Journal of International Economic Law · 2018 · 102 citations · 0 references
LawInternational LawRegulatory PolicyInternational Business LawInternational Economic LawInternational Trade LawCross-border Data FlowsData PrivacyData ProtectionPrivacy LawPrivacy PolicyTrade RegulationData Protection RegulationDigital Trade RulesInternational Data GovernanceInternational Data Protection LawInternational Trade FlowsPersonal DataPrivacyPrivacy Standards
The EU General Data Protection Regulation expands privacy enforcement and permits data export only when recipient countries meet equivalent standards, Binding Corporate Rules, or Standard Contractual Clauses, creating high compliance costs and challenges for developing nations while raising potential WTO concerns. The authors propose bilateral agreements in which destination countries safeguard foreign citizens’ privacy in exchange for source countries’ non‑restriction of data flows, exemplified by the EU–US Privacy Shield and CPTPP, and suggest multilateralizing this approach by establishing shared privacy principles through OECD and APEC frameworks.
The European Union's General Data Protection Regulation (GDPR) widens the scope and strengthens the enforcement of privacy standards. To protect privacy abroad, personal data is allowed out of the EU under strict conditions: if a non-EU country enacts privacy legislation equivalent to the GDPR, or if firms accept Binding Corporate Rules (BCR) or use Standard Contractual Clauses (SCC) for specific business deals. These conditions pose a challenge, particularly for developing countries. A GDPR-based national privacy law would impose the same high standard on all firms, even when they sell at home, leading to higher economy-wide costs of doing business. BCRs and SCCs have proved to be costly and time-consuming. While the GDPR may raise WTO issues, litigation cannot address the central challenge: preserving opportunities for digital trade while respecting countries' chosen levels of privacy protection. An alternative approach would involve negotiating agreements under which data destination countries protect the privacy of foreign citizens in return for source countries committing not to restrict data flows, as in the EU–US Privacy Shield and the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP). In parallel, and as a step toward multilateralizing these agreements, countries would develop common privacy principles, building upon the work in the OECD and APEC.