2.1 Privacy and security

IoT devices already outnumber the number of people in the world.Footnote ¹² As UNCTAD observes, IoT devices ‘silently listen, watch and record location and activity in the household, the workplace, and/or in public places to assist individuals with their lives or help companies or governments improve their goods or services or tailor advertisements’.Footnote ¹³ This creates both privacy and security risks, as the information might be abused or compromised. The race to deliver IoT devices cheaply may result in devices that are insufficiently secure. Indeed, hackers can exploit security vulnerabilities to take control of IoT devices, using these ‘zombie’ devices to deliver a massive denial of service attack.Footnote ¹⁴ A report from the United States Federal Trade Commission notes that IoT presents a variety of security risks by: ‘(1) enabling unauthorized access and misuse of personal information; (2) facilitating attacks on other systems; and (3) creating risks to personal safety’.Footnote ¹⁵

Even when used as intended, the devices raise significant privacy concerns because of their immense data collection capacities and their ubiquitous deployment. Traditional methods used to notify individuals about data gathering, such as privacy policies, are not readily available because these devices often lack screens to transmit such information.Footnote ¹⁶ Furthermore, the fact that multiple people might encounter an IoT device during its lifetime means that whoever installs and configures that device effectively makes privacy determinations for others.

UNCTAD's Global Cyberlaw Tracker reveals that 107 countries have established data protection/privacy legislation.Footnote ¹⁷ These laws will presumably apply to IoT manufacturers and service providers, including foreign manufacturers and service providers providing such services from abroad. Privacy requirements can incentivize security measures that reduce privacy risks.

Governments must protect the privacy and security of their citizens' information whether the information is held by a domestic or a foreign IoT provider. The United Nations General Assembly has recently reaffirmed the right to privacy as set out in article 12 of the Universal Declaration of Human Rights and article 17 of the International Covenant on Civil and Political Rights.Footnote ¹⁸

2.2 Standards and interoperability

IoT today is characterized by the emergence of often proprietary, incompatible ecosystems rather than open, interoperable networks. This means that these ‘operational technology systems work largely in silos’.Footnote ¹⁹ The fragmentation manifests itself in multiple ways, including different manufacturers, different operating systems, different versions of software, different types of connectors, and different communications protocols.Footnote ²⁰ Maximizing the value of networked devices will involve increasing the compatibility of communications and other protocols at different layers of the network stack. The European Commission, for example, declares interoperability between devices and services as key to its Europe 2020 Strategy: ‘The EU must enhance the interoperability of devices, applications, data repositories, services and networks.’Footnote ²¹ Interoperability can reduce the winner-take-all result of network industries; if other companies can participate in the network without needing the permission of a particular provider, it makes room for competition. At the same time, ‘imposing standards across devices could curb investment and innovation’.Footnote ²²

Because smart objects must communicate their information to the outside world, they often depend on access to telecommunications networks. Local regulations might be written in ways to disadvantage foreign smart object suppliers’ access to local networks. The GATS Annex on Telecommunications seeks to prevent such actions. Article 5(a) of the Annex mandates that foreign service suppliers must have ‘access to and use of public telecommunications transport networks and services on reasonable and nondiscriminatory terms and conditions’ for the supply of a service that is listed in that country's schedule of liberalization commitments.

2.3 Data localization

The IoT would not be possible without global data flows. Communication is at the heart of IoT, with machines talking to people or to other machines.Footnote ²³ IoT devices must communicate with their manufacturers or third parties selected by the manufacturer for data services and software updates. Smart objects depend on a remote infrastructure, receiving, storing, and processing information through that infrastructure. Most IoT manufacturers either build that data infrastructure locally near their home jurisdiction, or contract with cloud service providers like Alibaba, Amazon, Google, or Microsoft to provide scalable servers. As the smart objects are sold across borders by their manufacturers, the manufacturers and other related service providers rely on cross-border data flows to power these devices.

The European Commission has recognized the importance of facilitating ‘the flow and transfer of data’, observing that IoT involves the generation of data, the transfer of data, storage of data, processing of data, and the provision of data services– all of which must flow across borders.Footnote ²⁴ At the same time, many countries are increasingly demanding that data must not be taken out of their country on privacy and security grounds.Footnote ²⁵

Data localization mandates take a variety of forms. Nigeria, for example, requires information and communications technology companies to host all subscriber and consumer data locally within the country.Footnote ²⁶ Australia requires that personally identifiable health information must not leave the country without the consent of the individual to whom it pertains. British Columbia and Nova Scotia prevent personal information held by government agencies from leaving Canada without the consent of the data subject.Footnote ²⁷ Consent requirements pose special difficulties for IoT as devices often interact with multiple persons, not just the individual installing the device. Because IoT relies on remote storage and processing of information, restrictions on cross-border data flows significantly interfere with the ability to create global IoT products and services.

Data localization requirements mean that IoT manufacturers must either establish or lease local data facilities in every country with such requirements, substantially raising the costs of supplying IoT across the world. Such requirements not only raise costs, they also slow down global sales and add additional security risks because of the need to secure additional computer servers. Of course, some IoT manufacturers might ignore data localization obligations altogether because such laws are difficult to enforce. As the World Bank has pointed out, ‘some countries are using these [data localization] barriers to protect local firms’.Footnote ²⁸ Rules that hinder data flows across borders are facially discriminatory against foreign providers of data services. Data localization requirements effectively disfavor foreign IoT manufacturers who are less likely to have local data infrastructures. Thus, data localization requirements may violate commitments to liberalize trade in goods and services.Footnote ²⁹

3.1 Both good and service

Smart objects have been with us since the dawn of computing. If we saw them as simply the evolutionary successor to computerized objects such as the Casio smartwatches of the early 1980s, we might conclude that we should treat them simply as goods, whatever their purported smarts. After all, the Casio Databank watch stored an address book and calendar, alongside calculator functions. It certainly held a computer chip.Footnote ³⁰ But the smart objects of today are more Dick Tracy than Casio Databank. Today's smartwatches connect user information to the Internet, storing and accessing information held on Internet servers around the world. They can monitor our heartbeats, perhaps even predict high blood pressure through machine learning-based artificial intelligence applied to the data gathered by the device.Footnote ³¹ Extensive ongoing data services also generally characterize today's smart objects as well: the continuous, real-time, evolving information flows emanating from and to the IoT distinguish them from most earlier computerized objects. While computers have long been embedded in devices, from Casio smartwatches to Tickle-Me-Elmo dolls, the new devices also continuously communicate with the world, collecting and evaluating information.

The 1980s Casio smartwatch can be seen as providing a service – telling time, remembering your calendar, storing your contacts, or doing calculations. But this construction might transform all goods into service providers – a fan can be seen as a cooling service provider; a stool becomes a sitting service provider; a tractor, a plowing service provider; or a car, a transportation service provider. Transforming all goods into services eliminates the goods/services distinction without any useful effect.

How should we then identify whether a particular good entails a simultaneous service? To date, WTO discussions related to the Internet have largely focused on e-commerce used to enable trade in goods or services, but have not considered the growing challenges of the IoT.Footnote ³²

International trade law has proved reticent in seeking to define a service with precision. GATS merely offers a recursive definition: ‘For the purposes of this Agreement, trade in services is defined as the supply of a service.’Footnote ³³ For its part, the Dispute Resolution Body has sought not to define services abstractly, but rather simply identified a particular measure as one affecting services when faced with real world challenges that required a classification. Given technological changes that are creating new kinds of services or enabling for the first-time international trade in existing kinds of services, such reluctance to preordain a strict definition and thereby leave this question to future developments seems prudent.

Even the expansion of the Information Technology Agreement at the Ministerial Conference in 2015 failed to clarify these issues. In 1996, many WTO nations had agreed to phase out duties on the imports of a variety of information technology products.Footnote ³⁴ In 2015, the now-larger membership of the Information Technology Agreement agreed to expand the list of duty-free information technology products,Footnote ³⁵ but did not clarify the application of the WTO agreements to the IoT.

The classic WTO case exploring the intersection between a good and a service is Canada–Periodicals.Footnote ³⁶ There the United States challenged a special Canadian tax on periodicals that adversely affected United States periodicals such as Sports Illustrated. The United States argued that the Canadian tax violated Canada's national treatment obligation for US products under GATT. Canada countered that the tax was directed towards advertising in the magazines, and thus was a measure affecting a service, not a good. Since Canada had not promised national treatment for advertising services under GATT, the Canadian characterization of the measure as one affecting a service would have defeated the US challenge to the discriminatory tax. The Appellate Body rejected this argument, observing, ‘The entry into force of the GATS … does not diminish the scope of the application of the GATT 1994.’Footnote ³⁷ The Appellate Body concurred with the panel's view that the ‘obligations under GATT 1994 and GATS can co-exist’.Footnote ³⁸ The Appellate Body found that the periodical in question implicated services – but that the final product was a good which comprised services: ‘[A] periodical is a good comprised of two components: editorial content and advertising content. Both components can be viewed as having services attributes, but they combine to form a physical product –- the periodical itself.’Footnote ³⁹

Applying Canada–Periodicals to smart objects, should we therefore conclude that a smart object is a good, which is comprised in part of services? Are smart objects best understood simply as goods, the successor to computerized objects such as the Casio smartwatches of the early 1980s?Footnote ⁴⁰ After all, the Casio Databank watch stored an address book and calendar, alongside calculator functions. It certainly held a computer chip.

But today's smartwatches connect user information to the Internet, storing and accessing information held on Internet servers around the world. This is true generally of today's smart objects as well: the continuous, real-time, evolving information flows emanating from and to the IoT and the robots of today distinguish them from most earlier computerized objects. While computers have long been embedded in devices, the new devices also continuously communicate with the world.

Even if they communicate with the world, does that necessarily involve a service? Perhaps we should consider the data flows as communications, not as services at all? While it is easy to see the ‘good’ aspect of a smart object, it can be more difficult to recognize the services embedded within. Services now provided across borders include such abstract concepts as thinking, analyzing, recommending, and remembering. In many cases, the data flows entailed by these products cannot be found in traditional tariff classification schemes.Footnote ⁴¹

In China–Electronic Payment Systems, the WTO panel embraced a broad view of data operations as services. Consider the wide array of functions performed electronically that the panel recognized as services:

The data storage and processing required for a smart object seem of a kind with the operations recognized as services in China–Electronic Payment Systems. Rather than supporting financial transactions, the data services from a smart object might support health monitoring and analysis, or usage rates and times, etc.

Some of the data flows from smart objects are easy to recognize as services. Take, for example, the home monitoring service offered by makers of modern surveillance cameras. The Nest home surveillance system offers a $199 camera, a major feature – permitting the user to rewind and see who visited the premises the previous day – but which only works with a $5 per month video recording service.Footnote ⁴³ That service consists in cloud recording and replaying of the video.

In many cases, the economic value of the service will over the long term overwhelm the value of the good. Again, this is evident in smart objects such as a Nest, for which the monthly video recording service cost will far exceed the cost of the camera over the lifetime of the device.

But what of a Samsung home monitoring camera, which offers an option to send the video home surveillance recording to the user's Google drive account?Footnote ⁴⁴ (This might well involve the flow of data from a house in California to a data server in South Korea and then back to Google's data servers on the West Coast.) And all of this for free. Perhaps the sine qua non of a service should be whether it is provided for a cost? Under such a rule, Wikipedia would not be a service under international trade, even though it largely replaced the expensive encyclopedias of earlier generations. For smart objects like the Samsung camera, it seems better to treat the service as bundled with the good itself at the point of sale. Indeed, one of the key selling points distinguishing the Samsung home surveillance camera is the fact that one does not have to pay ongoing fees for the monitoring service, having free services instead. Thus, rather than seeing the data services provided for the lifetime of the object as free, we might see them instead as prepaid. After all, it costs Samsung money to provide the data processing for such cameras.

Thus, it makes sense to see a Smart Object as both a good and an ongoing service, and any regulation thereof thus subject to both GATT and GATS disciplines. In China–Audiovisual, the Appellate Body affirmed that ‘a measure can regulate both goods and services and that, as a result, the same measure can be subject to obligations affecting trade in goods and obligations affecting trade in services’.Footnote ⁴⁵

In sum, it seems likely that the Dispute Resolution Body would conclude that smart objects are goods with embedded services, subject to both GATT and GATS disciplines.

3.2 GATT or GATS?

The fact that a smart object may be subject to GATT and GATS disciplines simultaneously does not answer the question as to which treaty to apply in any particular challenge to a specific measure.

Again, the case of Canada–Periodicals is instructive. There, the Appellate Body had to decide whether GATT or GATS should be applied, with Canada arguing for the application of GATS, and the US arguing for the application of GATT. The critical question, as the Appellate Body saw it, was to determine whether to apply GATT or GATS to the dispute turned not simply on an examination of the good itself, but on the measure at issue. The Appellate Body wrote, ‘The measure at issue in this appeal, Part V.1 of the Excise Tax Act, is a measure which clearly applies to goods.’ The Appellate Body continued,

If the measure at issue had been directed at the advertiser in the periodical, then it might have been appropriate to characterize the measure as directed towards the regulation of the service. This is consistent with the opening mandate of GATS, set forth in Article 1:1: ‘This Agreement applies to measures by Members affecting trade in services.’Footnote ⁴⁷

Thus, the answer to the question of GATT or GATS does not depend on the nature of the economic transaction central to the dispute, but rather the measure at issue and to what it is applied. This approach recognizes that services and goods are often conjoined in a particular economic activity. Determining whether to apply GATT or GATS turns on what the measure is applied to – the good or the service in the economic activity. The Appellate Body's recognition in Canada–Periodicals that goods can have services embedded in them seems especially apt with respect to the IoT.

Confirmation of this approach can be found in another Appellate Body decision in the case of China–Audiovisual, a dispute which also involved the consideration of the intersection between goods and services. The Appellate Body repeated its observation in Canada–Periodicals that ‘particular measures “could be found to fall within the scope of both the GATT 1994 and the GATS”, and that such measures include those “that involve a service relating to a particular good or a service supplied in conjunction with a particular good”.’Footnote ⁴⁸ It continued, ‘a measure can regulate both goods and services and that, as a result, the same measure can be subject to obligations affecting trade in goods and obligations affecting trade in services’.Footnote ⁴⁹

China argued that its measures concerning films and audiovisual products did not regulate goods, but rather the content of films shown in China – and thus were not covered by its trading rights commitments, which were limited to goods. The Appellate Body, however, concluded the regulation limiting content necessarily limited who could import goods, and that therefore the measure implicated China's trading rights commitments.Footnote ⁵⁰ In order to determine whether goods commitments were implicated, the Appellate Body asked whether the challenged measure affected a foreign supplier of goods. Finding that it did, the Appellate Body assessed whether the measure violated the country had violated that country's commitments with respect to those goods.

This approach explains why even a case involving bananas might bring to bear the GATS. In EC–Bananas III, Ecuador and a number of other countries brought a variety of claims against a European licensing regime for banana imports, distribution, and sale.Footnote ⁵¹ In addition to the principal GATT claims, Ecuador argued that the European measures violated that region's GATS commitments to permit Ecuadorian ‘wholesale trade service’ providers. The European Communities insisted that their measures did not implicate GATS because the measures were focused on the licensing of goods, and thus should be examined under GATT exclusively. The Appellate Body sided with Ecuador, concluding that European measures that prevented the Ecuadorian companies from buying or selling certain bananas interfered with Europe's GATS commitments.Footnote ⁵² The Appellate Body concluded, ‘It is difficult to conceive how a wholesaler could engage in the “principal service” of “reselling” a product if it could not also purchase or, in some cases, import the product.’Footnote ⁵³

This approach offers a sensible means to determine whether to apply GATT or GATS (or both) in any particular dispute. If the measure is directed towards the regulation of the service, then GATS disciplines should apply; if directed towards the regulation of the good qua good, then GATT disciplines should apply. If directed towards both, both should apply. Rather than beginning with the particular item of international trade to determine whether it consists in a good, service, or both, we examine the challenged measure to see whether it is targeting a good, a service, or both.

What if a measure regulates both a service and a good simultaneously? In EC–Bananas III, the Appellate Body offered a way to determine how to apply GATT and GATS when a measure implicated both. In that case, the Appellate Body had in mind ‘measures that involve a service relating to a particular good or a service supplied in conjunction with a particular good’.Footnote ⁵⁴ Such a measure, it noted, ‘could be scrutinized under both the GATT 1994 and the GATS’.Footnote ⁵⁵ However, while the same measure could be scrutinized under both agreements, the specific aspects of that measure examined under each agreement could be different: ‘Under the GATT 1994, the focus is on how the measure affects the goods involved. Under the GATS, the focus is on how the measure affects the supply of the service or the service.’Footnote ⁵⁶

Some have argued that the WTO framework needs to be revised in light of contemporary technologies. Farrokhnia and Richards argue that e-commerce products could conceivably constitute both a good and a service. They seem to have in mind products that are intangible, such as movies or music in digital form. They maintain that intangibility alone does not necessitate any conclusion as to whether a particular product is either a good or a service because neither GATT nor GATS ‘says anything about tangibility or intangibility’.Footnote ⁵⁷ They note the possible ‘need to create a new category for e-commerce products in the WTO framework’.Footnote ⁵⁸

Cernat and Kutlina-Dimitrova propose such a new category – but for a different type of economic activity. Arguing that the existing GATS framework is inadequate to the increasing role of services in manufacturing, they propose a new mode 5 for services that are incorporated into products.Footnote ⁵⁹ They have in mind goods involving design or similar services, or goods embedded with software. The introduction of mode 5 would mean that countries would need to identify whether they intend to make commitments to national treatment and/or market access for each good/service category combination – a rather demanding requirement given the long-running impasse in multilateral liberalization.