the TiSA, and the TPP (Sect. 5.1.2). The US started to include comprehensive data flow clauses in trade agreements only after they withdrew their signature from the TPP. Currently, the US aggressively tries to commit its trading partners to the free flow of personal data across borders (Sect. 5.1.3). Four examples of trade agreements from other countries complete the overview (Sect. 5.1.4).

## 5.1.1 Development in EU Trade Agreements

The EU has been the pioneer in including data flow clauses in its trade agreements.2 The following trade agreements of the EU represent the most important milestones in the development of data flow clauses: The EU-Algeria Association Agreement from 2002 (Sect. 1.1), the EU-CARIFORUM Economic Partnership Agreement from 2008 (Sect. 1.2), the EU-Canada Comprehensive Economic and Trade Agreement (CETA) from 2016 (Sect. 1.3), and the EU-Japan Economic Partnership Agreement (JEEPA) from 2018 (Sect. 1.4).

#### <IP_ADDRESS> EU-Algeria Association Agreement

The earliest provision addressing cross-border data flows in a trade agreement can be found in the EU-Algeria Association Agreement (AA) from 2002.3 The EU-Algeria AA does not contain a chapter on electronic commerce or digital trade. The provision on cross-border data flows is located in the chapter on competition and other economic matters:

#### Article 45

The Parties undertake to adopt appropriate measures to ensure the protection of personal data in order to eliminate barriers to the free movement of such data between the Parties.

It is remarkable that the EU and Algeria qualify data protection as a contributing factor to eliminating barriers to cross-border data flows in their AA.4 Prior, the protection of personal data or privacy was normally included as a legitimate public policy objective that legitimated deviations from other obligations in a trade

2 Contra Yakovleva (2020), p. 487.

3 Euro-Mediterranean Agreement establishing an Association between the European Community and its Member States, of the one part, and the People's Democratic Republic of Algeria, of the other part, 22 April 2002 [2005] OJ L 265/1.

4 Willemyns (2020), p. 237.

agreement.5 Article 45 EU-Algeria AA reflects EU-style data protection. The provision implies that cross-border flows of personal data are possible under the condition that an adequate level of protection for personal data be preserved.

#### <IP_ADDRESS> EU-CARIFORUM Economic Partnership Agreement

The EU tried a new approach in the EU-CARIFORUM Economic Partnership Agreement (EPA) from 2008.6 Article 119 EU-CARIFORUM EPA in the electronic commerce chapter of the trade agreement outlines the objective and the principles of the chapter. In the second paragraph, Article 119 connects electronic commerce with data protection:

## Article 119 Objective and principles

2. The Parties agree that the development of electronic commerce must be fully compatible with the highest international standards of data protection, in order to ensure the confidence of users of electronic commerce.

The provision does not directly address cross-border flows of personal data, but it mentions electronic commerce that relies on such data flows. The provision implies that cross-border flows of personal data are possible under the condition of the presence of an adequate level of protection for personal data. More specifically, the provision refers to the "highest international standards of data protection." The EU-CARIFORUM EPA also includes a full chapter on data protection to flesh out these standards. Article 197 describes the general objective of the chapter on data protection:

#### Article 197 General Objective

	- (a) their common interest in protecting fundamental rights and freedoms of natural persons, and in particular their right to privacy, with respect to the processing of personal data;
	- (b) the importance of maintaining effective data protection regimes as a means of protecting the interests of consumers, stimulating investor confidence and of facilitating transborder flows of personal data;

5 For example, Article XIV(c)(ii) GATS. See Sect. <IP_ADDRESS>.2.1.

6 Economic Partnership Agreement between the CARIFORUM States, of the one part, and the European Community and its Member States, of the other part, 16 December 2017, OJ L 289/I/3 [2008]. Another EPA that entails a separate chapter on data protection is the Interim Agreement with a view to an Economic Partnership Agreement between the European Community and its Member States, of the one part, and the Central Africa Party, of the other part, 17 December 2007 [2009] OJ L 57/1.

(c) that the collection and processing of personal data should be accomplished in a transparent and fair manner, with due respect accorded to the data subject,

agr pria sup ind hig ee to establish appropriate legal and regulatory regimes, as well as approte administrative capacity to implement them, including independent ervisory authorities, in order to ensure an adequate level of protection of ividuals with regard to the processing of personal data, in line with existing h international standards.7

2. The Signatory CARIFORUM States shall endeavour to implement the provisions of paragraph 1 as soon as possible and no later than seven years after the entry into force of this Agreement.

In line with Article 8 CFR, Article 197 EU-CARIFORUM EPA underlines the fundamental rights aspect of data protection in paragraph 1(a) and combines it with the facilitation of cross-border data flows in paragraph 1(b).8 The provision commits the parties to establish a data protection regime, as well as appropriate administrative capacity, including independent supervision, in order to ensure an adequate level of protection within a relatively short period of time. This is the first time that an EU trade agreement specifically refers to an adequate level of protection for individuals regarding the processing of personal data. Even if the provision refers to existing "high international standards," it is evident that the chapter on data protection specifically reflects EU-style data protection regulation. The data protection principles and the conditions for enforcement mechanism that follow in Article 199 EU-CARIFORUM EPA are a start to ensure a high standard of data protection when correctly implemented.9

The chapter on data protection is complemented with rules on cooperation in Article 201 EU-CARIFORUM EPA. They underline the importance of cooperation to facilitate the development of an adequate level of protection for personal data:

#### Article 201 Cooperation

1. The Parties acknowledge the importance of cooperation in order to facilitate the development of appropriate legislative, judicial and institutional frameworks as well as an adequate level of protection of personal data consistent with the objectives and principles contained in this Chapter.

7 Such standards are those included in the following international instruments:

(i). Guidelines for the regulation of computerised personal data files, modified by the General Assembly of the United Nations on 20 November 1990;

(ii). Recommendation of the Organisation for Economic Cooperation and Development Council concerning guidelines governing the protection of privacy and trans-border flows of personal data of 23 September 1980. 8

Fontoura Costa (2020), p. 487.

9 Ibid., 489.

The second paragraph of Article 201 entails a list of areas in which the parties agree to cooperate. For example, the list includes the exchange of information and expertise, assistance in drafting legislation, guidelines and manuals, and assistance with the design and implementation of compliance initiatives aimed at economic operators and consumers. Nevertheless, it would have been useful to also include compliance initiatives aimed at public authorities. Overall, the EU implemented essential parts of its data protection regulation in the EU-CARIFORUM EPA and used the trade agreement to lay the basis for an improvement of the level of protection for personal data in the contracting parties' legislative, judicial, and institutional frameworks.

#### <IP_ADDRESS> EU-Canada Comprehensive Economic and Trade Agreement

The EU abandoned the approach taken in the EU-CARIFORUM EPA and chose yet another approach in the CETA from 2016.10 The CETA does not include a general provision on the free flow of personal data across borders. This can be explained by the fact that Canada already had an adequacy decision from the EU. This means that the transfer of personal data from the EU to commercial organizations in Canada was already possible without the need for further safeguards.11 Yet the CETA does not include substantive rules on data protection either. Article 16.4 CETA on trust and confidence in electronic commerce only entails a very general reference to the regulation of data protection:12

## Article 16.4 Trust and confidence in electronic commerce

Each Party should adopt or maintain laws, regulations or administrative measures for the protection of personal information of users engaged in electronic commerce and, when doing so, shall take into due consideration international standards of data protection of relevant international organisations of which both Parties are a member.

The reference to international organizations is limited to the standards of the UN and the OECD as Canada is not a party to Convention 108, and the EU member states are not members of APEC. The OECD Privacy Guidelines pursue economic rather than broader normative goals of protecting personal data.13 The provision recognizes data protection as a necessary condition for spurring international trade

10Comprehensive Economic and Trade Agreement (CETA) between Canada and the European Union and its Member States, 30 October 2016 [2017] OJ L 11/23.

11Wolfe (2019), p. 73; Greenleaf (2018), p. 208.

12Streinz (2019), p. 335.

13Yakovleva (2018), p. 496. Cp. Sect. <IP_ADDRESS>.1.

and does not acknowledge its fundamental rights character as Article 197.1(a) of the EU-CARIFORUM EPA did.14

Moreover, the CETA does not restrict national or regional regulations even if they might interfere with the free flow of personal data across borders in fields covered by the agreement.15 The provision on cross-border flows of personal data concerning financial services in Article 13.15(2) CETA exempts EU data protection law from the scope of the CETA chapter on financial services:16

#### Article 13.15 Transfer and processing of information

2. Each Party shall maintain adequate safeguards to protect privacy, in particular with regard to the transfer of personal information. If the transfer of financial information involves personal information, such transfers shall be in accordance with the legislation governing the protection of personal information of the territory of the Party where the transfer has originated.

The CETA clearly makes a distinction between domestic data protection regulation and international trade law.17 The CETA does not contain any data protection obligations and there are no rules for cross-border flows of personal data in the trade agreement. The EU was careful to keep separate the regulation of data protection and trade rules.18 In addition, the EU started to shield its rules for the transfer of personal data from other obligations in the CETA as is evidenced by the provision on financial services in Article 13.15(2) CETA.

#### <IP_ADDRESS> EU-Japan Economic Partnership Agreement

In the negotiation of the JEEPA, the EU was faced with Japanese demands—likely inspired by the concurrent negotiations of the TPP—to include a general provision on cross-border flows of personal data.19 The EU was reluctant to include such provisions and resisted the Japanese demands until the end. Indeed, this disagreement emerged as the last big hurdle to the conclusion of the JEEPA.20 After five years of negotiations, the two parties achieved agreement at the EU-Japan Summit in 2017. In a joint declaration, Prime Minister Shinzo Abe and Commission President

14Cp. Wunsch-Vincent (2008), p. 520.

15Berka (2017), p. 179.

16Yakovleva and Irion (2020), p. 14.

17Irion and Bartl (2017), p. 5.

18But see Burri (2017), p. 107.

19Streinz (2019), p. 335. The EU also declined in 2013 to grant India what it called "data secure status" as part of the proposed trade agreement. According to Graham Greenleaf that would have meant the recognition of completely inadequate laws in India as being adequate. See Greenleaf (2014), pp. 432–433.

20Mucci et al. (2016).

Jean-Claude Juncker stressed the importance of ensuring "a high level of privacy and security of personal data as a fundamental right and as a central factor of consumer trust in the digital economy, which also further facilitate mutual data flows, leading to the development of digital economy." 21 They indicated that their respective data protection reforms offered new opportunities for simultaneous findings of adequacy. The JEEPA was successfully concluded in July 2018.22 In the end, the parties settled on a rendez-vous clause:

## Article 8.81 Free flow of data

The Parties shall reassess within three years of the date of entry into force of this Agreement the need for inclusion of provisions on the free flow of data into this Agreement.

In 2019, the EU Commission adopted an adequacy decision for Japan.23 The EU has thus continued to treat data protection and international trade law as two separate tracks with little middle ground. Only after the negotiations with Japan were effectively concluded did the Commission reach an internal compromise on a new template for horizontal provisions for cross-border data flows and data protection.24

## 5.1.2 Development in the Mega-Regional Trade Agreements

On the international plane, the development of data flow clauses was significantly influenced by the negotiations of the big trade agreements in the 2010s. The negotiations of the TTIP between the EU and the US were never completed but they showed how the two parties clashed over the issue of cross-border flows of personal data (Sect. <IP_ADDRESS>). The multilateral negotiations of the TiSA were not completed either. The proposals of the US for a data flow clause triggered a defensive reaction from the EU (Sect. <IP_ADDRESS>). In contrast, the multilateral negotiations for the TPP saw the inclusion of an intricate data flow clause, which was also integrated in the Comprehensive and Progressive Agreement for the Trans-Pacific Partnership (CPTPP) after the US withdrew its signature from the TPP (Sect. <IP_ADDRESS>).

21European Commission (2017b).

22Agreement between the European Union and Japan for an Economic Partnership, 17 July 2018 [2018] OJ L 330/3.

23Commission Implementing Decision (EU) 2019/419 of 23 January 2019 pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information, [2019] OJ L 76/1.

24Streinz (2019), p. 335. See Sect. 5.4.

#### <IP_ADDRESS> Transatlantic Trade and Investment Partnership

The TTIP was a proposed trade agreement between the US and the EU. While the idea for such an agreement had been circulating for more than a decade, formal negotiations only started in 2013. Several negotiation rounds took place in the following years and efforts to wrap-up negotiation in late 2016—before the new US administration took office—failed. The negotiations were subsequently halted by US President Donald Trump. After the US left the Paris Agreement on Climate Change, the Council of the EU decided in 2019 that the negotiating directives for the TTIP had become obsolete.25

In the beginning of the negotiations, EU Justice Commissioner Viviane Reding stated that data protection issues had been cut out of the TTIP as a result of "a political decision by the US and EU." 26 She also warned against bringing data protection to the trade talks at a conference in Washington D.C., indicating that the US would not be very happy with the exclusion of cross-border flows of personal data under the TTIP. She said that "[t]here are challenges to get [the TTIP] done and there are issues that will easily derail it. One such issue is data and the protection of personal data." 27 Nevertheless, US Trade Representative Michael Froman never publicly said that data protection should be off the agenda.28

The leaked draft text of the TTIP from 2016 did not include a provision on crossborder flows of personal data.29 The leaked EU note on the tactical state of play in the TTIP negotiations from March 2016 summarized that "[d]iscussions on e-commerce covered all proposals except for the provisions on data flows and computing facilities." Nevertheless, the note also indicated that "[t]he US signaled that progress on [...] key EU interests might be accelerated if discussions on data flows and computing facilities also advanced faster." It is safe to assume that crossborder flows of personal data were repeatedly a topic on the agenda. This is probably also the reason why the European Parliament asked the Commission to ensure that the EU's acquis on data privacy was not compromised through the liberalization of data flows.30 The Parliament recommended that a comprehensive and unambiguous horizontal self-standing provision based on Article XIV GATS should be incorporated into the TTIP to fully exempt the existing and future EU legal framework on the protection of personal data.31 Interestingly, the recommendations of the Parlia-

25Council of the EU (2019), Article 3.

26Fleming (2013). See also European Commission (2013a).

27European Commission (2013b).

28Fleming (2013).

29The negotiation documents were leaked by Wikileaks. The documents are available on their website.

30European Parliament (2015), Article 2(b) xii.

31Ibid.

ment allowed the negotiation of a data flow clause if the full application of data protection rules on both sides of the Atlantic was guaranteed.32

The negotiations of the TTIP confirm that the EU once again decided to separate the regulation of data protection from international trade law and to shield its rules for the transfer of personal data from other obligations in trade agreements. It is questionable whether the US would ever have agreed to a trade agreement without rules enabling cross-border flows of personal data. Such rules have become more important for the US when the Privacy Shield was invalidated and the possibility to use the instruments in Article 46 GDPR has become unsure. They will continue to be important because eventually the adequacy decision for the new Transatlantic Data Privacy Framework, which is currently in preparation, will be challenged and its validity will not be evident.33

#### <IP_ADDRESS> Trade in Services Agreement

Due to the lack of progress in the negotiations at the WTO, some WTO members formed a sub-group called the Really Good Friends (RGF) in 2012 to discuss the possibility of a services liberalization agreement. Led by the US and the EU, the RGF consisted of more than 20 countries including Australia, Canada, Japan, the Republic of Korea, Switzerland, Colombia, and Mexico. Negotiations for the TiSA started immediately after the formation of the sub-group. Over 20 full negotiation rounds took place in Geneva in the following years. Just as with the TTIP, efforts to wrap-up the negotiations in late 2016 failed. The negotiations are currently suspended and the future of the TiSA is unclear.

One of the reasons why the TiSA was not successfully concluded were the controversies over rules on cross-border flows of personal data.34 A leaked US negotiation document from 2014 titled "Proposal of New Provisions Applicable to All Services" suggested the inclusion of a provision on movement of information:35

#### Article X.4

No Party may prevent a service supplier of another Party from transferring, accessing, processing or storing information, including personal information, within or outside the Party's territory, where such activity is carried out in connection with the conduct of the service supplier's business.

32Ibid.

33noyb (2022).

34Yakovleva (2018), p. 496.

35The negotiation documents were leaked by Wikileaks. The documents are available on their website.

This proposal for a data flow clause in the TiSA did not include any exception for the protection of personal data.36 According to other leaked negotiation documents from 2015 and 2016, the provision was later included as Article 2 in the negotiating text of the TiSA Annex on Electronic Commerce. The annotated negotiation documents show that many countries considered exceptions or conditions for this provision, so as to allow more flexibility for domestic regulation. For instance, Hong Kong proposed that "[t]here should be a balance between free movement of information across border and protection of personal data. Advancing the former cause should be without prejudice to safeguarding the latter right." 37 Switzerland also proposed to include safeguards that "[e]ach party applies its own regulatory regime concerning the transfer of data and personal data by electronic means."

The leaked negotiation documents also indicated that the TiSA Annex on Localization sought to ban "local presence" and other "local performance" requirements. It is unclear whether restrictions on cross-border flows of personal data based on domestic data protection regulation would have been included in this ban. The exceptions do not mention data protection related safeguards.

The European Commission did not comment on the data flow clauses in the negotiation documents because it was waiting for the final agreement on the Privacy Shield with the US before addressing the issue of cross-border flows of personal data in the TiSA negotiations. Nevertheless, the European Parliament took a firm stand on the regulation of cross-border flows of personal data in the TiSA. It recommended that the Commission take a cautious approach to the negotiation of chapters concerning data and privacy protection. It suggested the incorporation of a comprehensive, unambiguous, horizontal, self-standing, and legally binding provision based on Article XIV GATS, which would fully exempt the existing and future EU legal framework for the protection of personal data from the scope of the TiSA.38 Negotiations have not been resumed since 2017.

## <IP_ADDRESS> Comprehensive and Progressive Agreement for Trans-Pacific Partnership

The TPP was a trade agreement between Australia, Brunei, Canada, Chile, Japan, Malaysia, Mexico, New Zealand, Peru, Singapore, Vietnam, and the US signed in 2016. It was not ratified and could not enter into force because US President Donald Trump withdrew the US signature from the TPP in 2017. The remaining countries negotiated a new trade agreement called the CPTPP that incorporated most of the provisions from the TPP and entered into force in 2018.

36Berka (2017), p. 180; Kelsey and Kilic (2014), pp. 15–16.

37Burri (2017), p. 124.

38European Parliament (2016), Paragraph 1(c)ii., iii. and v.

The US significantly shaped the design of the provision on cross-border flows of personal data during the negotiations of the TPP, which was integrated without changes into the CPTPP:

#### Article 14.11 Cross-Border Transfer of Information by Electronic Means

	- (a) is not applied in a manner which would constitute a means of arbitrary or unjustifiable discrimination or a disguised restriction on trade; and
	- required to achieve the objective. (b) does not impose restrictions on transfers of information greater than are

The first paragraph of the provision introduces the data flow clause by recognizing the differences between regulatory regimes for cross-border flows of personal data. The second paragraph entails the obligation to allow cross-border flows of personal data by electronic means for the conduct of business. This is the first time a provision explicitly formulates a commitment to the free flow of personal data across borders. Nevertheless, the third paragraph allows derogations from this obligation for legitimate public policy objectives under two conditions. It can be assumed that data protection and privacy qualify as legitimate public policy objectives under this provision. The first condition for the derogation demands compliance with the standards that can also be found in the chapeau of Article XIV GATS. The second condition refers to restrictions that should not be greater than required to achieve the objective pursued by the measure in question. It is not entirely clear what kind of standard the second condition foresees. The use of the word required might imply that the test should be easier than a necessity test. However, only the English and the Spanish version of the CPTPP use language that does not hint at a necessity test. The French version clearly refers to a necessity test.

In addition, the parties recognize in Article 14.8 CPTPP that the economic and social benefits of protecting the personal data of users of electronic commerce as well as the contribution that this makes to enhancing consumer confidence in electronic commerce. However, the parties do not refer to the fundamental rights character of data protection. It must be assumed that the CPTPP, which is the only mega-regional trade agreement in force, is likely to set international standards for data flow clauses in future trade agreements.

## 5.1.3 Development in US Trade Agreements

Although the US was not the first mover when it came to data flow clauses in trade agreements, they have extensively pursued this option in more recent years. The trade agreement with the Republic of Korea from 2012 was the first attempt by the US to get some form of commitment to the free flow of personal data across borders (Sect. <IP_ADDRESS>). The US intensified their efforts to include strong obligations for cross-border flows of personal data in the negotiations of the TTIP, the TiSA, and the TPP. After the withdrawal of its signature from the TPP, the US started to include stronger obligations on cross-border flows of personal data in trade agreements such as the United States-Mexico-Canada Agreement (USMCA) from 2018 (Sect. <IP_ADDRESS>) and the US-Japan Digital Trade Agreement from 2019 (Sect. <IP_ADDRESS>).

#### <IP_ADDRESS> US-South Korea Free Trade Agreement

The trade agreement with the Republic of Korea from 2012 (KORUS) was the first US trade agreement to include a provision on the free flow of personal data across borders.39 The provision on cross-border information flows is located in Article 15.8 of the e-commerce chapter in the KORUS:

#### Article 15.8 Cross-Border Information Flows

Recognizing the importance of the free flow of information in facilitating trade, and acknowledging the importance of protecting personal information, the Parties shall endeavor to refrain from imposing or maintaining unnecessary barriers to electronic information flows across borders.

The provision refers to personal data, but the importance of protecting it is put in strong contrast with a call on the parties to endeavor to refrain from imposing or maintaining unnecessary barriers to cross-border flows of personal data. There are no further indications as to what constitutes a "necessary" or "unnecessary" barrier in the KORUS. It is also not clear whether domestic rules on cross-border flows of personal data are considered necessary or not. Because the language used in the provision is not actionable,40 it is uncertain if one party could use it to challenge another party's restrictions on cross-border flows of personal data.41

Article 15.8 of the e-commerce chapter in the KORUS is the first attempt by the US to include some form of commitment to the free flow of personal data across borders. Two other US trade agreements from 2012—one with Colombia and one with Panama—do not contain any similar provisions.

39Wu (2017), p. 23; Aaronson (2015), p. 687.

40Yakovleva (2020), p. 487; Wu (2017), p. 23; Burri (2019), pp. 95–96; Aaronson (2015), p. 687.

41Aaronson and Townes (2012), p. 6.

#### <IP_ADDRESS> United States-Mexico-Canada Agreement

The US actively participated in the negotiations of the TPP and signed the trade agreement in 2016. One year later, President Donald Trump decided to withdraw the US signature.42 In consequence, the US used the renegotiation of the North America Free Trade Agreement in 2018 to set new standards for data flow clauses in their trade agreements.43 The provision on the cross-border transfer of information by electronic means is located in Article 19.11 of the digital trade chapter in the USMCA:

#### Article 19.11 Cross-Border Transfer of Information by Electronic Means

	- (a) is not applied in a manner which would constitute a means of arbitrary or unjustifiable discrimination or a disguised restriction on trade; and
	- necessary to achieve the objective.44 (b) does not impose restrictions on transfers of information greater than are

Compared with Article 15.8 KORUS, Article 19.11(1) USMCA is an actionable provision that uses strong language to install an obligation on the parties to refrain from prohibiting or restricting the cross-border transfer of information, including personal information, for the conduct of business.45 The exception in Article 19.11(2) USMCA require the party imposing a prohibition or restriction on cross-border flows of personal data to justify its measures. The exceptions present a significant burden for any regulation of cross-border flows of personal data. A measure inconsistent with Article 19.11(1) USMCA must be necessary for a legitimate public policy objective and not be applied in a manner which would constitute a means of arbitrary or unjustifiable discrimination, or a disguised restriction on trade. These conditions are

42Removing the US from the TPP was one of President Donald Trump's first decisions in office. Nevertheless, the administration of President Barack Obama significantly shaped the design of the provision on cross-border data flows during the negotiations of the TPP.

43The USTR mentions the establishment of "rules to ensure that NAFTA countries do not impose measures that restrict cross-border data flows and do not require the use or installation of local computing facilities" in the official summary of objectives for the NAFTA renegotiation. See USTR (2017), p. 9.

44A measure does not meet the conditions of this paragraph if it accords different treatment to data transfers solely on the basis that they are cross-border in a manner that modifies the conditions of competition to the detriment of service suppliers of another Party.

45Willemyns (2020), p. 237.

similar to the general exceptions in Article XIV GATS.46 However, there is an additional condition in Article 19.11(2)(b) USMCA entailing a separate necessity test that is qualified in a footnote. Differential treatment of data flows solely on the basis that they are cross-border in a manner that modifies the conditions of competition cannot satisfy the additional necessity test in Article 19.11(2)(b) USMCA.47 This qualification in the footnote seems to be difficult to satisfy with domestic data protection rules that entail legal mechanisms for the transfer of personal data with separate requirements.48

There are some essential differences between Article 14.11 CPTPP and Article 19.11 USMCA. The CPTPP introduces the provision on cross-border flows of persona data with a recognition of the differences between regulatory regimes. Such an accommodating introductory clause is absent from the USMCA. Furthermore, the chapeau of the derogations in the CPTPP does not include a necessity test like the USMCA does. The English version of the CPTPP refers to restrictions that should not be greater than required to achieve the objective. The USMCA also entails a second necessity test, which is further qualified in a footnote. It seems that the USMCA is less permissive than the CPTPP of restrictions on crossborder flows of personal data for data protection or privacy. The data flow clause in the USMCA is in line with the US digital trade agenda. It is an expression of the US view that data protection is an impediment to digital trade and therefore in need of justification.49

In addition, the provision on cross-border data flows in Article 19.11(1) USMCA takes precedence over a long and detailed provision on personal information protection in Article 19.8 USMCA:

#### Article 19.8: Personal Information Protection

46See Sect. <IP_ADDRESS>.2.

47Svetlana Yakovleva has noted that despite the differences between US- and EU-led trade agreements, they have one trait in common: "they are not formulated as non-discrimination provisions." This is not entirely correct when looking at the qualification in the footnote in Article 19.11(2)(b) USMCA, which entails such a non-discrimination obligation. See Yakovleva (2020), p. 497.

48See also Streinz (2019), p. 332.

49Ibid., 334.

50For greater certainty, a Party may comply with the obligation in this paragraph by adopting or maintaining measures such as comprehensive privacy, personal information or personal data protection laws, sector-specific laws covering privacy, or laws that provide for the enforcement of voluntary undertakings by enterprises relating to privacy.

Privacy Framework and the OECD Recommendation of the Council concerning Guidelines governing the Protection of Privacy and Transborder Flows of Personal Data (2013).

	- (b) an enterprise can comply with legal requirements.

The provision on personal information protection uses weak language for the substantive protection for personal data.51 While Article 19.8(1) USMCA recognizes the contribution of data protection to enhancing consumer confidence in digital trade, it does not mention data protection as a fundamental right. According to Article 19.8(2) USMCA, the parties should adopt a legal framework that provides for the protection of personal data. However, a footnote clarifies that sector-specific laws or laws that provide for the enforcement of voluntary undertakings by enterprises are enough to comply with this obligation.52 This approach is tailored to the US patchwork regulation concerning data privacy.53 It is evident that such a legal framework for the protection of personal data does not have to include the public sector and extend to internet surveillance practices. Even though Article 19.8(3) USMCA entails important data protection principles and highlights the importance of ensuring compliance with measures to protect personal data, it also underlines that any restrictions on cross-border flows of personal information must be necessary and

51Streinz (2019), p. 334.

52Geist (2018).

53Wolfe (2019), p. 74.

proportionate to the risks presented. This is a reference to the obligations on crossborder data flows in Article 19.11 USMCA, which accordingly takes precedence over the protection of personal data. Finally, Article 19.8(6) USMCA encourages the parties to promote compatibility between different legal approaches to data protection and explicitly recognizes that the APEC Cross-Border Privacy Rules system based on the accountability principle is a valid mechanism for cross-border data flows.

#### <IP_ADDRESS> US-Japan Digital Trade Agreement

The US-Japan Digital Trade Agreement was signed in 2019, along with the US-Japan Trade Agreement. The provisions on digital trade from the USMCA have been included, almost verbatim, in the digital trade agreement with Japan. It seems that these provisions have become the model for data flow clauses in future US-led trade agreements.54 Article 11 of the US-Japan Digital Trade Agreement even entails the same restrictive qualification in the footnote of the exception to the prohibition of restrictions on cross-border data flows.

## 5.1.4 Development in Non-EU/US Trade Agreements

Trade agreements without the EU or the US as a party also include data flows clauses. Four recent examples show the development of data flow clauses outside the EU and the US: the Costa Rica-Colombia trade agreement from 2013 (Sect. <IP_ADDRESS>), the Mexico-Panama trade agreement from 2014 (Sect. <IP_ADDRESS>), the China-Republic of Korea trade agreement from 2015 (Sect. <IP_ADDRESS>), and the Sri Lanka-Singapore trade agreement from 2018 (Sect. <IP_ADDRESS>).

#### <IP_ADDRESS> Costa Rica-Colombia Trade Agreement

The Costa Rica-Colombia trade agreement was signed in 2013. It is one of many trade agreements that uses regulatory cooperation to facilitate cross-border flows of personal data:55

54Yakovleva and Irion (2020), p. 13. These provisions are also included in the US proposal for the electronic commerce negotiations at the WTO. See Sect. <IP_ADDRESS>.

55Willemyns (2020), p. 237; Wu (2017), p. 23.

## Artículo 16.7 Cooperación

	- b) compartir información y experiencias sobre leyes, regulaciones, y programas en el ámbito del comercio electrónico, incluyendo aquellos relaci-onados con privacidad de datos, confianza del consumidor, seguridad en las comuni-caciones electrónicas, autenticación, de-rechos de propiedad intelectual, y gobierno electrónico;
	- electrónico; c) trabajar para mantener los flujos transfronterizos de información como un elemento esencial en el fomento de un entorno dinámico para el comercio

The trade agreement between Costa Rica and Colombia does not go beyond a declaration of intent on cooperation. Very often such provisions on cooperation are "just the equivalent of trade negotiators throwing in the towel on an issue where no perceivable consensus is apparent, or inserting verbiage to provide some filler to a given treaty text." 56 This is also apparent in the provision on the protection of personal data:

## Artículo 16.7 Protección de la Información Personal

In this case, the parties advise each other to endeavor to adopt data protection laws and only commit to do their best to exchange information about them. Nevertheless, the two countries acknowledge the importance of data protection for the users of electronic commerce.

## <IP_ADDRESS> Mexico-Panama Trade Agreement

The Mexico-Panama trade agreement was signed in 2014. It stands out as a trade agreement between two developing economies with a binding commitment on crossborder flows of personal data:

56Lacey (2020), p. 202.

#### Artículo 14.10 Flujo Transfronterizo de Información

Cada Parte permitirá que sus personas y las personas de la otra Parte transmitan información electrónica, desde y hacia su territorio, cuando sea requerido por dicha persona, de conformidad con la legislación aplicable en materia de protección de datos personales y tomando en consideración las prácticas internacionales.

In this case, the two parties agreed to allow transmissions of electronic information to and from their territory in accordance with data protection legislation and following international practices.57 The reference to data protection legislation and international practices is open to different interpretations. It could indicate that the commitment to cross-border flows of personal data in the trade agreement is subject to domestic legislation that regulates such data flows for the protection of personal data. It could also mean that domestic legislation should accommodate the obligation on cross-border flows of personal data under consideration of international practices. The provision on data protection in the Mexico-Panama trade agreement does not resolve the ambiguity of the interpretation:

#### Artículo 14.8 Protección de Datos Personales

Las Partes fomentarán la adopción o mantenimiento de leyes y regulaciones para la protección de los datos personales de los usuarios del comercio electrónico. Las Partes tomarán en consideración las prácticas internacionales que existen en esta materia.

The provision encourages the parties to adopt or maintain data protection legislation and requires them to consider international practices when doing so. In any case, the provision is subject to general exceptions like those in Article XIV GATS, which were included in Article 19.2(2) Mexico-Panama trade agreement mutatis mutandis. 58

#### <IP_ADDRESS> China-Republic of Korea Trade Agreement

The China-Republic of Korea trade agreement was signed in 2015. The two parties address data protection with a rather weak provision:

#### Article 13.5 Protection of Personal Information in Electronic Commerce

Recognizing the importance of protecting personal information in electronic commerce, each Party shall adopt or maintain measures which ensure the protection of the personal information of the users of electronic commerce and share

57Wu (2017), p. 23.

58Monteiro and Teh (2017), p. 50.

information and experience on the protection of personal information in electronic commerce.

In this case, the two parties recognize the importance of protecting the personal data of users of electronic commerce.59 It is interesting that China included a provision on data protection, a value it does not seem to implement domestically.60 It is also notable that the provision includes an obligation to share information and experiences on the protection of personal information in electronic commerce. This seems like a cooperation commitment in order to address any obstacles that may arise in the cross-border flow of personal data between the two countries.

#### <IP_ADDRESS> Sri Lanka-Singapore Trade Agreement

The Sri Lanka-Singapore trade agreement was signed in 2018. The influence of the CPTPP on the data flow clause in the Sri Lanka-Singapore trade agreement cannot be overlooked—even if Sri Lanka is not a member of the CPTPP.61 The provision on cross-border flows of personal data in the electronic commerce chapter of the Sri Lanka-Singapore trade agreement is essentially the same:

## Article 9.9 Cross-Border Transfer of Information by Electronic Means

However, an important difference between the data flow clauses in the Sri Lanka-Singapore trade agreement and the CPTPP can be found in the exception. The condition in the CPTPP that a measure may not impose restrictions on transfers of information greater than required to achieve its legitimate objective is not replicated in Article 9.9(3) of the Sri Lanka-Singapore trade agreement. The Sri Lanka-Singapore trade agreement is more permissive of restrictions on cross-border flows of personal data. Restrictions must be adopted to achieve a legitimate public policy objective such

59Ibid., 51–52.

60Willemyns (2020), p. 238; Weber et al. (2020), p. 569.

61Cp. Burri (2017), p. 128.

as the protection of personal data and they have to satisfy the conditions that can also be found in the chapeau of the general exceptions in Article XIV GATS.

## 5.1.5 Summary

The first data flow clauses in EU and US trade agreements illustrate their respective positions on data protection-based restrictions for cross-border flows of personal data perfectly. The EU sees data protection as a precondition for trade whereas the US perceives it as a potential trade barrier akin to data protectionism. In line with its digital trade agenda, the US pushed for a binding commitment on cross-border flows of personal data in the negotiations of the mega-regional trade agreements in the 2010s. After the US withdrew its signature from the TPP, it used the USMCA to set new standards for data flow clauses. The USMCA is currently the trade agreement with the strongest obligation on cross-border flows of personal data.62 It prohibits the parties from restricting the free flow of personal data and imposes strict conditions for exceptions, including the standards from the chapeau of Article XIV GATS and two necessity tests, one of which is further qualified in a footnote. This provision has become the model for US-led trade agreements. At the same time, the provision in the CPTPP has become the model for new trade agreements of its members, as the Sri Lanka-Singapore trade agreement from 2018 shows.

The EU tried different approaches in its trade agreements. It used the EU-CARIFORUM EPA from 2008 to underline the fundamental rights character of data protection. This agreement committed the parties to establish a data protection regime, as well as appropriate administrative capacity, including independent supervision, in order to ensure an adequate level of protection and facilitate crossborder flows of personal data. In contrast, the CETA from 2016 only contains a very general reference to data protection. The CETA clearly makes a distinction between domestic data protection regulation and international trade law.63 The CETA does not contain any data protection obligations anymore, and it includes no rules for cross-border flows of personal data. The EU separated the regulation of data protection from trade rules.64 In addition, the EU started to shield its rules for the transfer of personal data from other obligations in the CETA as the provision on cross-border flows of personal data concerning financial services in Article 13.15(2) CETA shows.

62Willemyns (2020), p. 237.

63Irion and Bartl (2017), p. 5.

64But see Burri (2017), p. 107.

## 5.2 Legal Requirements for Data Flow Clauses in EU Trade Agreements

The second section of this chapter is dedicated to the legal requirements for data flow clauses in EU trade agreements. The architecture of EU law, the right to continuous protection of personal data in Article 8 CFR, the GDPR, and other regulations impose requirements upon the EU for the inclusion of data flow clauses in trade agreements. The most important requirement is the primacy of fundamental rights over international law (Sect. 5.2.1). In addition, data flow clauses in EU trade agreements should accommodate legal mechanisms for the transfer of personal data in the GDPR (Sect. 5.2.2). The GDPR also encourages the EU to develop means for cooperating with third countries in the field of data protection (Sect. 5.2.3). Finally, the GDPR and Regulation (EU) 2018/1807 on a framework for the free flow of non-personal data in the EU entail requirements for a ban on data localization obligations of third countries that are not motivated by data protection or privacy (Sect. 5.2.4).

## 5.2.1 Respecting the Primacy of Fundamental Rights Over International Law

The first legal requirement for data flow clauses in EU trade agreements is the primacy of fundamental rights over international law. This requires a brief explanation of the relationship between primary EU law and international law (Sect. <IP_ADDRESS>) before it is possible to discuss the implications for data flow clauses in EU trade agreements (Sect. <IP_ADDRESS>).

#### <IP_ADDRESS> The Relationship of Primary Union Law and International Law

Primary Union law is above international law in the hierarchy of the legal order in the EU (Sect. <IP_ADDRESS>.1). The ECJ has two important competences with regard to this subordination of international law: The Court can a priori examine the lawfulness of a proposed international agreement according to the opinion procedure in Article 218(11) TFEU (Sect. <IP_ADDRESS>.2) and the Court can a posteriori review the lawfulness of an international agreement with regard to the EU Treaties in an annulment procedure according to Article 263 TFEU or in a preliminary ruling procedure according to Article 267(b) TFEU (Sect. <IP_ADDRESS>.3).

### <IP_ADDRESS>.1 Hierarchy in the Legal Order

Primary Union law is derived from the EU Treaties, the Charter based on Article 6(1) TEU since the adoption of the Lisbon Treaty in 2009, and the general principles of law established by the ECJ.65 The EU Treaties do not regulate expresis verbis the hierarchical position of international agreements within the legal order of the EU.66 Article 216 TFEU only states that international agreements concluded by the EU are binding upon the institutions of the Union and on its member states. The ECJ endorsed early on that international agreements concluded by the EU form an integral part of Union law from the moment of their entry into force.67

## <IP_ADDRESS>.2 A Priori Examination of International Agreements by the European Court of Justice

An important competence of the ECJ with regard to the subordination of international law is that the Court can a priori examine the lawfulness of a proposed international agreement according to the opinion procedure in Article 218(11) TFEU: any member state, the European Parliament, the Council or the Commission may seek the opinion of the ECJ on the compatibility of a proposed international agreement with the EU Treaties.68 This examination also extends to the Charter and the general principles of law established by the ECJ.69 Should the ECJ find an incompatibility, the proposed agreement may only enter into force if it is amended.

## <IP_ADDRESS>.3 A Posteriori Review of International Agreements by the European Court of Justice

Another important competence of the ECJ with regard to the subordination of international law is that the Court can a posteriori review the lawfulness of an international agreement with regard to the EU Treaties in an annulment procedure according to Article 263 TFEU or via a preliminary ruling procedure according to Article 267(b) TFEU.70 This review power also extends to the Charter and the general principles of law established by the ECJ.

65Craig and de Búrca (2017), p. 111; Lenaerts and Van Nuffel (2011), p. 753.

66Mohay (2017), p. 157; van Rossem (2009), p. 194; Van Vooren and Wessel (2014), p. 211, 221; Lenaerts and Van Nuffel (2011), p. 817.

67ECJ, R. & V. Haegeman v Belgian State, para. 5; Van Vooren and Wessel (2014), p. 211; Eeckhout (2011), p. 327.

68Cp. ECJ, Opinion 2/15, para. 305 and ECJ, Opinion 1/15, para. 232; Mohay (2017), p. 153; see generally Craig and de Búrca (2017), pp. 369–371; Eeckhout (2011), pp. 268–274.

69Cp. ECJ, Opinion 1/17, para. 237 and ECJ, Opinion 1/15, para. 119; Cremona (2020), p. 3, 10.

70Cp. ECJ, Western Sahara Campaign UK, paras 36–37; ECJ, Parliament v. Council and Commission, paras 67–70 and ECJ, Germany v. Council, para. 72. Importantly, the annulment by the

The ECJ has previously annulled decisions of the Council approving an international agreement because of a breach of the general principles of Community law. In Germany v. Council, the ECJ annulled the first indent of Article 1(1) of Council Decision 94/800/EC of 22 December 1994 approving the Framework Agreement on Bananas concluded by the EC and certain third countries, because it violated the general principle of non-discrimination.71 Article 264 TFEU holds that if an action is well-founded, the ECJ should declare the act concerned to be void and, if the Court considers this necessary, state which of the effects of the act that has been declared void should be considered as definitive. The power to determine the date at which the annulment of the act becomes effective and to what extent is important to prevent the annulment from resulting in a legal vacuum.72

An annulment by the ECJ merely invalidates the internal act of conclusion of an international agreement with the consequence that the agreement is inapplicable within the EU but remains valid on the international plane.73 When the ECJ annulled Council Decision 2004/496/EC of 17 May 2004 approving the PNR agreement with the US and the underlying adequacy decision, the Court recognized that the EC cannot rely on its own law as a justification for not fulfilling the agreement, which remains applicable for a period of 90 days from termination thereof, and preserved the effect of the decision on adequacy until the end of that period.74

#### <IP_ADDRESS> Implication for the Design of Data Flow Clauses

Any EU international trade commitment must respect the provisions of the EU Treaties and the Charter.75 This includes the right to data protection in Article 8 CFR. In order to ensure the lawfulness of a data flow clause, the European Commission must respect Article 8 CFR when negotiating trade agreements. This also concerns the right to continuous protection of personal data that is transferred from the EU to a third country, which is an unwritten constituent part of Article 8 CFR. It is therefore important to recognize and state in a trade agreement that the protection of personal data is a fundamental right, and that the protection of personal data must continue when it is transferred across borders.

There are two options for the EU to deal with the primacy of fundamental rights over international law when negotiating data flow clauses in trade agreements. The

ECJ merely invalidates the internal act of conclusion of an international agreement with the consequence that the agreement is inapplicable within the EU but remains valid on the international plane. Peters (1997), p. 76; see generally Eeckhout (2011), pp. 292–298.

71ECJ, Germany v. Council, para. 72.

72Cp. ECJ, Parliament v. Council, para. 88 and ECJ, Commission v. Council, para. 57; Barents (2004), p. 259.

73Peters (1997), p. 76.

74ECJ, Parliament v. Council and Commission, paras 68–74.

75Van Waeyenberge and Pecho (2014), p. 752; Gstöhl and Hanf (2014), p. 745 fn. 61.

first option does not include a commitment to the free flow of personal data across borders and focuses on carving-out data protection from an agreement. The second option includes a commitment to the free flow of personal data across borders and focuses on aligning this commitment with the right to continuous protection of personal data. Should a commitment to the free flow of personal data be integrated into a trade agreement of the EU, it must guarantee that the transfer of personal data can be restricted should the level of protection for personal data not be essentially equivalent to that guaranteed within the EU in cases in which personal data is transferred to a contracting party or parties. This is especially important in cases in which foreign internet surveillance practices capture personal data that is transferred from the EU to the surveilling third country.

## 5.2.2 Accommodating the Legal Mechanisms for Data Transfers

The accommodation of the legal mechanisms for the transfer of personal data in the GDPR is the second legal requirement for data flow clauses in EU trade agreements. This requires a brief explanation of the relationship between secondary Union law and international law (Sect. <IP_ADDRESS>) before it is possible to discuss the implications for data flow clauses in FTAs of the EU (Sect. <IP_ADDRESS>).

#### <IP_ADDRESS> The Relationship of Secondary Union Law and International Law

International law is above secondary Union law in the hierarchy of the legal order in the EU (Sect. <IP_ADDRESS>.1). The ECJ may review secondary Union law in light of an EU international agreement in an annulment procedure according to Article 263 TFEU or in a preliminary ruling procedure according to Article 267(b) TFEU. However, the ECJ has not always acknowledged international agreements concluded by the EU as a standard for the review of secondary Union law. The question of review has been linked to the issue of the direct effect of international agreements (Sect. <IP_ADDRESS>.2).

#### <IP_ADDRESS>.1 Hierarchy in the Legal Order

Subject to the EU Treaties, institutions of the Union and its member states are bound by international agreements through Article 216 TFEU. International law holds a superior position in the hierarchy of the EU legal order than secondary Union law.76 Given the primacy of international law over secondary Union law, the courts of the EU and its member states must ensure that secondary Union law and national legislation is interpreted as far as possible in conformity with the obligations contained in international agreements concluded by the EU.77 However, a conforming interpretation is not possible in circumstances in which secondary Union law or national legislation clashes with an international agreement, and in which conformity would lead to an interpretation contra legem. 78

#### <IP_ADDRESS>.2 Review of Secondary Law in Light of International Agreements by the European Court of Justice

It follows from the hierarchy of the EU legal order that the lawfulness of secondary Union law, which is contrary to an EU international agreement, may be reviewed by the ECJ in an annulment procedure according to Article 263 TFEU or in a preliminary ruling procedure according to Article 267(b) TFEU.79 However, the ECJ has not always acknowledged international agreements concluded by the EU as a standard for the judicial review of secondary Union law. The question of review has been linked to the issue of direct effect of international agreements.80

Direct effect exists when the contracting parties so indicate in the terms of an agreement.81 Until recently, it was rare that the EU and the other contracting party or parties addressed the issue of direct effect in a trade agreement.82 Given the lack of presumption of direct effect in international agreements that are binding on the EU, it is often left to the ECJ to decide whether a provision has direct effect or not. The ECJ has repeatedly pointed out that the interpretative liberty to determine direct effect in international agreements is based on the fact that agreements contain no explicit provisions on the issue. The ECJ stressed that in conformity with the principles of international law, "Community institutions which have the power to negotiate and conclude an agreement [...] are free to agree with that country what effect the provisions of the agreement are to have in the internal legal order of the contracting

76Cp. ECJ, IATA and ELFAA, para. 35 and ECJ, Commission v. Germany, C-61/94, para. 52; Lenaerts (2010), p. 519; see generally Barnard and Peers (2017), p. 196; Van Vooren and Wessel (2014), p. 211; Lenaerts and Van Nuffel (2011), pp. 862–863.

77Van Waeyenberge and Pecho (2014), p. 752; see generally Van Vooren and Wessel (2014), pp. 238–240; Eeckhout (2011), pp. 355–357.

78ECJ, AG Opinion, Rízení Letového Provozu, para. 58; Lenaerts (2010), p. 519.

79Mohay (2017), p. 159; Craig and de Búrca (2017), pp. 371–372; Lenaerts and Van Nuffel (2011), pp. 871–873.

80Van Waeyenberge and Pecho (2014), p. 753; Craig and de Búrca (2017), pp. 368–369; Eeckhout (2011), p. 297.

81ECJ, Portugal v. Council, para. 34.

82Cp. Van Waeyenberge and Pecho (2014), p. 753.

parties." 83 In the absence of an agreement between the contracting parties on the effect of the provisions of the agreement in the internal legal orders, the ECJ considers whether the nature or broad logic of an agreement precludes direct effect, and, whether the provision in question is, as regards its content, unconditional and sufficiently precise.84

The EU started to depart from its conventional approach in 2010 by breaking the silence with regard to the direct effect of trade agreements in the internal legal order.85 The Council Decision approving the trade agreement with the Republic of Korea explicitly stated that the agreement shall not be construed as conferring rights or imposing obligations which can be directly invoked before Union or member state courts.86 Subsequently concluded trade agreements have usually included a general clause with similar effect.87 For example, Article 30.6(1) CETA provides that nothing in the agreement should be construed as conferring rights or imposing obligations on persons other than those created between the parties under public international law, nor as permitting the agreement to be directly invoked in the domestic legal systems of the parties. Such a provision prevents a trade agreement from being directly invoked before Union and member states courts. It also blocks the possibility of using a trade agreement as a standard for the judicial review of secondary Union law.

#### <IP_ADDRESS> Implications for the Design of Data Flow Clauses

The possibility to review the legal mechanisms for the transfer of personal data in the GDPR for compatibility with a data flow clause in a trade agreement depends on the direct effect of the provision and the trade agreement in question. As long as a Council decision approving the trade agreement, or the agreement itself, entails a provision that excludes direct effect of the agreement, then the legal mechanisms for data transfers in the GDPR cannot be reviewed for their compatibility with the trade agreement in question. The inclusion of such a provision is important to safeguard the EU regulation of data transfers from potential challenges.

Recital (102) GDPR explicitly allows the conclusion of international agreements which involve the transfer of personal data to third countries, insofar as such

83ECJ, Air Transport Association of America, para. 49; ECJ, Kupferberg, para. 17.

84ECJ, FIAMM, para. 110; ECJ, Intertanko, para. 45; ECJ, IATA and ELFAA, para. 39; ECJ, International Fruit Company, paras 19–20; see generally Lenaerts and Van Nuffel (2011), p. 865; Van Vooren and Wessel (2014), pp. 227–233.

85Semertzi (2014), p. 1127.

86Article 8 Council Decision 2011/265/EU of 16 September 2010 on the signing, on behalf of the European Union, and provisional application of the Free Trade Agreement between the European Union and its Member States, of the one part, and the Republic of Korea, of the other part [2011] OJ L 117/1.

87Semertzi (2014), p. 1131.

agreements do not affect the GDPR and include an appropriate level of protection for the fundamental rights of the data subjects: