The governance of cross-border data flows in trade agreements: is the cptpp framework an ideal way out?

• Author: Quan Xiaolian
• Position: Ph.D. in International Law, School of Law, Jilin University, Changchun, China
• Pages: 253-279

FRONTIERS OF LAW IN CHINA

VOL. 15 SEPTEMBER 2020 NO. 3

DOI 10.3868/s050-009-020-0016-3

FOCUS

RESEARCH ON THE MAJOR ISSUES OF DATA FLOW AND INFORMATION PRIVACY

PROTECTION: A GLOBAL WATC H FR OM A CHINESE PERSPECTIVE

THE GOVERNANCE OF CROSS-BORDER DATA FLOWS IN TRADE AGREEMENTS:

IS THE CPTPP FRAMEWORK AN IDEAL WAY OUT?

QUAN Xiaolian*

Abstract The regulations of cross-border data flows is a growing challenge for the

international community. International trade agreements, however, appear to be

pioneering legal methods to cope, as they have grappled with this issue since the 1990s.

The World Trade Organization (WTO) rules system offers a partial solution under the

General Agreement on Trade in Services (GATS), which covers aspects related to

cross-border data flows. The Comprehensive and Progressive Agreement for

Trans-Pacific Partnership (CPTPP) and the United States-Mexico-Canada Agreement

(USMCA) have also been perceived to provide forward-looking resolutions. In this

context, this article analyzes why a resolution to this issue may be illusory. While they

regulate cross-border data flows in various ways, the structure and wording of exception

articles of both the CPTPP and USMCA have the potential to pose significant challenges

to the international legal system. The new system, attempting to weigh societal values

and economic development, is imbalanced, often valuing free trade more than individual

online privacy and cybersecurity. Furthermore, the inclusion of poison-pill clauses is, by

nature, antithetical to cooperation. Thus, for the international community generally, and

China in particular, cross-border data flows would best be regulated under the

WTO-centered multilateral trade law system.

Keywords cross-border data flows, Comprehensive and Progressive Agreement for

Trans-Pacific Partnership (CPTPP), United States-Mexico-Canada Agreement (USMCA),

World Trade Organization (WTO), cybersecurity, individual privacy, data localization

* QUAN Xiaolian (全小莲), Ph.D. in International Law, School of Law, Jilin University, Changchun,

China; Associate Professor, School of International Law, Southwest University of Political Science and Law,

Chongqing 401120, China. Contact: xiaolian_jlu@163.com

This article is supported by the National Social Science Fund Project “China’s Non-Market Economy

Status in WTO Trade Remedies” (Project No. 15XFX023) and the Human Rights Institute of Southwest

University of Political Science and Law (SWUPL HRI) 2015 Yearly Research Project “Global Human Rights

Governance under the TPP.” All mistakes and omissions are my responsibility.

254 FRONTIERS OF LAW IN CHINA [Vol. 15: 253

INTRODUCTION .................................................................................................................... 254

I. EXISTING RULES CONCERNING CROSS-BORDER DATA FLOWS IN TRADE

AGREEMENTS .......................................................................................................... 256

A. The Historical Evolution ...................................................................................256

B. Multilateral Trade Agreements and International Guidelines........................... 257

C. Regional and Bilateral Trade Law System ........................................................260

II. CROSS-BORDER DATA FLOW REGULATION UNDER THE CPTPP............................. 261

A. The Electronic Commerce Chapter ...................................................................261

1. Prohibition of Customs Duties and Discrimination...................................... 261

2. Facilitating Trade and Anti-Localization ...................................................... 261

3. Balancing Clashed Values............................................................................. 262

4. The Application of Exceptions...................................................................... 262

5. Dispute Settlement........................................................................................ 262

B. New Features..................................................................................................... 263

C. The USMCA Digital Trade Chapter: An Advanced Version.............................. 265

III. LOOKING FORWARD: LEGAL PROBLEMS AND CHALLENGES ON CROSS-BORDER

DATA FLOW REGULATION UNDER THE CPTPP...................................................... 266

A. The Confusion Surrounding Exceptions ............................................................ 266

1. The Myth of General Exceptions.................................................................. 266

2. The Risk of Abuse of Security Exceptions ................................................... 269

B. Imbalance between Opposing Policy Objectives ..............................................271

1. Online Privacy Protection............................................................................. 272

2. Cybersecurity................................................................................................ 273

C. Tendencies towards Anti-Globalization: The Poison Pill Clauses ....................275

1. Non-Market Country FTA Clause................................................................. 275

2. Non-Application of the Mexico-United States Investment Disputes

Clauses.......................................................................................................... 277

CONCLUSION........................................................................................................................ 278

INTRODUCTION

Although there is no unified definition, cross-border data flows typically concern the

movement or transfer of information between computer servers across national borders.1

Cross-border data flows impact both domestic and international trade due to the

mysterious ways they are delivered. For example, when trade-related information is

transferred online, it is often divided into several small data packets that then travel

through servers. The servers are located all over the world, and which server the

information goes through is decided upon by the internet service provider. When the data

1 USA Congressional Research Service Report, Data Flows, Online Privacy, and Trade Policy, Mar. 11,

2019, Report No.: R45584, at 2–5. This pattern of definition could be found in OECD Guidelines on the

Protection of Privacy and Transborder Flows of Personal Data, which was Annex to the Recommendation of

the Council of 23 September 1980.