The complicated relationship between trade agreements, human rights, national security and the free flow of information

The Internet has made it cheaper and easier to trade information, to collaborate and work across borders, and to fund and sell goods and services (Manyika et al., Reference Manyika, Bughin, Lund, Nottebohm, Poulter, Jauch and Ramaswamy2014; eBay, 2014). One way to measure the global impact of the Internet is to measure cross-border flows, although economists disagree as to how they can do such measurement. The consulting firm McKinsey notes there was an 18-fold increase in cross-border Internet traffic between 2005 and 2012. Cross-border information flows are the fastest growing component of trade; using IMF data from 2008 to 2012, economist Michael Mandel found these flows increased 49% while trade in goods and services grew some 2.4% (Mandel, Reference Mandel2013). Moreover, digitization of goods (such as music and movies) is changing the mix of flows, transforming global logistics and enabling new and smaller players to participate in trade (McKinsey Global Institute, 2014: 2–3; eBay, 2014). If policymakers could devise shared rules to encourage the free flow of information, they would facilitate interoperability among legal regimes. More people would have greater access to information, and more information would be created and exchanged (Manyika et al., Reference Manyika, Bughin, Lund, Nottebohm, Poulter, Jauch and Ramaswamy2014; Tietje, Reference Tietje2011). Alas, policymakers have not found common ground in international agreements designed explicitly to facilitate information flows, but they have established human rights language to guide these flows.

States are supposed to protect and respect the wide range of human rights established under the Universal Declaration of Human Rights. The UN Human Rights Council has affirmed that people have the same rights online as they do offline and that these rights are ‘applicable regardless of frontiers'.Footnote ⁸ However, many states, including democratic ones, do not respect these rights consistently. Policymakers must balance many different rights; sometimes governments must intervene to protect rights; at other times, states must refrain from intervention. Although human rights are universal and indivisible, most governments make protecting the right to life (the security of their citizens) their top priority.Footnote ⁹

Since the terrorist attacks of September 11, 2001, many democratic governments such as the United States, United Kingdom, Germany, and the Netherlands, have expanded their use of the Internet to conduct surveillance of their own citizens and foreigners. These governments assert that online surveillance helps prevent threats to their citizens.Footnote ¹⁰ However, when they monitor people online, these governments may undermine rights, including the right to privacy, the right to freedom of opinion and expression, the right to seek, receive and impart information, and the right to freedom of association. The UN High Commissioner for Human Rights says that when monitoring the citizens of another country, states are obligated to protect the privacy of ‘foreigners' as well as citizens and not discriminate among noncitizens. In short, in their attempts to protect the right to life by using surveillance mechanisms, many governments have failed to sufficiently respect other human rights and policy priorities.Footnote ¹¹

The UN has also established guidelines for governments regarding information. At the UN General Assembly in 1946, member states agreed that ‘freedom of information is a fundamental human right and … the touchstone of all the freedoms to which the United Nations is consecrated’. However, states may restrict access to information under certain exceptions: for example to respect the rights or reputations of others, protect national security and public order, and protect public health or morals. When applying these exceptions, governments should weigh the harm to the public interest.Footnote ¹²

Governments that restrict the free flow of information may produce other unanticipated negative side effects. Economists generally agree that information is also a global public good that governments should provide and regulate effectively. When states restrict the free flow of information, they shrink access to information which can reduce economic growth, productivity, and innovation (Maskus and Reichman, Reference Maskus and Reichman2004: 284–285; Kahn, Reference Khan2009). Moreover, when governments retain and control access to large amounts of information on their citizens, they may put their citizens' privacy at risk (Chander and Le, Reference Chander and Le2014; Pearce, Reference Pearce2014

While international human rights obligations related to information flows are clear, they are not binding or enforceable globally. However, trade agreements have both binding and enforceable obligations, which makes them an attractive venue to regulate cross-border information flows (Burri: Reference Burri2013)). When country x does not meet its obligations, country y may challenge country x's behaviour in a trade dispute. Under the World Trade Organization's General Agreement on Trade and Services, member states agreed to guidelines on trade in information services. The GATS rules also allow nations to restrict trade in the interest of protecting public health, public morals, privacy, or intellectual property, as long as such restrictions are necessary and do not discriminate among WTO member states (Google, 2010; Goldsmith and Wu, Reference Goldsmith and Wu2006; Mattoo and Schuknecht, Reference Mattoo and Schuknecht2000). Although the GATS language predates the Internet, and states nothing explicitly about information flows, WTO dispute settlement bodies have begun to apply these obligations to cross-border information flows (Wunsch-Vincent, 2006; Goldsmith and Wu, Reference Goldsmith and Wu2006).

The WTO's Dispute Settlement Body has adjudicated only two trade disputes related to information flows. After Antigua challenged the US ban on Internet gambling, the WTO ruled that governments could restrict service exports to protect public morals if these barriers are necessary and non-discriminatory.Footnote ¹³ The WTO's Appellate Body also examined China's restrictions on publications and audiovisual products and noted that commitments for distribution of audiovisual products must extend to distribution of such products by the Internet.Footnote ¹⁴ However, WTO trade disputes have not yet clarified whether governments can, for example, restrict sales of offensive items such as Nazi memorability or if they can censor and filter websites (Mattoo and Schuknecht, Reference Mattoo and Schuknecht2000: 19–20; Mattoo and Wunsch-Vincent, Reference Mattoo and Wunsch-Vincent2004; Goldsmith and Wu, Reference Goldsmith and Wu2006 ; Santoro and Goldberg, Reference Santoro and Goldberg2009.)Footnote ¹⁵ Until members increase the extent to which they challenge these policies or negotiate new rules, we will not have clarity on why, how, and when governments can restrict cross-border flows (Aaronson and Townes, Reference Aaronson and Townes2012).

Moreover, the WTO needs updating in order to govern trade that is related to ongoing changes to the Internet, such as ‘the Internet of Things' – connecting goods, such as gloves, light bulbs, or watches, to the Internet; mobile technology; and the cloud, among other developments. Trade negotiators should also update the WTO's e-commerce provisions to prevent forum shopping; and to ensure that the global Internet remains a duty free zone (Burri, 2013: 4–5).

However, bilateral and multilateral trade agreements may not be the best place to address questions at the intersection of information flows, national security, and human rights.Footnote ¹⁶ First, when information flows across borders, nothing tangible crosses a border or moves through customs. An outflow of data may not really be the same as the export of data. As a result, trade statistics generally underestimate or do not address cross border data flows (USITC, 2013; Mandel, 2013). If a significant amount of information flows is not traded, policymakers will need to figure out if trade agreements should regulate all information flows, or those solely related to commercial transactions. Secondly, because trade agreements regulate the behaviour of states, individuals and firms involved in information flows have no way to directly represent their interests at the WTO or in bilateral free trade agreements.Footnote ¹⁷ Thirdly, the trade policymaking process is very different from the Internet governance process. Trade agreements are negotiated in secret by governments; these negotiations move slowly and the public is not directly involved. In contrast, the Internet is governed in a more ad hoc, bottom-up and transparent manner. Internet governance rules are made by stakeholders from civil society, business, government, academia, and national and international organizations in a timely, open, collaborative, and bottom-up manner without a central governing body.Footnote ¹⁸ Many Internet activists would not take kindly to the WTO as the key venue to regulate cross-border information flows given its secretive, slow, top-down, and closed processes. Finally, the WTO (and many trade agreements) do not explicitly address human rights and have no authority to prod member states to provide an enabling regulatory context for the protection of these rights. The WTO Services Agreement addresses protection of privacy as an exception (XIV (c) (ii) WTO).Footnote ¹⁹ Therefore, trade diplomats cannot easily include issues such as the relationship of privacy, data flows, and surveillance in a trade agreement. Yet policymakers will not be able to effectively facilitate the free flow of information without developing coherent and interoperable rules governing whether, how, when and whose data will be protected as information flows across borders. Without such rules, whether delineated in trade agreements or in other instruments, firms and individuals may not feel secure exchanging information online.

However, the WTO and other trade agreements have a long history of promoting trust between buyers and sellers who do not know each other (Büthe and Milner, Reference Büthe and Milner2008; Dobbin et al., Reference Dobbin, Simmons and Garrett2007). When we go online, just as when we trade, we operate on trust. Producers and consumers of information often do not know each other. Hence, Internet producers and consumers must trust that others will protect personal or business confidential information.Footnote ²⁰ Until recently, many people felt comfortable storing information online, where it was dispersed and encrypted rather than being locked in a file cabinet (Ryan et al., Reference Ryan, Falvey and Merchant2013). However, in light of numerous violations of privacy, malware attacks, and revelations about surveillance, people are becoming less trusting in the Internet as a safe venue (Dutton et al., Reference Dutton and Law2011; Eurobarometer, 2013). They may demand greater restrictions on the free flow of information in the belief that data kept at home are more secure and local suppliers are more trustworthy.Footnote ²¹

Literature review: academic analysis of the free flow of information as a trade issue

Trade and Internet scholars are just beginning to study the economic and human rights implications of information flows. Some analysts place this issue in the larger context of Internet regulation and see a battle between states (Goldsmith and Wu, Reference Goldsmith and Wu2006; Drezner, 2004) where states shape Internet content and access. Others see Internet governance through a regime theorist lens, where policymakers and citizens seek rules to facilitate cooperative endeavours. These scholars emphasize that much of the governance of the Internet is carried out by nongovernmental stakeholder organizations such as the Internet Society and the World Wide Web Consortium, as well as governmental bodies such as the International Telecommunications Union and the World Trade Organization (Waz and Weiser, Reference Waz and Weiser2012). Still others argue that the Internet is multilayered and governed by individuals, corporations, international bodies, and government networking (Braman, Reference Braman2012; DeNardis, Reference DeNardis2014; Mueller, Reference Mueller2010; Tietje, Reference Tietje2011; DeNardis and Raymond, Reference DeNardis and Raymond2013). Finally, some scholars use constructivist theories to compare how multiple actors deal with different approaches to regulating e-commerce among nations with different norms and values (Farrell, Reference Farrell2003).

Some scholars have focused on information flows to describe the interaction of states, netizens, and business online. Computer scientist Dorothy Denning notes that the flow of information is all about power; power to collaborate to encourage that flow or power to block it (Denning, 2009: 1–3). However, agents can also deny, degrade, and disrupt information flows by censoring, filtering, adopting security measures, or digital rights management tools (Denning, Reference Denning, Subramanian and Katz2009: 4; Marlin Bennet, Reference Marlin2012).

Whatever their framing of the issues and players, scholars agree that the September 11, 2001 terrorist attacks inspired more states to restrict and monitor cross-border information flows. In both the US and the EU, legislatures allowed governments to monitor online activity, extend their monitoring to citizens in other countries, and mine and retain data. Democratic governments began to proactively police the Internet and monitor information flows (Birnhack and Elkin Koren, Reference Birnhack and Elkin-Korean2003; Davies, Reference Davies2014).

Although some trade scholars have focused on how the events of September 11 changed trade policy (Ahearn, Reference Ahearn2005; Aaronson and Zimmerman, Reference Aaronson and Zimmerman2008), relatively few have relied on cross-border information flows as a unit of analysis. Instead they have focused on whether national government regulations are barriers to trade (Lee-Makiyama, Reference Lee-Makiyama2011; Dreyer and Hindley, Reference Dreyer and Hindley2008) or on how the WTO might be updated to address the Internet economy (Bieron and Ahmed, Reference Bieron and Ahmed2012; Chander, Reference Chander2009; Burri, Reference Burri2013; Berry and Reisman, Reference Berry and Reisman2012). They note that WTO rules related to the Internet were negotiated before the Internet came into wide use.Footnote ²² Recently, some academics have begun to examine digital protection and/or privacy issues using information flows as a unit of analysis (Svantesson and Jerker, Reference Svantesson and Jerker2007 ; Chander and Le, Reference Chander and Le2014; Aaronson and Maxim, Reference Aaronson and Maxim2013). By focusing on the free flow of information, we can understand why governmental efforts to restrict information flows in the interest of protecting national security or privacy have long been a trade issue.

The free flow of information as a trade issue: the 1960s–2001

The 1960s and 1970s were a golden age for technology. Computers and satellites became more efficient and dramatically cut the costs of communicating across borders. Based on those cost efficiencies, individuals learned new ways to use and analyze data. Although many executives and investors welcomed these developments, government officials worried about the impact of these new technologies on employment and the competitiveness of their manufacturing and service sectors. The US, as the world leader in these technologies, pressed to include information flows in trade agreements (United Nations, 1982: 6; Fascell and Schlundt, Reference Fascell and Schlundt1983; Drake, Reference Drake, Nordenstreng and Schiller1993). But from 1975 to1985, many officials outside of the United States (including in Europe and Brazil) feared unrestrained information flows could lead to too much corporate or centralized political power (Brown, Reference Brown1984; European Commission , 1979: 3; National Research Council, 1987). These officials also worried that free flows of data (then called trans-border data flows) could expose private corporate, citizen, or government information and reduce their ability to protect national security. Although the US tried to argue that trans-border data flows enhanced human rights, some opponents seized on a Canadian argument that trans-border data flows were a threat to ‘information sovereignty’; the ability to control what information flowed in or out a country's borders. These critics also raised questions about the ability of states to get information in cases where the data were held abroad. For a time, opponents of information flows appeared to win the argument; many developing countries worried that they could become information poor and lose control over indigenous information. Further, critics could easily point to the inconsistencies in the US argument. For example, although President Ronald Reagan called information ‘the oxygen of the modern age’ and noted that governments could not suppress it; in 1984, he issued a National Security Decision Directive that limited foreign access to online information. The US also argued that cross-border data flows could be curtailed for national security concerns (Verhagen, Reference Verhagen2010; Drake, Reference Drake, Nordenstreng and Schiller1993: 278–281, 282). After the OECD (a think tank for middle income and industrialized nations) developed principles to guide state practice on privacy, national security, and trans-border data flows, the issue seemed to die down (OECD, 1985; OECD, 2013). By the late 1980s, policymakers around the world recognized that they needed to facilitate these flows, but they did not agree on how, when, and where data flows could be restricted (National Research Council, 1987: 24–27; Drake, Reference Drake, Nordenstreng and Schiller1993).

In the 1990s, technology again brought cross-border information flows to policymakers' attention. The Internet, the World Wide Web, and fibre optic cable transformed global commerce, trade, and productivity. Middle income countries such as Brazil, India, and the Philippines among others, became major producers of online data, doing sophisticated data analysis and outsourcing (OECD, 2007: 8; Mattoo and Wunsch-Vincent, Reference Mattoo and Wunsch-Vincent2004). Economic officials from these countries were now torn. On the one hand, they understood that a set of rules facilitating data flows would be in their economic interest. On the other hand, such rules could reduce their ability to control information and yield greater market power to US companies over domestic firms (Lindmark, Reference Lindmark2009).

Clinton era trade officials decided that the time was ripe to again put forward rules to govern cross-border information flows (McLoughlin, Reference McLoughlin2000). In 1997, President Clinton announced a ‘Framework for Global Electronic Commerce’, which focused on private sector leadership, a limited role for government intervention including on cross-border flows, strategies designed to encourage global e-commerce, and provisions on privacy and security. According to the Framework, ‘The US government supports the broadest possible free flow of information across international borders … The Administration … will develop an informal dialogue with key trading partners … to ensure that differences in national regulation … do not serve as disguised trade barriers'.Footnote ²³

The Clinton Administration had some success in its drive to set rules governing e-commerce and data flows. President Clinton directed the US Trade Representative to make the Internet a tariff free zone and to secure new agreements to make electronic commerce a seamless global marketplace. The members of the WTO agreed to a temporary moratorium on taxes on cross-border data flows, which they have continued to renew.Footnote ²⁴ The President directed the Department of Commerce to develop a uniform commercial legal framework that recognizes, facilitates, and enforces electronic transactions worldwide and to work with the private sector to develop national online privacy standards. He also called upon all executive departments and agencies to promote efforts make the Internet a secure environment for commerce.Footnote ²⁵ In the years that followed, the US signed bilateral agreements with the Netherlands, Japan, France, Ireland, and Korea to remove barriers to e-commerce. The US and other members of the OECD endorsed an Action Plan for Electronic Commerce in 1999, which was put forward by various international business groups. It aimed to build trust, establish ground rules for e-commerce, and to maximize the benefits of electronic commerce (BIAC et al., 1999). But in the twentieth century, the US was unable to find language that assuaged its major trading partners that trade rules designed to facilitate the free flow of information would also enable government officials to keep data private and secure.

Privacy regulations remained a stumbling block to trade because the US has a very different perspective and regulatory approach to privacy than many of its major trade partners. Under US law, online privacy is a consumer right, whereas in the EU (as well as in Australia and Canada), privacy is a human and consumer right that must be protected by governments. In 1998, the EU s Data Protection Directive went into effect; it prohibits the transfer of data in and out of the EU unless the outside country provides what the EU judges to be sufficient privacy safeguards. The EU strategy seemed directly at odds with US voluntary, limited, and sectoral approach. Nonetheless, on 31 May 2000, US and EU negotiators agreed to a compromise called the ‘safe harbour policy’. Those US organizations that voluntarily agree to adhere to EU principles of privacy protection would be certified that they adhered to these standards, but if they did not adhere to those commitments, they could be prosecuted. The US was able to meet EU standards while maintaining a voluntary rather than a top-down approach. Neither consumers nor policymakers were prodding the US to take steps that could make the world's many national privacy regimes more interoperable (Gasser and Palfrey, Reference Gasser, Palfrey, Burri and Cottier2012: 134–138; Chander, Reference Chander2009: 284).

In 2000, the US approach to surveillance again collided with the EU approach to privacy. After allegations that the US, UK, Canada, Australia, and New Zealand (‘the Five Eyes') had an extensive shared global intelligence gathering system, the European Parliament issued a report with over 40 recommendations to EU policymakers. Yet, despite the furore, the Parliamentary report simply recommended that the European Union get an official agreement stipulating that the US and the EU should observe each other's privacy provisions.Footnote ²⁶ The US was again able to preserve its voluntary approach.

Despite its failings on privacy and on limiting digital protectionism, the Clinton e-commerce framework guided the two administrations that followed. Presidents George W. Bush and Barack Obama abided by its key principles: a limited role for government, a focus on business self-regulation, an emphasis on free flow of information, and labelling all barriers to free flow ‘digital protectionism’.

Nevertheless, George W. Bush (2001–2008) promised a new approach to foreign economic policy, focusing on bilateral and regional trade liberalization. US Trade Representative, Robert Zoellick, believed the US would make little progress in multilateral negotiations so he made the negotiation of bilateral free trade agreements (FTAs) the centrepiece of Bush-era trade negotiations (Aaronson and Zimmerman, Reference Aaronson and Zimmerman2008: 156; Ahearn, Reference Ahearn2005: 1). In 2002, Congress passed fast-track (now trade promotion authority) legislation, which granted the Executive authority to negotiate new trade agreements. Congress also encouraged the President to develop new rules to facilitate e-commerce and called on the President to reduce high-tech trade barriers.Footnote ²⁷ But the law said nothing about the free flow of information.Footnote ²⁸ The Bush Administration pushed through several free trade agreements with language on e-commerce. The FTAs with Chile, Singapore, Peru, Columbia, and CAFTA-DR stated that signatories should avoid erecting new trade barriers to digital trade as well as saying that neither party may include local presence requirements (Wunsch-Vincent, Reference Wunsch-Vincent2003: 32–34). However, none of these agreements contained language on the free flow of information or clarified when nations could restrict the flow. Hence, although the Bush Administration made some progress in getting US FTA partners to agree to avoid digital protectionism, they did little to promote the free flow of information per se.

As the Bush Administration moved to promote e-commerce through trade liberalization, the Internet world was changing. More people from more countries were going online and building domestic companies to serve local Internet needs. While US companies (and to a lesser extent European companies) still dominated Internet searches and social networking, local companies were finding a niche in providing services, cyber-security, apps, or games.Footnote ²⁹ Meanwhile, policymakers from many of these countries were increasingly determined to control the Internet within their borders and facilitate the rise of domestic Internet firms. China, Australia, India, Russia, Thailand, Turkey, and the UAE, as examples, restricted or blocked information flows (Hindley and Makiyama, Reference Hindley and Makiyama2009; Meier and Worth, Reference Meier and Worth2010; ONI, 2008). These governments cited a wide range of reasons for their actions: some to protect their citizens from harm; others to prevent their citizens from organizing. Still others acted to restrict information flows to encourage local Internet development (European Parliament, 2012: 7).

Many US based Internet companies saw in these actions a threat to their bottom lines. Executives from these companies argued that when governments restricted information flows, companies have fewer viewers and customers for their sites, content, and apps. Moreover, executives from these companies recognized that their future growth would lie outside the US and EU. While nine out of the top ten ‘global Internet properties' are made in the US, in 2013, some 79% of their users came from outside the US. Facebook provides a good example. In 2008, some 50% of Facebook users were outside the US; in 2013, 86% of its users live abroad (Meeker, 2014). Not surprisingly, these executives demanded that officials do a better job of limiting digital protectionism, which they often saw as any restriction on data flows. For example, Google used the research of the Open Network Initiative (a Canadian think tank) to document how more than 40 governments instituted broad scale restrictions of information flows.Footnote ³⁰ Google reported that governments were using opaque regulation, wholesale blocking of services, bias against foreign competitors, and other strategies that could violate international trade rules under the WTO (Google, 2010: 6–11). Google's arguments were supported by other business associations and firms that use data flows to cut costs, raise quality of services, and optimize energy use.Footnote ³¹

In 2009, Barack Obama became President. Obama's team was particularly attuned to the importance of the Internet for economic growth, responsive to the big Internet companies, and determined to reduce digital protectionism. The Department of Commerce asked firms to describe the restrictions they encountered. Some of the firms and associations commenting noted that the US also had various rationales to block the Internet. They suggested that the US should adopt a more principled approach to these issues and to do a better job of linking information flows and human rights.Footnote ³²

US and EU recent efforts to promote internet rights and the free flow of information

The US and the EU responded differently to rising government attention to the Internet economy and governance. The Obama Administration adopted a three pronged and confrontational approach: it would sign principles with countries with which it was not negotiating agreements, or with trade agreement partners which had no e-commerce chapters;Footnote ³³ it would negotiate language on free flow in the trade agreements under negotiation; and it would name and shame countries which adopted digital protectionist strategies. The EU, in contrast, embraced a less combative and more internationalist strategy. The EU pushed for WTO wide data flow principles but did not name and shame other countries for digital protectionism (although it does list some countries' policies as barriers to trade).Footnote ³⁴ Further, several European leaders, including the Foreign Ministers of France, the Netherlands, and Sweden, brought digital rights to the world's attention.

In 2010, the foreign ministers of France and the Netherlands organized the first conference on Internet freedom as a foreign policy issue.Footnote ³⁵ Soon thereafter, US Secretary of State, Hillary Rodham Clinton, seized on this issue and made Internet freedom a US foreign policy priority. In the belief that the Internet created new opportunities for citizens to demand their rights as well as new challenges for policymakers, Clinton and several European leaders including Sweden's Foreign Minister, Carl Bilt, gave speeches, developed principles, and created organizations designed to support greater freedom online.Footnote ³⁶ For example, the Dutch government created the Freedom Online Coalition, a forum for 21 like-minded governments collaborating to advance Internet freedom. This group also supports the Digital Defenders Partnership, a group in which governments provide emergency support for Internet users under threat in repressive environments.Footnote ³⁷ The US government also helped establish the Global Network Initiative, a multi-sectoral partnership among business, human rights groups, academics, and other interested parties. The Initiative has developed principles to guide the information technology industry on how to respect, protect, and advance freedom of expression and privacy, when faced with government demands for censorship and disclosure of users' personal information. Although the US remains supportive of the GNI, like other governments, it is not directly involved.Footnote ³⁸

The EU, US, various European governments, and human rights organizations worked to build an international consensus on how states should respect digital rights. They stressed that under international human rights and trade law, states should not block the Internet, unless they do so to achieve legitimate and accepted policy goals.Footnote ³⁹ But in reality, all governments block the flow of some information for moral, ethical, privacy, cyber security, or national security reasons. Officials understandably do not want to criticize the decisions of their democratically elected counterparts, but without a clear set of principles or rules it is hard to ascertain whether states have adopted restrictions to favour domestic producers or to achieve other legitimate policy goals (Aaronson with Townes, Reference Aaronson and Townes2012).

Unfortunately, despite their collaboration, the US and the EU do not completely agree on digital rights. First, European nations have a more expansive vision of human rights, whereas the United States tends to focus on freedoms. The EU is guided by the universality, indivisibility, inter-relatedness, and interdependence of all human rights, whereas the US makes civil and political rights a priority.Footnote ⁴⁰ Second, access to the Internet is a fundamental human right in some European nations, including France, whereas the US sees access as a development rather than a human rights problem (Aaronson with Townes, Reference Aaronson and Townes2012: 2, 19). In addition, the US and the EU disagree on the role of the state and business in protecting privacy. Nonetheless, the two trade giants had something in common: policymakers making digital rights policies had little interactions with those making trade policies. As a result, policies to facilitate the free flow of information were not effectively linked with policies to advance digital rights or the open Internet.

US trade agreements and the free flow of information

In 2012, the US and the Republic of Korea became the first states to include language related to the free flow of information in the electronic commerce chapter of their FTA. Article 15.8 of the agreement says ‘the Parties shall endeavour to refrain from imposing or maintaining unnecessary barriers to electronic information flows across borders'.Footnote ⁴¹ However, this provision does not forbid the use of such barriers, nor does it define necessary or unnecessary barriers. In short, the language is not actionable. In addition, the agreement did not clarify whether legitimate online exceptions to free flow, such as cyber-security measures or privacy regulations, are necessary or not. It is unclear if one party could use this language to challenge another party's use of such barriers (Aaronson with Townes, Reference Aaronson and Townes2012).

In 2011, the US proposed actionable language in the Trans-Pacific Partnership, a regional-Asia-Pacific trade agreement being negotiated by 12 countries, which could enhance Internet openness. In 2012, Deputy Assistant USTR for Telecommunications Policy, Jonathan McHale, said that the US had proposed rules that would allow data, as a default, to flow freely across borders.Footnote ⁴² According to press reports, the US also wanted to include language obligating TPP countries not to block the cross-border transfer of inbound and outbound data over the Internet, language prohibiting countries from requiring that data servers to be located in their country as a business condition, as well as provisions allowing businesses to operate in countries via e-commerce platforms, without establishing a commercial presence in the country.Footnote ⁴³

Officials from some of the TPP parties did not respond enthusiastically to these provisions.Footnote ⁴⁴ Meanwhile, countries such as Malaysia and Vietnam have not yet developed regulations to balance privacy and free flow; the US hopes that the TPP will influence the development of these regulations.Footnote ⁴⁵ In September 2012, Australia tabled alternative language to ensure that the data-flow proposal would be consistent with its privacy laws. Australia wants TPP countries to be able to put in place restrictions on the free flow of data, as long as the country can justify that they are not disguised barriers to trade.Footnote ⁴⁶ The US responded to Australian demands by proposing a more ad hoc strategy, which adheres to the Asia-Pacific Economic Cooperation Privacy Framework: firms could develop their own strategies to guard sensitive data, but each government would make this commitment enforceable through domestic institutions, such as the FTC in the US.Footnote ⁴⁷ As of this writing, TPP negotiators have not yet found language that the participating states can agree upon. Meanwhile, the US repeatedly scolded its trade partners for digital protectionism, but at times its arguments were inconsistent. For example, in its 2013 report on foreign trade barriers, USTR argued that British Columbia's and Nova Scotia's privacy laws discriminate against US suppliers because they require that personal information be stored and accessed only in Canada.Footnote ⁴⁸ In its 2012 report, the US also cited Australia's approach to privacy, noting Australia's unwillingness to use US companies for hosting due to concerns about privacy violations.Footnote ⁴⁹ The US also complained about Japan's uneven approach to privacy and Vietnam's unclear approach.Footnote ⁵⁰ Ironically, the US also argues that China's failure to enforce its privacy laws stifles e-commerce.Footnote ⁵¹ Hence, the US both criticizes governments for the failure to develop a clear or adequate approach to enforcing privacy while citing privacy as a barrier to trade.

By 2014, the US had a broader critique of the regulatory context for the free flow of information. It chided Thailand, South Africa, China, and the UAE for unclear Internet rules; criticized South Africa for failing to effectively enforce its laws online; it named Vietnam and Turkey for overreaching bans on Internet content; and France for its proposals to tax Internet activity.Footnote ⁵² In September 2014, the US International Trade Commission also suggested that foreign trade barriers were reducing US GDP by some 0.1–0.3%. The ITC noted that digitally intensive firms identified Nigeria, Algeria, and China as having high barriers to digital trade (USITC, 2014: 1, 77–79). Nevertheless, US policymakers were equally willing to adopt protectionist strategies when they perceived that the Internet could be vulnerable to hacking.Footnote ⁵³

Free flow provisions: the EU

The EU has taken a less aggressive approach than the US to encouraging the free flow of information. Recent EU FTAs such as the EU Chile Free Trade Agreement, signed in 2002, and EU Korea FTA do not include language on the free flow of information in the e-commerce chapter.Footnote ⁵⁴ EU Cariform and EU Korea include pledges to avoid unnecessary regulatory barriers to EU commerce. These pledges call for cooperation on data protection and oblige the signatories to ensure that they make data protection standards fully compatible with EU standards. However, the EU and Canada did not agree to include such provisions in their free trade agreement.Footnote ⁵⁵ This was surprising because Canada has included aspirational language encouraging the free flow of information as well as language on transparency and privacy in the Canada–Colombia agreement, which went into force August 2011.Footnote ⁵⁶

In 2011, the EU and the US proposed joint language related to the free flow of information provisions as part of the TISA negotiations at the WTO. Some 50 nations (more than a third of WTO members representing 70% of the world's trade in services) agreed to reduce barriers in service sectors including e-commerce.Footnote ⁵⁷ However, as the negotiations proceeded, the US disagreed with the EU (and other nations) on specifics: while the US wanted an absolute right to transfer information in electronic and other forms for data processing, the EU and other governments wanted transfer to be subject to rules consistent with international agreements. These European governments wanted to make it clear that the language should not restrict the right of a party to protect personal data, personal privacy, or the confidentiality of individual records and accounts, so long as such a right is not used to circumvent the agreement.Footnote ⁵⁸

The TISA negotiations are also being conducted in secret, but one chapter on financial services which contains some provisions on the free flow of information has been leaked online. We do not know if the leak represents a current or outdated version of the text. The leaked version contains language calling for the free flow of data and vague language on data protection. One clause states ‘No Party shall take measures that prevent transfers of information or the processing of financial information, including transfers of data by electronic means, into and out of its territory, for data processing … Nothing in this paragraph restricts the right of a Party to protect personal data, personal privacy and the confidentiality of individual records and accounts so long as such right is not used to circumvent the provisions of this Agreement.’Footnote ⁵⁹ However, nothing is said about defining or limiting data protectionism. The EU also agreed to negotiate provisions on the free flow of data in the Transatlantic Trade and Investment Partnership (TTIP), although they refused to include any language that could weaken the EU's approach to privacy/data protection. The negotiators seemed to be making progress, but in June 2013 that progress came to a halt. Snowden's revelations that the US was collecting phone calls and Internet communications of foreign citizens, as well as using the Internet to spy on allied governments, sowed distrust between US and EU officials, citizens, and firms. Netizens learned that the US National Security Agency (and its allies in the Five Eyes: Canada, Australia, the UK, and New Zealand) had obtained direct access to the servers of Microsoft, Yahoo, Google, and other US Internet giants. Moreover, Snowden revealed that many of the companies that were certified that they met EU standards by the Safe Harbor Agreement were in fact providing personal data to the US government.Footnote ⁶⁰ To many Europeans, the US approach to privacy was both inadequate and ineffective.

The fallout from the Snowden revelations about governmental surveillance and the free flow of information

Many European officials and senior EU leaders responded angrily to these allegations. Within days, the EU parliament announced an investigation, the German Prosecutor General began looking into espionage charges,Footnote ⁶¹ and German Chancellor Angela Merkel expressed her support for tougher rules governing the privacy of European citizens' data.Footnote ⁶² French President, Francois Hollande, flirted with the idea of calling off negotiations for the Trans-Atlantic Trade and Investment PartnershipFootnote ⁶³ as the French government weighed a tax on cross-border data flows.Footnote ⁶⁴ President Hendryk Ilves of Estonia argued that the right response to these revelations should be to create a secure ‘European cloud’ with high data protection standards.Footnote ⁶⁵ Some European NGOs and policymakers said that because the US could not be trusted to protect privacy, and the EU should not negotiate free flow of data provisions in TTIP.Footnote ⁶⁶ Although it soon became clear that the UK, France, Germany, and other European nations also had surveillance programs with extraterritorial reach,Footnote ⁶⁷ the US became the poster child for a lack of respect for privacy and human rights.

US and EU trade and foreign policymakers recognized that if they wanted to include free flow of information provisions in TTIP they had to change course. First, the EU and the US set up a working group on privacy, which provided answers to EU questions about the reach, methods, and effectiveness of the NSA programs.Footnote ⁶⁸ Second, the US Department of Commerce took steps to show that Safe Harbor was effective, and US companies that violated these policies would be punished. The US Federal Trade Commission doubled enforcement actions against 14 companies that claimed to participate in the Safe Harbor Framework but had not renewed their certifications under the program.Footnote ⁶⁹ The US also reassured businesses that the US remained committed to a voluntary, rather than a top-down regulatory approach to privacy.

The two trade giants agreed to develop an interoperable system for data protection. Specifically, they agreed to strengthen the Safe Harbor program for the exchange of personal data for commercial purposes, as they also negotiated a framework agreement which would apply to personal data transferred between the EU and the US for law enforcement purposes. The EU has insisted and US policymakers have reportedly concurred that the US grant EU citizens the same privacy rights as US citizens.Footnote ⁷⁰ While the EU's approach might protect EU citizens and facilitate data exchange among the US and EU, it would do little for citizens of other nations. Nor did it clarify whether the US would view privacy regulations as legitimate exceptions to the free flow of information or address the broader issue of how to deal with the multiplicity of privacy strategies among US and EU trade partners.

Meanwhile, US Internet companies paid a price for the country's surveillance prowess. Internet giants such as Facebook, Google, Cisco, Yahoo, and Microsoft have lost sales and/or market share in many countries as a result of the Snowden allegations.Footnote ⁷¹ Executives from these companies acknowledge that they and the US Government must reestablish trust in the US as a secure haven for data.Footnote ⁷² Several of these companies denied they provided backdoor access and sued the US Government to protect the privacy of their users. They also urged lawmakers to develop a more effective and universal approach to privacy across borders, but most of these companies do not want to alter the US's voluntary approach.Footnote ⁷³ At the same time, these companies (and their European counterparts) continue to support the free flow provisions and to demand that both the US and the EU address digital protectionism (ECIPE, 2013; Kommerskollegium, 2014).

Meanwhile, some governments saw in the Snowden allegations an opportunity to criticize US Internet dominance and current Internet governance policies. In September 2013, Pakistan, on behalf of Cuba, Venezuela, Zimbabwe, Uganda, Ecuador, Russia, Indonesia, Bolivia, Iran, and China, made a joint statement condemning mass surveillance and calling for strategic rethinking of the global Internet governance mechanism. These governments stressed that the Internet was dominated by US companies that, like US surveillance agencies, ‘intrude into peoples' private space’.Footnote ⁷⁴ In a shrewd political move, the US agreed to work with Internet stakeholders to develop new arrangements for ICANN, the Internet organization that defines policies and procedures for domain names such as .org or .com. US officials stressed that they will not agree to any arrangement that is not broadly supported by the stakeholders of the Internet community, that threatens the security or stability of the Internet, or that fails to maintain and enhance the ‘multi-stakeholder model’ for policy making.Footnote ⁷⁵ After months of planning, Brazil organized an April 2014 meeting ‘Netmundial’ to rethink Internet governance in light of the surveillance revelations. The meeting produced a closing document that stated, ‘Mass and arbitrary surveillance undermines trust in the Internet and trust in the Internet governance ecosystem.’Footnote ⁷⁶ However, the declaration did not prod member states to initiate a dialogue. In the months that followed, other nations, including France and civil society groups such as the Web We Want, called upon citizens and policymakers to continue to rethink Internet governance and not blindly accept US mechanisms and authority.Footnote ⁷⁷

In light of these developments, the US Department of State acknowledged that the US had lost credibility as a proponent of digital rights and the Open Internet. After some 400 groups worldwide signed onto a set of human rights principles to guide surveillance activities, in March 2014 Deputy Assistant Secretary for Democracy Human Rights and Labor Scott Busby announced that ‘US surveillance policies are guided by six principles – rule of law, legitimate purpose, non-arbitrariness, competent authority, oversight, and transparency and democratic accountability … These principles will be an important part of how my bureau engages governments around the world on admittedly difficult questions of Internet freedom.’Footnote ⁷⁸ But the US government did little to balance digital rights, surveillance, and the free flow of information.