1. The problem
It is a truth universally acknowledged that every ambitious twenty-first century trade agreement is in want of a chapter on electronic commerce.Footnote 1 Of the 275 regional/bilateral trade agreements (RTAs) currently in force that had been notified to the World Trade Organization (WTO) by May 2017, 75 have e-commerce provisions, and such provisions are included in more than 60% of the RTAs that entered into force between 2014 and 2016 (Monteiro and Teh, Reference Monteiro and Teh2017: 6).Footnote 2 While these chapters are called ‘e-commerce’, they include things that go beyond the WTO definition of ‘the production, distribution, marketing, sale or delivery of goods and services by electronic means’. One of the most politically sensitive and technically challenging issues is the privacy of personal information. Among the more than two dozen main types of provisions related to e-commerce in RTAs, three matter for privacy: cross-border transfer of information by electronic means found in 19 agreements; use and location of computing facilities in 2; and personal information protection in 44 (Monteiro and Teh, Reference Monteiro and Teh2017: 14). The diversity of approaches, even of definitions of ‘e-commerce’, shows that states are still learning how to regulate in this domain.
Digital trade is deeply challenging for a territorial conception of states and their jurisdiction, because the internet is not physical. This is not the place for a theory of territoriality (Ruggie, Reference Ruggie1993) nor of changing conceptions of the role of the state in twenty-first century governance (Macdonald and Wolfe, Reference Macdonald and Wolfe2009), but we should recognize two things: first, citizens still look to the state for protection, including of their privacy; and, second, the default setting of the state is to attempt to exert territorial control. An example of this difficulty is efforts to ensure privacy by demanding that computer servers be located at home. The digital trade story is about how states are learning to solve the problem of state responsibility for something that does not respect their borders while still allowing twenty-first century commerce to develop.
I explore this problem in a comparison of two recent trade agreements, the Canada–European Union Comprehensive Economic and Trade Agreement (CETA) and the Trans-Pacific Partnership (TPP). CETA was signed in October 2016 and was provisionally in force as of 21 September 2017, but the e-commerce chapter was substantially complete in 2012. The TPP text was released in January 2016, four years later than the completion of the CETA e-commerce chapter, but remains unratified after the US pulled out in January 2017.Footnote 3
Canada is caught between the EU – the most comprehensive privacy regime in the world – and the US, home of the largest digital players. A comparison of CETA and TPP allows us to see the evolution of the issues thought necessary for an e-commerce chapter, since both include Canada, and we can see the differing priorities of the US and the EU, since they are each signatory to one of the agreements, but not of the other. The two chapters differ from each other even on something as simple as the definitions of their domain, in CETA 16.1 and TPP 14.1. Although a snapshot of two moments in time in a rapidly evolving area, the comparison therefore sheds light on the difficulties that may be faced in future trade negotiations involving the EU and the US, including the exploratory work launched at the WTO's 2017 Buenos Aires ministerial (WTO, 2017), and a possible resumption of the negotiations for a Trade in Services Agreement (TiSA) and the Transatlantic Trade and Investment Partnership (TTIP).
In the next section, I briefly address why we have trade agreements in general, and why ambitious ones now include chapters on e-commerce; and then in the following section I show how the EU, Canada, and the US can be arrayed along a privacy continuum. I next explore the difference between CETA and TPP with respect to privacy, data flows, location of computing facilities, and institutional provisions. I conclude by seeking generalizations about why we see a mix of aspirational and obligatory provisions in free trade agreements. I suggest that the reasons are that governments are learning how to work with each other in a new domain, and learning about the trade implications of these issues.
2. Why have a trade agreement?
The major reason to have a trade agreement, especially one that covers behind-the-border policies, is to reduce uncertainty for governments and firms, which is not the same as creating certainty, nor is it the same as the standard terms of trade argument.Footnote 4 Three factors influence the timing and content of attempts to reduce uncertainty in the domain of e-commerce. The first is technological and economic change. The digital world is changing fast – digital flows globally are said to have been 45 times larger in 2014 than 2004 (Manyika et al., Reference Manyika and Lund2016), and the rate of increase is not slowing. Restrictions on these flows are not new, but they too have increased in the last decade (Ferracane, Reference Ferracane2017: Figure 1).
Second, as governments attempt to deal with these changes, they discover that differences in their regulatory frameworks create an interface issue, which alters their view of the need for some form of international regulatory cooperation – so called ‘interoperability’ is one response, in addition to the usual alternatives of alignment, harmonization, and mutual recognition. While the US, the EU and Canada all say they want to facilitate e-commerce, it does not mean that their interests coincide, or that they are equally responsive to business demands. The issues placed by the USTR on the TPP negotiating agenda primarily reflect concerns that American companies had been facing in foreign markets (Mishra, Reference Mishra2017: 33), but Canadian negotiators were also hearing more and more from business about their needs.
Finally, as personal information flows more freely than ever before, making it harder for individuals to guard their privacy, high profile data breaches and cyber-attacks, along with things like the Facebook controversy of early 2018, lead to public demands for governments to act. But since data flows everywhere, governments cannot act at home without some sort of international coordination, which for the moment leads to trade agreements. Although here, as in other domains, a trade agreement might not be the best vehicle for regulatory cooperation (Wolfe, Reference Wolfe, van Assche, Tapp and Wolfe2017: 29), if the objective is some form of equivalence.
While a coherent global data protection and privacy regime may be desirable, what the world has now is highly fragmented. Aaronson and Leblond suggest that digital realms are emerging in the EU, the US, and China. Their view is that small countries have to pick one or the other realm, which they helpfully describe in considerable detail (Aaronson and Leblond, Reference Aaronson and Leblond2018). While research making this claim about China is novel, although it reflects a common worry sparked by China's Belt and Road initiative (Chaisse and Matsushita, Reference Chaisse and Matsushita2018), we know that the EU and the US tend to favour their own template for RTAs. Many analysts have observed that TPP draws on past US RTAs, notably the e-commerce provisions (Gao, Reference Gao2018), and Chapter 2 builds on both WTO, and past US RTAs (Santana, Reference Santana, Gantz and Goldmanin press).
Others have observed that both the US and the EU try to use negotiation of their RTAs to transfer their regulatory regimes to other countries (Horn et al., Reference Horn, Mavroidis and Sapir2010). Hence when I come to the textual comparison in Section 4, I will be especially interested in the sources of the language of the e-commerce chapters. But first, I consider the differences in the privacy regimes of the parties.
3. The privacy continuum
The privacy aspects of e-commerce chapters may be the most puzzling for trade people. Some scholars see all such policies as trade restrictions (Ferracane et al., Reference Ferracane, Lee-Makiyama and Van Der Marel2018). Others are critical of efforts (especially by the US) to use trade agreement to undermine privacy law (Greenleaf, Reference Greenleaf2016a). The problem is familiar: parties have to find a way to reconcile differing regulatory approaches. But the reason to regulate ‘privacy’, and the way to do it, is rooted in culture, legal evolution, and especially constitutional norms. National conceptions of privacy will inform trade agreements, and national conceptions can meaningfully be enforced only within national jurisdictions. The poles are illustrated by Europeans who are more worried about rapacious firms, and Americans who worry more about an intrusive government. Canadians are caught in the middle. TPP and CETA are especially interesting, therefore, because they are at the poles, and yet both have privacy provisions acceptable to Canada.
3.1 EU privacy
Privacy rules promulgated by the EU Commission are secondary law, derived from the principles and objectives set out notably in the Treaty on the Functioning of the European Union (TFEU) and the Charter of Fundamental Rights of the European Union. Articles 7 and 8 of the Charter guarantee both the right to privacy and an independent right to the protection of personal data (Yakovleva, Reference Yakovleva2018: 10). Implementing such rights in legislation requires some acceptable compromise among the Member States.
The European Data Protection Directive of 1995 was intended to harmonize the privacy standards of the Member States to ensure the protection of personal data of EU citizens, including when such data are transferred outside the EU. Under Article 288 of the TFEU, ‘directives’ leave national authorities free to choose the form and method of implementation, while a ‘regulation’ is directly applicable in all Member States. As part of the current plan to create a Digital Single Market for Europe (EU, 2017a), complementing the single market for goods and services that is one of the foundations of the EU, the Commission decided to transform the data directive into a regulation.
The General Data Protection Regulation (GDPR) is intended to offer businesses simplified rules, and new opportunities while encouraging innovation. The GDPR (Regulation (EU) 2016/679) is a complex set of rules that place a heavy onus on firms to protect personal data. My interest is in how the Commission deals with the problem of differing regulations in other countries. The CETA e-commerce chapter was negotiated while the EU legal regime was still the Data Protection Directive, but the Commission had already started the process which led to the adoption of the GDPR after the CETA text was complete, hence the GDPR is my reference point.
In the Preamble to the GDPR (103), the Commission may decide that a third country ‘offers an adequate level of data protection, thus providing legal certainty and uniformity throughout the Union … In such cases, transfers of personal data to that third country … may take place without the need to obtain any further authorisation.’ In reaching such an adequacy decision (104), ‘The third country should offer guarantees ensuring an adequate level of protection essentially equivalent to that ensured within the Union’, and one indicator of such equivalency (105) could be the third country's accession to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (also known as Convention 108). Only a handful of countries outside the Council of Europe have ratified Convention 108, but others are in process.Footnote 5 Whether that will lead to standards seen as adequate by the EU is not clear (Greenleaf, Reference Greenleaf2016b; Greenleaf, Reference Greenleaf2017b).
The Commission is clear: the EU data protection rules cannot be the subject of negotiations in a free trade agreement. Privacy they say is not a commodity to be traded (EU, 2017b), but horizontal provisions for cross-border data flows and personal data protection in trade negotiations can aim at reducing protection barriers in other countries (EU, 2018). Free traders in Europe worry that the EU position tilts too far towards protecting privacy, and not enough towards facilitating digital trade. Some scholars think such a mandate in trade agreements is essential to balance interests protected by trade law and those protected by human rights law (Yakovleva, Reference Yakovleva2018). The Commission (EU, 2017b: 6) argues that
An adequacy finding allows the free flow of personal data from the EU without the EU data exporter having to implement any additional safeguards or being subject to further conditions. In finding that its legal order provides an adequate level of protection, the decision recognises that the country's system approximates that of the EU Member States. As a result, transfers to the country in question will be assimilated to intra-EU transmissions of data, thereby providing privileged access to the EU single market, while opening up commercial channels for EU operators.
An adequacy decision under Article 45 of the GDPR by the Commission is therefore unilateral, but can follow consultations with the other country, as is the case with Canada, and the Privacy Shield discussed below rests on an EU–US agreement about the rules applicable to US firms. The collaborative process gets the EU to a position of determining that rules offer equivalent protection.
3.2 Canadian law
Canada's Charter of Rights and Freedoms, part of the Constitution Act, 1982, ‘is almost exclusively a compendium of negative rights running against only the government itself, not positive rights that the state has a duty to secure more broadly within society (Krotoszynski, Reference Krotoszynski2016: 59)’. In consequence, the European idea of a positive duty to secure privacy rights has no basis in Canadian constitutional law.
Canada has two federal laws that govern the protection of personal information; the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal private-sector privacy law (Power, Reference Power2017). PIPEDA is horizontal: it sets out the ground rules for how all private-sector organizations collect, use, or disclose personal information in the course of commercial activities (Canada, 2009, Principle 4.1.3 of Schedule 1).
PIPEDA does not prohibit organizations in Canada from transferring personal information to an organization in another jurisdiction for processing, and its rules governing such transfers do not require a particular legal framework for protection in a foreign jurisdiction. Rather, the transferring organization is accountable for the information in the hands of the organization to which it has been transferred, subject to oversight by the Privacy Commissioner of Canada. Organizations must be transparent about their personal information handling practices. This includes advising customers that their personal information may be sent to another jurisdiction for processing and that while the information is in another jurisdiction it may be accessed by the courts, and law enforcement and national security authorities.
Officials say that Canada recognizes that growth in international trade and competitiveness in the digital economy depends on seamless and uninterrupted flows of information across borders, but individuals must have confidence that their personal information is protected wherever it travels. Business recognizes that concern, but it is only one of many issues they think should be addressed in e-commerce policy (Canada, 2018b).
PIPEDA, first proposed in 2000 but since amended, most recently in 2015 by the Digital Privacy Act, was motivated the EU Data Protection Directive of 1995 (Soma and Rynerson, Reference Soma and Rynerson2008). In 2001, the EU formally recognized PIPEDA as providing an ‘adequate’ level of data protection for the purposes of the Directive, thereby permitting transfers of personal data from the EU to Canada without the need for additional safeguards or the need for foreign firms to individually show compliance with EU privacy laws. PIPEDA was again under review at the time of writing, with a House of Commons report recommending changes including stronger enforcement powers for the Privacy Commissioner (Canada, 2018a). The EU has apparently signaled that the current adequacy finding only covers PIPEDA. Given the stronger protections envisaged in the GDPR, future adequacy decisions will involve a comprehensive assessment of a country's privacy regime, including access to personal data by public authorities for law enforcement, national security, and other public interest purposes (Canada, 2018a: 65).
3.3 US privacy law
US privacy law is less protective of individual privacy than Canadian law (Krotoszynski, Reference Krotoszynski2016: 59) – Americans worry more about an intrusive government and are traditionally trusting of business. State constitutions often provide more protection for individual privacy than the US constitution. At least ten state constitutions contain explicit right to privacy clauses and others have some form of a right to privacy through court interpretations of their state constitutions (Soma and Rynerson, Reference Soma and Rynerson2008).
In the absence of general legislation, US privacy law is a confusing patchwork. The main federal legislation is the Federal Trade Commission Act, which prohibits ‘unfair’ and ‘deceptive’ acts or practices in, or affecting, commerce. The Federal Trade Commission (FTC) also enforces targeted (or vertical) statutes that protect information relating to health, credit, and other financial matters, as well as on-line information on children. Exceptions to FTC jurisdiction include banks, airlines, insurance, and common carrier activities of telecommunications service providers where a mix of legislation and self-regulation allows companies and industry bodies to establish codes of practice (Soma and Rynerson, Reference Soma and Rynerson2008) on the assumption that the market will do a better job at reaching a balance between commercial needs and privacy interests (Cockfield, Reference Cockfield and Zureik2010). The FTC has enforcement powers over privacy-related contractual provisions, such as the power to issue orders and seek consumer redress in certain circumstances, but federal law does not stipulate what those provisions should be (Branstetter, Reference Branstetter, Schott and Cathleen2016: 79).
This system makes it difficult for US firms to show that they follow EU rules, because there is no comprehensive legal regime that can be shown to be adequate. The first attempt to bridge this divide, called Safe Harbor, collapsed after a legal challenge. The replacement EU–US agreement, called Privacy Shield, relies on commitments by participating companies to apply the high data protection standards of the agreement that are in turn enforceable under US law by the FTC (EU, 2017b: 7). EU regulators in their first annual review were not convinced that the system is working.Footnote 6 Privacy Shield is unlikely to be the last word on finding ways to ensure that US practices are deemed adequate under the GDPR.
3.4 The Atlantic divide
These differing conceptions of privacy rest on constitutional foundations on both sides of the Atlantic, even if the divide manifests itself as a difference over the priority to be assigned to commercial or rights considerations (Watanabe, Reference Watanabe2017: 1115). The EU insists on adequate protection, the US worries that data protection is a trade barrier that could serve as a camouflage for protectionism (Berka, Reference Berka, Griller, Obwexer and Vranes2017). Policies designed to privilege human rights will seem to restrain trade more than policies designed to preserve trust in online commerce (Yakovleva, Reference Yakovleva2018).
US experts and former practitioners lament the fragmented implementation of US privacy law, not least because it cedes a lead role to the EU (Hyman and Kovacic, Reference Hyman and Kovacic2018). This puts US companies at a disadvantage globally as emerging economies adopt simpler, and often more EU-style, comprehensive approaches (O'Connor, Reference O'Connor2018). The Obama Administration's proposal for a Consumer Privacy Bill of Rights Act went nowhere, but in light of the Facebook controversy, some Americans think it is time the US had a horizontal privacy law with similar objectives to the GDPR.
In the meantime, foreign data companies need to comply with the GDPR to do business with Europeans. Many will simply adopt European standards globally rather than have to meet multiple sets of privacy regulations, although the EU does not require firms to apply the GDPR rules to non-European data held outside the EU. Indeed in response to the scandal over use of its data in early 2018, Facebook said it would apply the EU privacy standards, but not other regulatory requirements, around the world, with appropriate adaptation to local laws (Scott, Reference Scott2018). As I was finishing my research on the GDPR, I received an email in Canada from the maker of my wireless home sound system telling me that they were updating their privacy statement. The company's FAQ states ‘We now meet the high standard required by the European Union's General Data Protection Regulation (GDPR) … And because we believe that all our customers can benefit from its mandates, we're implementing it globally.’Footnote 7 The GDPR may become the de facto global standard in the absence of a coherent US approach, and the current global standard for data privacy laws seems closer to the EU standards than those of the OECD (Greenleaf, Reference Greenleaf2017a). Canadian law is evolving towards greater compatibility with the EU approach.
4. Textual comparison of the CETA and TPP e-commerce chapters
The e-commerce chapter in the TPP is perhaps the most ambitious yet seen in an RTA. It differs from the CETA because it is more recent, but also because of the differing parties in the negotiations. The chapters may also differ for other reasons. I do not consider the chapters as part of a bargain in the overall agreement, nor do I consider the chapters as bargains in themselves, with trade-offs among the various provisions, other than the privacy-related provisions that are the focus of this article. And with respect to the TPP, I only consider Canada and the US, without asking if the US included certain provisions to try to change domestic policy in the ten other parties, or if those others influenced an outcome that was obviously acceptable to the US and Canada.
The comparison of CETA and TPP is sketched in Box 1, where the topics of each article are grouped according to whether the language is aspirational or obligatory.Footnote 8 In a now classic analytic framework for RTAs (Horn et al., Reference Horn, Mavroidis and Sapir2010: 1567), the covered subjects are divided into ‘WTO-plus’ (WTO+), corresponding to topics where bilateral commitments go beyond multilateral obligations, and ‘WTO-extra’ (WTO-X), where the topics are not currently covered by WTO disciplines. While a great many WTO-X provisions, the ones where they are trying to export their regulatory regimes, are included in EU and US RTAs, few are enforceable. Enforceability here simply means whether the provision is drafted in terms of aspiration or obligation, hence whether it could be invoked before a regional or domestic court, not whether the institutional means of enforcement envisaged by the agreement are either practical, or used (Horn et al., Reference Horn, Mavroidis and Sapir2010: 1572).
Texts of e-commerce chapters compared
This is a list of all the topics covered in the e-commerce chapters, with an [indication] of related topics in other chapters. The starred items (*) are relevant to privacy.
Legally enforceable (obligatory language)
CETA Chapter 16
Permanent prohibition on customs duties
[Transfer and processing of financial information 13.15]
*[Privacy of users of public telecommunications transport services 15.3.4]
TPP Chapter 14
Permanent prohibition on customs duties
Non-Discriminatory Treatment of Digital Products
Electronic Authentication and Electronic Signatures
*Cross-Border Transfer of Information by Electronic Means
*Location of Computing Facilities
Source Code
Best endeavours or too vague to be enforceable, or dialogue/cooperation
CETA Chapter 16
*Trust and confidence in electronic commerce
General Provisions
Electronic signatures
Liability of intermediary service suppliers;
Spam
Fraudulent and deceptive commercial practices
TPP Chapter 14
*Personal Information Protection
Domestic Electronic Transactions Framework
Online Consumer Protection
Paperless Trading
Principles on Access to Internet
Internet Interconnection Charge Sharing
Spam
Security in electronic communications
Authentication
*[Privacy of personal data of end-users of public telecommunications networks 13.4.4]
So what do we find? First, the definitions in TPP 14.1, the more recent agreement, cover more concepts than in CETA 16.1. Indeed, TPP generally covers more issues, including in the Scope article (14.2), with more concrete language.
Second, both agreements say the objective is to promote the development of e-commerce for economic reasons (CETA 16.2; TPP 14.2), and both make permanent the WTO moratorium on customs duties, an easy and longstanding obligation. The chapters themselves are not otherwise about market access, though tradeoffs between the rules here and access in another chapter may not be incidental.
Third, negotiations on both agreements started well after the entry into force of the General Agreement on Trade in Services (GATS) in 1995, and the 1998 WTO ministerial Declaration on Electronic Commerce (WTO, 1998). With the exception of a ban on customs duties, most e-commerce provisions in CETA and TPP are WTO-X. CETA confirms the applicability of WTO rules (16.2), and both agreements explicitly acknowledge the general exceptions and horizontal necessity test in GATS Article XIV.Footnote 9 This test allows regulations that ‘are not applied in a manner which would constitute a means of arbitrary or unjustifiable discrimination between countries where like conditions prevail, or a disguised restriction on trade in services…’ especially if they are necessary for ‘the protection of the privacy of individuals in relation to the processing and dissemination of personal data and the protection of confidentiality of individual records and accounts’.
Fourth, both agreements are a mix of aspirational and obligatory commitments, which may be just as well, because both have weak institutional provisions, as discussed below. How do I decide that some provisions are aspirational? Here is an example. TPP Article 14.5 requires parties to have a legal framework governing electronic transactions, without specifying its content, and they ‘shall endeavor’ to ensure that it does not create an unnecessary regulatory burden.
Finally, the source of the e-commerce language in TPP is often other US agreements (Alschner et al., Reference Alschner, Seiermann and Skougarevskiy2017), but Canada had more influence on the CETA chapter (Allee et al., Reference Allee, Elsig and Lugg2017: 249 and Table 2), and Canada played the key role on privacy in TPP.
In the rest of this section, I conduct a more detailed comparison of the privacy provisions, then data flow and data localization, and finally the institutional provisions.
4.1 Privacy protection
The key privacy provision in CETA is Article 16.4 on Trust and confidence in electronic commerce:
Each Party should adopt or maintain laws, regulations or administrative measures for the protection of personal information of users engaged in electronic commerce and, when doing so, shall take into due consideration international standards of data protection of relevant international organizations of which both Parties are a member.
This commitment is not obligatory – it simply recognizes that the CETA parties have dealt with privacy in another forum through the adequacy finding (Section 3 above). This text has a clear origin in Article 13.4 of Canada's RTA with Korea of 2015 (work started years earlier), and Article 1507 of its 2009 RTA with Peru.
In TPP, Article 14.8.2 on Personal Information Protection provides that ‘each Party shall adopt or maintain a legal framework that provides for the protection of the personal information of the users of electronic commerce’. This language came from past Canadian agreements, although the ‘should’ in CETA 16.4 is replaced by ‘shall’ in TPP. The key though is footnote 6, which reads
For greater certainty, a Party may comply with the obligation in this paragraph by [A] adopting or maintaining measures such as a comprehensive privacy, personal information or personal data protection laws, [B] sector-specific laws covering privacy, or [C] laws that provide for the enforcement of voluntary undertakings by enterprises relating to privacy.
The language at [A] refers to PIPEDA; at [B] it takes account of the US patchwork; and at [C] it covers the Privacy Shield approach. TPP accommodates the privacy regimes of Canada and the US without requiring any domestic policy change.
TPP also provides in Article 14.8.4 that
Each Party should publish information on the personal information protections it provides to users of electronic commerce, including how:
(a) individuals can pursue remedies; and
(b) business can comply with any legal requirements.
Publication at home is a basic transparency norm, but as noted below, TPP does not go to the next step of notification to trading partners. Clause (a) is consistent with the complaints-based enforcement system of the US FTC – parties are only required to have reactive enforcement. The only cause for dispute under this chapter would be if a party had no privacy legislation, which might require change in the domestic policies of some CPTPP parties. Clause (b) is fundamental administrative law: economic actors need to know the rules with which they are expected to comply. This language was first used in Article 1504 of Canada–Peru. The rest of Article 14.8 is best endeavours, including 14.8.5 on the development of mechanisms to promote compatibility between the different regimes of the parties.
Finally, an important privacy-related provision is found in the telecommunications chapters of both agreements – parties ‘shall’ (CETA 15.3.4) or ‘may’ (TPP 13.4.4) take measures to ensure the privacy of users of public telecommunications services, subject to standard necessity test language on not being a disguised restriction on trade. The CETA language is consistent with the EU ePrivacy Directive (soon to be a Regulation), and PIPEDA.
4.2 Data localization and data flows
Two other issues in these agreements are related to privacy. An example illustrates the problem to be solved. Iceland is apparently emerging as a prime location for server farms (Gudjonsson, Reference Gudjonsson2018). Why? Server farms are prodigious users of electricity and cooling, both of which the country has in abundance. Should other countries prevent their citizens’ data from being held on servers in Iceland in the interest of protecting their privacy? Should governments restrict the cross-border flow of data to and from Iceland? And in either case would any restrictions be designed to protect jobs at home rather than privacy?
Who has physical control of the server is not the same as who has control of the data. In PIPEDA terms, a Canadian entity can be accountable for control of the data held on a server in Iceland. A different concern arises if a foreign government attempts to gain access to data for security reasons, and the controller of the data has no means to resist. The issue applies largely to the US, a government that tries to gain access wherever the server is located, although the EU is moving in that direction. Hence the greater the certainty of privacy or access is desired – e.g. for security reasons – the more physical location matters because the state has more confidence in its control of the controllers.
Neither of these issues were addressed in CETA – Canadian officials had only just begun to hear about them when the e-commerce chapter was completed in 2012. The chapter on financial services contains a weak provision in the financial services chapter: Article 13.15 requires a party to permit the transfer of information for data processing if required in the ordinary course of business, subject to the privacy framework of the originating country and to certain other limitations in Article 13.17. A separate EU initiative seeks to establish the same free movement for non-personal data as the GDPR does for personal data as a way to prevent requirements hampering data flows within the EU itself.
Americans believe that the choice of technology and server location should be dictated by business considerations and not rules on data storage. Hence their trade agreements have increasingly included rules to ensure that such domestic measures are not an unnecessary burden on trade. TPP therefore has two obligatory provisions, derived from past US practice, requiring parties to allow cross-border transfer for the conduct of the business of a covered person and prohibiting a requirement to locate computing facilities in that Party's territory as a condition for conducting business in that territory (14.13). This language is harder than that found in the Korea–US RTA (Burri, Reference Burri2017: 433). Both articles recognize that parties may have regulatory requirements for security and privacy, and both say that parties may maintain restrictions for legitimate public policy purposes, subject to a necessity test, although some observers worry that the exceptions language is too weak (Geist, Reference Geist2018).
The TPP data flow and localization obligations do not apply to government data. The scope article specifies (14.2.3) that the e-commerce chapter shall not apply to government procurement, or information held or processed by or on behalf of a Party, and the government procurement chapter (Article 19.2.3) specifies that it does not apply to data held by a government. Canada's federal Privacy Act and the tough data rules in the provinces of British Columbia and Nova Scotia are not affected by TPP.
Financial services is a special case. The definitions in TPP 14.1 exclude a ‘financial institution’ and a ‘cross-border financial service supplier of a Party’ from the e-commerce chapter. The US financial services industry was not happy with this carve out, which was included due to pressure from the US Treasury (Dawson, Reference Dawson2018: 8). The industry lobbied unsuccessfully for a blanket ban on data localization in the renegotiation of NAFTA, but Canada and Mexico remained cautious. In the event the TPP privacy obligations were the basis for the United States Mexico Canada Agreement provisions (30 November 2018 text), with only minor changes to the aspects discussed in this article, including the retention of the footnote to TPP Article 14.8.2, now USMCA Article 19.8.2.
4.3 Institutional weakness limits enforceability, and learning
A final basis for comparison is institutional. Once the parties have an agreement on paper, they have to bring it to life, which depends on effective institutional design. Reciprocal obligations, the basis of any trade agreement, depend on opportunities for the constant development and affirmation of shared understanding of what the obligations mean (Wolfe, Reference Wolfe2015). Such opportunities require transparency; and accountability to partners. Not much can be expected from the weak institutional provisions in both chapters.
First, both chapters are deficient in generating information, an essential step in learning. Many other CETA and TPP chapters indicate that compliance with the relevant WTO notification obligation would meet the requirements of the agreement. The absence of a notification requirement in the e-commerce chapters is telling. WTO Members have so far failed to agree on how the rules apply. In consequence, WTO has no explicit notification requirements for anything to do with e-commerce. Not that it would be easy to decide what should be notified – countries are still at an early stage in elaborating e-commerce disciplines. So in the case of the various exceptions clauses in TPP, parties are not required to notify the limitations they place on the location of computing facilities or restrictions they place on data flows. Nor are they required to explain implementation of their privacy rules in a way that could be discussed in a committee established under the agreement,
Second, the lack of notifications hardly matters because neither agreement creates a dedicated committee for e-commerce.Footnote 10 This omission is perhaps not surprising – only 16 RTAs establish specific institutional arrangements related to e-commerce (Monteiro and Teh, Reference Monteiro and Teh2017). Both chapters have a large regulatory cooperation component, but such cooperation is hard to do without a means for the regulators to talk to each other.
Finally, the handful of articles cast in obligatory terms are potentially justifiable, though skepticism is warranted about whether the dispute settlement mechanisms in these two agreements will be used any more than the dispute settlement provisions in other RTAs (Wolfe, Reference Wolfe, van Assche, Tapp and Wolfe2017).
4.4 Summing up the comparison
The e-commerce chapters of CETA and TPP address a regulatory cooperation problem, but the provisions on e-commerce are not mutual recognition agreements, and are not part of the regulatory cooperation process in CETA Chapter 21 or TPP Chapter 25. Regulatory equivalence as a concept in EU practice is similar, but in these chapters there is no joint determination of what standards should be, let alone any appeal to the standards of a multilateral regime. Both chapters have similarities to a ‘Reference Paper' that is incorporated into Members' Schedules to the General Agreement on Trade in Services (GATS) in accordance with the 1997 Agreement on Trade in Basic Telecommunications Services: both chapters deal with principles, not common regulations or harmonization, and neither deals with market access, which is covered in other chapters.
Interoperability of government measures, and accountability assigned to firms, represent an inherently decentralized approach, while being consistent with the post-war compromise of embedded liberalism (Ruggie, Reference Ruggie1982) – do what you must to allow trade liberalization, while protecting national regulatory space. The principles cover issues that might be specific to digital trade. There are commitments that facilitate consumer trust by ensuring countries have measures in place to protect their information, and prevent fraudulent practices online. There is cooperation on things that are international in scope, like spam, where little can be done domestically when the unsolicited email is coming from abroad.Footnote 11
On personal privacy, the expectation of both CETA and TPP is that parties will have a domestic regime. The EU requires proof that the regime is adequate, Canada holds firms accountable for following its rules wherever data are transferred, and the US provides individuals a right to complain. Parties can claim an exemption if restrictions are necessary, but the default is no restriction on data flows and processing. Some critics think that the balance between privacy and data flow falls in the wrong place (Greenleaf, Reference Greenleaf2016a: 3, 6). The EU says personal data may be transferred only to countries with an ‘adequate level of protection’ of privacy. The US thinks barriers to the flow of data harm legitimate business interests involved in cross-border trade, and hence are a camouflage for protectionism. Canada and Europe have horizontal privacy law, but Americans have vertical and sectoral privacy law, so Americans cannot agree to horizontal obligations.
It seems evident that the US tried to use TPP to externalize its regulatory preferences for data flows and data localization, and for intermediary liability for internet service providers. On the latter, TPP contained extensive provisions in Article 18.82 of the intellectual property chapter on ‘Legal Remedies and Safe Harbours’. Canada was exempted from this provision through TPP Annex 18-E, hence resisted the further attempt by the US in the NAFTA renegotiation to embed its regulatory preferences in a trade agreement, not least because the circumstances that led to the passage of section 230 of the US Communications Decency Act (Lomonte, Reference Lomonte2018) rarely arise in Canada or Mexico. The recently concluded USMCA maintains that exemption in the intellectual property chapter. The most significant privacy-related difference from TPP in the Digital Trade chapter of the new agreement is the addition of Article 19.17 on Interactive Computer Services, which more directly addresses intermediary liability, but Canada appears to be exempted by footnote 8 to that article: a party may comply through ‘application of existing legal doctrines as applied through judicial decisions’, an implicit recognition of rulings by the British Columbia Supreme Court and the Supreme Court of Canada in the Equustek Case (Sookman, Reference Sookman2018).
Similarly, my story confirms but does not develop work that analyzes the limits on the so-called ‘Brussels effect’. Some scholars argue, using the example of digital trade among others, that the EU does not export its regulations through preferential trade agreements (Young, Reference Young2015). I think this claim is only true in the sense that the EU will not make commitments on the GDPR in a trade agreement. The CETA reference to privacy is framed in Canadian language, but the EU is a huge market, and Canada has clearly changed its policy to maintain its adequacy finding. EU rules on privacy create a first-mover advantage in the absence of comprehensive rules in the US (Newman and Posner, Reference Newman and Posner2015: 1323), but a unilateral rule is not the basis for a stable regime.
5. Seeking generalization
In lieu of a conclusion, in this section I seek to generalize from the above comparison. The first question is: Why do negotiators bother with vague provisions that are not enforceable? The brief answer is, because they are learning, and because reducing uncertainty does not require creating certainty.
Part of the process of learning is labeling – if you name something, it becomes more tractable for disciplines. Then you see that some aspects of the new area are affecting transaction flows in ways that are susceptible to analysis using trade concepts.
Countries arguably began learning about e-commerce in the 1970s, beginning with the OECD work on what were then called transborder data flows, the precursor to discussions about ‘trade in services’ (Drake and Nicolaïdis, Reference Drake and Nicolaïdis1992). The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data of 1980 inspired a number of national laws as well as the EU Data Protection Directive of 1995.Footnote 12 The EU Directive was also inspired by the 1981 Council of Europe Convention 108. The issue is still discussed at the OECD, for example in its evolving privacy guidelines (OECD, 2017).Footnote 13 Those Guidelines are designed to minimize restrictions, as does the APEC Privacy Framework, first elaborated in 2004, by making the data controller accountable regardless of where the data are located (Yakovleva, Reference Yakovleva2018: 8–9).
This work in international organizations notwithstanding, a multilateral regime has not yet emerged. There is no shared definition either of e-commerce, or of digital trade, as we see in RTA chapters (Monteiro and Teh, Reference Monteiro and Teh2017: 17). The blurring of the terms is seen in TPP, where Article 14.2.2 provides that the e-commerce chapter ‘shall apply to measures adopted or maintained by a Party that affect trade by electronic means’. WTO is blocked both by the transatlantic divide and by developing country nervousness, so RTAs are being used for learning. Or at least the negotiation process is a form of learning. The institutional weakness described above is compounded by the lack of a Secretariat that could draw on notifications and work in other international organizations to provide background papers for discussion. Perhaps the parties did not want to use a trade agreement in this way – TPP Article 14.15 provides that the Parties should ‘endeavor’ to cooperate, without saying how. CETA article 16.6 calls for dialogue without being explicit about where. Creating a place to talk about e-commerce, a vital form of learning, should be part of the preparatory process now underway in the WTO (WTO, 2017).
I find it significant that neither the CETA nor the TPP language is found in the new EU deal with Mexico announced in April 2018. The chapter on digital trade effectively says nothing on privacy (in effect carved out under ‘right to regulate’ in Article. 1.2), or data localization, and discussion of data flows here and in the financial services chapter are deferred for at least three years.Footnote 14 For now e-commerce as a trade issue is far from being sufficiently well understood for consistent codification to be possible. Put differently, the lack of shared understanding at the multilateral level leads to experiments in RTAs; and there the lack of shared understanding of causal relations hence of what agreements should even cover leads to aspirational rather than obligatory language. Trade lawyers may wonder why negotiators bother with the softer commitments, but informal law is valuable (Shaffer et al., Reference Shaffer, Wolfe and Le2015) and trade agreements are necessarily incomplete, relational contracts. What matters is the effort to understand a new area and to express that understanding in language.
5.1 What do trade people need to learn about privacy?
How should trade negotiators think about privacy? They are familiar with privacy for producers, which is customarily waived in trade in goods. For example, trade agreements ensure that consumers are able to hold producers liable for products that are in some way unsafe. Digital trade requires a similar relationship. The GDPR, for example, in effect creates new liabilities for producers, and limits their privacy. That is, in order to protect the privacy of the consumer, the data controller will have to have less privacy about its own actions. We observe that countries do not use trade agreements to regulate privacy while trying to ensure that domestic privacy rules do not unduly interfere with trade. What trade analysts do not know is what the optimal trade rules should be in this rapidly changing area. For example, under what circumstances is it worth worrying about ‘disguised protection’?
Goldfarb and Trefler offer a novel argument looking at digital trade from the standpoint of Artificial Intelligence (AI), not e-commerce. Variation in regulations that affect access to data could help domestic AI firms and/or hurt foreign firms, especially if the regulations affect the ability of firms in small countries, like Canada, to access the huge amounts of data they need to build their predictive models, in comparison to firms in larger markets. In the case of the privacy of individuals, regulation involves policies on the collection and use of data, which can either limit or expand the ability of firms to use AI effectively. Goldfarb and Trefler say that ‘lax privacy policies may help domestic industry relative to countries with strict policies just as lax labor and environmental regulation may help the domestic industry’. AI firms could be expected to move to the country with access to the most data and the fewest restrictions on its use. One might then expect that trade negotiations would try to prevent such a race to the bottom, by insisting on similar privacy laws in each partner (Goldfarb and Trefler, Reference Goldfarb and Trefler2018: 20–22).
While that is not what we observe in the approach to privacy in CETA and TPP, which are permissive of variation in domestic privacy law, we also do not observe a necessity test applied to the privacy provisions, perhaps because the possibility of disguised protection in the case of strong privacy standards is not serious, since such rules do not help domestic firms at the expense of foreign firms.Footnote 15 As a consumer I cannot tell how well any firm will protect my information. If I start worrying about use of personal information, I may be inclined to use fewer services that ask for it. If in contrast I feel confident that government is ensuring strict protection, I will be more inclined to use more services and provide more information (Heidhues et al., Reference Heidhues, Johnen and Koszegi2018). Hence trade agreements that promote strong privacy regulation might thereby promote more cross-border trade, rather than less.
In contrast, rules that limit data flows or require data to be kept at home might favour home firms. That is, we might expect privacy to be something a country ought to have, but transfer and localization, Goldfarb and Trefler suggest, could be expected to be characterized as trade restrictive and potentially as disguised protection. Hence we might expect such rules to be subject to a necessity test, a requirement that such restrictions be necessary for the achievement of a legitimate policy objective (Lim and De Meester, Reference Lim, De Meester, Lim and De Meester2014: 348; Muller, Reference Muller2015; Yakovleva, Reference Yakovleva2018: 21). And that is what we find: the ‘disguised restriction’ language is explicit in the TPP articles on cross-border transfer (14.11) and data localization (14.13).
Finally, a standard reason for trade agreements is dealing with a market failure. What Hoekman and Mattoo call regulatory heterogeneity can be seen as a market failure when requirements in this domain vary across countries because of differences in institutions, and when regulators in the jurisdiction of the exporter do not adequately take into account consequences for consumers in the jurisdiction of the importer (Hoekman and Mattoo, Reference Hoekman and Mattoo2017). The challenge is compounded because a change in domestic policy made for one partner is made for all – it is hard to design preferential privacy rules, ones that respect each country's domestic law. One solution suggested by Hoekman and Mattoo could be destination-based regulatory commitments by exporters to protect foreign consumer interests in return for market access commitments by importers. That is in effect what we see with the Privacy Shield, which requires US regulators to discipline American digital exporters on behalf of European consumers, who are otherwise not the concern of US regulators, in order to maintain market access. But no multilateral agreement is yet able to express such an approach in precise rules, and so there is no constraint on the inherent unilateralism of the EU approach to reaching an adequacy decision. Trade agreements may not be the best way to encourage agency to agency discussion among privacy regulators on how best to reconcile their domestic obligations with the free flow of data. In the absence of other consultative mechanisms, however, trade negotiators will keep learning through experimentation in RTAs.
