Sweeping cross-border data flows in EU-New Zealand trade agreement

The right to regulate clause in Chapter 12 Digital trade, article 12.3, casts a shadow over the chapter, including over the safeguard for the protection of personal data and privacy. ¹ It reads:

The Parties reaffirm each Party’s right to regulate within their territories to achieve legitimate policy objectives, such as the protection of human, animal or plant life or health, social services, public education, safety, the environment, including climate change, public morals, social or consumer protection, animal welfare, privacy and data protection, the promotion and protection of cultural diversity, and, in the case of New Zealand, the promotion or protection of the rights, interests, duties and responsibilities of Māori. (emphasis added)

The right to regulate clause is not new in EU trade agreements. ^{2 , 3} It may have attracted most attention when included in investment chapters, during negotiations with Canada and the US. Many commentators pointed out weaknesses. Simon Lester noted that the text does not create any new right to regulate because it is just “reaffirming” a right that is assumed to already exist. ⁴ The safeguard contains the condition “legitimate policy objectives” which may be applied in strict ways. Furthermore, the formulation does not preclude or limit compensation orders, as does for some limited issues article 8.9 para 4 of the the EU - Canada trade agreement (CETA). Noteworthy, CETA’s article 8.9 para 1 general right to regulate clause does not preclude or limit compensation orders, nor does the EU - New Zealand’s Digital Trade chapter’s. In the case of investment chapters or treaties, this sets off alarm bells. ⁵

How strong is a right to regulate clause in a trade chapter if it is regarded weak in an investment chapter? Does the context make a sufficient difference? Arbitration and compensation work in other ways. States party to a trade agreement may press less hard against a right to regulate clause than investors do. But this may not be true for countries with beggar-thy-neighbour policies, such as tax havens and countries providing on line gambling.

Incidentally, a TNI study explores how tax havens have now become the preferred destinations for data storage. As the study puts it: “Financial capitalism and digital capitalism are now hiding together.”

We find the cross-border data flow commitment in the draft trade agreement in Chapter 12, Digital Trade, Section B, Cross-Border Data Flows and Personal Data Protection, Article 12.4, page 253. The article allows data flows and rules out localisation.

Earlier EU trade agreements, for instance the FTA with Japan, contained two data flow commitments. An explicit one regarding financial data. And an implicit one: cross-border services commitments imply cross-border data flows. The GATS article XIV like safeguard contains a necessity test which has been applied in strict ways by trade arbitrators. This undermines the safeguard.

The EU - New Zealand FTA does not contain a commitment regarding financial data flows; that is not needed as the new Digital Trade chapter is much broader in scope.

The FTA does contain cross-border services commitments in chapter 10. So the data flows related to cross-border services are covered by two commitments: cross-border services commitments (chapter 10) and the broader digital trade commitments (chapter 12).

The cross-border data flow commitment in the Digital Trade chapter comes with a safeguard in article 12.5, Protection of personal data and privacy:

1. Each Party recognises that the protection of personal data and privacy is a fundamental right and that high standards in this regard contribute to enhancing consumer confidence and trust in digital trade.
2. Each Party may adopt or maintain measures it deems appropriate to ensure the protection of personal data and privacy, including through the adoption and application of rules for the cross-border transfer of personal data. Nothing in this Agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective measures.

The EU commission first presented this approach in 2018. This unconditional safeguard is a major improvement over earlier ones based on GATS article XIV, which contains conditions, among them a necessity test. The mention of data protection and privacy as a fundamental right in trade agreements is a positive development. NGOs welcomed the decision. For a broad discussion, see Svetlana Yakovleva and Kristina Irion (2020). I was somewhat more skeptical.

Compared with GATS article XIV like safeguards, which contain conditions, an exception without conditions is much stronger. Hence the positive reception. There are, however, some potential limitations and weaknesses.

First, is the exception compatible with GATS’s principle of non-discrimination? ⁶

Second, a zero-quota issue may arise. Say a dictator takes over a trading partner and the EU would like to suspend data flows. Trade arbitrators may see this as a not allowed zero-quota. ⁷

Third, chapter 10 with cross-border services commitments contains a most favoured nation clause. See below.

Fourth, if we compare the exception with the weak right to regulate clause, we see similarities. With the discussions on the right to regulate clause in investment chapters in mind, we could consider:

(a), recognising something that is already known (para 1) doesn’t create anything new;

(b), the formulation “Nothing in this Agreement shall affect” (para 2) does not preclude or limit compensation orders;

(c), the strength of the safeguard then comes down on the first sentence of para 2, which does not preclude or limit compensation orders either.

But, such an interpretation would be scandalous, not? A scenario in which disembedded supranational trade arbitrators would interpret exceptions to commitments as outrageously as disembedded supranational investment arbitrators, may not seem very likely, as there are differences between trade arbitration and investment arbitration. Will these differences be enough? Ideas and interpretations change over time. With the right to regulate clause and the exception in the same chapter, do they come contagiously close?

The strength of a safeguard may depend on the context. It seems prudent to only use these commitments and this exception to commitments in a safe situation and avoid asynchronous situations, in which the states party to the agreement have or may develop very different interests or ideas on fundamental rights, the public interest, and democracy.

If we really do not want disembedded supranational trade arbitrators to take fundamental rights unfriendly decisions it may not be enough to indicate that in the text. A stronger option is to not give them jurisdiction, nor jurisdiction to decide on jurisdiction. ⁸ The EU could continue working with adequacy decisions and leave data flow commitments out of trade agreements. This has worked between the EU and New Zealand for a decade now.

If the EU would remove the data flow commitment from the Digital Trade chapter, it would still make sense to keep a strengthened exception, as cross-border services commitments imply cross-border data flows and we can expect the return of a commitment regarding financial data.

When the EU commission first presented these trade agreement based sweeping data flows commitments with the new exception it noted that the new plans are meant for countries which do not have an adequate protection of personal data. Reuters helpfully gave an example: Russia.

Sweeping cross-border data flow commitments with Russia, under this or whatever safeguard would seem imprudent by now. It will remain important to choose trade partners wisely, and even, ever more wisely.

Chapter 12 Digital Trade does not contain a most favoured nation clause. This is a good thing as otherwise this clause could import the data flow commitments with a weaker safeguard from the EU - UK agreement. See David Scholte on this agreement. Margot Kaminski argued that trade is not the place for the EU to negotiate privacy. The EU - UK agreement confirms this.

However, as noted above, the data flows related to cross-border services are covered by two commitments: cross-border services commitments (chapter 10) and the broader digital trade commitments (chapter 12).

Chapter 10 with cross-border services commitments does contain a most favoured nation clause. Under this clause commitments from an earlier trade agreement with a weaker safeguard, for instance the FTA with Japan, could be imported. It would be prudent to limit the scope of the most favoured nation clause. (The draft text is a pre-legal scrub text.)

In an earlier blog I noted that there are tensions between a prohibition on localisation and development goals, and between supranationalisation and democracy. ⁹ I concluded:

A trade regime doesn’t put democracy and fundamental rights first. As democracy and fundamental rights are under pressure, we should take a hard look at our priorities.