1. Introduction
Data localization is one of the most contentious and challenging policy issues in digital trade today.Footnote 1 Chander and Le define data localization to include any measure ‘that specifically encumber(s) the transfer of data across national borders’.Footnote 2 In a legislative proposal on cross-border data flows, the European Commission defines data localization as ‘any obligation, prohibition, condition, limit or other requirement’ contained in the ‘laws, regulations or administrative provisions of the Member States, which imposes the location of data storage or other processing requirements in the territory of a specific Member State or hinders storage or other processing of data in any other Member State’.Footnote 3 Following these broad definitions, in this article a variety of laws and regulations restricting data flows outside one's borders, whether directly or indirectly, are included within the scope of data localization. For example, explicit data residency laws requiring data to be storedFootnote 4 and/or processedFootnote 5 in domestic servers,Footnote 6 and even routed within the territory during transit,Footnote 7 fall within the scope of data localization. Further, implicit restrictions including cross-border data flow restrictions on grounds of privacy or data protection,Footnote 8 cybersecurityFootnote 9 and law enforcementFootnote 10 could indirectly force localization by imposing impracticable regulatory requirements or unreasonable compliance costs.
Data localization is premised on the logic that the degree of governmental control over data processing, access, and transfer significantly increases once data are located within one's borders. As data are a highly valuable resource in the digital economy,Footnote 11 several countries increasingly attempt to confine data within their borders to increase economic profits.Footnote 12 Further, many countries believe that domestic laws and regulations can be enforced easily when data reside in local servers; for example, compliance with domestic privacy laws or obtaining data access for criminal investigations.Footnote 13 Since the Snowden revelations in 2013 (exposing the massive digital surveillance of the US government), several countries have also advocated data localization for protecting national sovereignty, including national security, and preventing breach of their citizens’ privacy through foreign surveillance.Footnote 14 In practice, however, a country might have multiple policy considerations behind a data localization measure, including conveniently hiding its protectionist intent behind legitimate public policy rationales.Footnote 15
By impeding cross-border data flows, data localization measures disrupt various activities in the global supply chain. A broad variety of services and goods manufacturing processes incorporate digital elements such as cloud computing, big data processing, and artificial intelligence.Footnote 16 By creating barriers to data flows, therefore, data localization measures also create barriers to trade. For example, a data localization law forcing local data storage or processing increases compliance costs for foreign service providers and reduces market access, particularly for small and medium-sized enterprises (SMEs).Footnote 17 In other cases, even when the data localization requirement is not explicit, certain regulatory requirements (such as compliance with stringent technical standards) make cross-border data transfers impracticable.
Data localization measures are subject to rules under international trade agreements, particularly the General Agreement on Trade in Services (GATS)Footnote 18 as they affect the ‘production, distribution, marketing, sale and delivery’ of various internet and internet-enabled services.Footnote 19 Applying GATS to data localization measures raises several questions such as the sectors affected by the measure, relevant commitments in that sector, and the nature and extent of violations including obligations on non-discrimination, market access, and domestic regulations, and the justification of such measures under GATS exceptions: the general exception (GATS Art. XIV) and the national security exception (GATS Art. XIV bis).Footnote 20 This article focuses on one key aspect of the above assessment: presuming a data localization measure violates a Member's GATS obligations, how does GATS Art. XIV apply if the Member desires to justify the measure on grounds of cybersecurity or privacy? Does GATS Art. XIV adequately safeguard the Member's right to take measures on these grounds? Can GATS Art. XIV achieve a sound balance between trade and internet policy? The focus is primarily on privacy and cybersecurity as they are the most commonly proffered rationales for implementing data localization measures.Footnote 21 This article does not directly address other issues, such as online censorship,Footnote 22 data access for domestic legal enforcement and investigations,Footnote 23 as well as justification of data localization under GATS Art. XIV bis (national security exception).Footnote 24
Section 2 discusses the various technical and economic aspects of data localization, and comments on the general utility of data localization as a tool for cross-border data regulation. I argue that although data localization measures are technologically and economically inefficient, several governments strongly believe in (or at least advocate) their effectiveness in achieving domestic policy goals. Section 3 reflects on the various perspectives on privacy and cybersecurity, both from a domestic public policy perspective and in context of the multistakeholder internet governance community. I argue that the framework for regulation of cross-border data flows is complex and ambiguous because perspectives on internet privacy and cybersecurity at the international/transnational and domestic level are distinct and often conflicting. Given this complex policy environment, Section 4 investigates the application of Art. XIV to data localization measures, and whether it balances trade liberalization with cybersecurity and privacy considerations. I emphasize that the application of GATS Art. XIV essentially entails an assessment of cybersecurity and privacy issues from a domestic policy point of view, rather than multistakeholder norms in internet governance. Thus, the balance sought under GATS Art. XIV is between trade liberalization obligations and a Member's understanding of privacy and cybersecurity.
Section 5 argues that GATS Art. XIV can achieve the desired balance between trade liberalization and domestic public policy; for example, when applied thoughtfully considering relevant technical and factual evidence and thoroughly examining if certain cybersecurity/privacy measures have a hidden protectionist intent. Experts in the internet technical and policy community (including the Internet Engineering Task Force (IETF), World Wide Web Consortium (W3C), Internet Governance Forum (IGF), Internet Corporation for Assigned Names and Numbers (ICANN) or even the International Telecommunications Union (ITU) can provide relevant inputs regarding how data flows occur in digital networks, and whether specific measures/standards are effective in achieving security or privacy, at least from a technological standpoint. However, in the absence of international consensus on cybersecurity and internet privacy, the effectiveness of GATS Art. XIV in assessing legitimacy of data localization measures is inevitably limited. For example, where data localization measures are imposed in violation of multistakeholder norms/principles in internet governance, WTO panels have limited scope to consider the relevance of these norms/principles as they are largely not legally binding. Similarly, examining measures based on contentious standards or benchmarks on privacy and/or cybersecurity raises complex technical questions that WTO panels cannot usually address.
Section 6 concludes that although GATS Art. XIV remains an important and effective tool in fighting growing digital protectionism, it cannot and should not operate in a vacuum. Moving forward, when developing solutions to address data localization or other restrictions on data flows, both domestic policymakers and international trade institutions, such as the World Trade Organization (WTO), should remain wary of placing excessive emphasis on disciplines in GATS or other international trade agreements, and instead work towards developing a more balanced, multidimensional framework addressing various facets of internet and data regulation.
2. Data Localization: An Efficient Tool for Data Regulation?
The rapid adoption of data localization has triggered extensive debates on their effectiveness to achieve public policy goals such as protecting privacy of individuals and enhancing security of data and the networks carrying these data. From a technical perspective, geographical prescriptions on data flows and data storage contradict the fundamental end-to-end architecture of the internet that requires unhindered and instantaneous flow of data across the network, irrespective of the origin or content of the data.Footnote 25 Further, data routing is autonomous because the underlying technical protocols move data through the most efficient route rather than aligning with territorial boundaries.Footnote 26 Therefore, data localization artificially interferes with the technical and logical infrastructure of the internet and affects its reliability as a platform for transferring data.
From the perspective of economic efficiency, data localization measures also have undesirable consequences for all concerned stakeholders – governments, businesses, and consumers. First, data localization measures can hurt a country's economy by reducing productivity of services, and increasing prices for all.Footnote 27 Second, monitoring whether service providers comply with data localization laws requires governments to inefficiently expend resourcesFootnote 28 to achieve rather impracticable outcomes, particularly because: (i) data are instantaneously transferred through multiple locations of the world in nanoseconds, making it almost impossible to track the exact location of specific data points in real-time;Footnote 29 (ii) the end goal of achieving greater data security or protection is not contingent on the location of the data, as envisaged under a data localization measure but rather on the underlying technical protocols and designs of digital services.Footnote 30 For example, if the encryption mechanism of a digital service is weak, user privacy can be compromised irrespective of the server location; similarly, if a cloud service provider does not provide robust security, its servers remain susceptible to cyberattacks, even if a government forces the provider to locate its server farms within its borders.
Data localization increases compliance and operational costs for foreign providers of digital services as they are forced to build local servers or use local services in all implementing countries, foregoing the network economies of scale.Footnote 31 For example, instead of efficiently managing data distribution through continuous back-end transactions across multiple global/regional servers, companies are required to synchronize their data distribution with fewer domestic servers with increased chances of overloading and security breaches.Footnote 32 Further, foreign companies bear a significant increase in transaction costs to comply with stringent and restrictive standards of privacy or security that prevent interoperability across the global supply chain.Footnote 33 For instance, data protection laws containing extensive requirements to obtain consent from individual users and/or appropriate authorities for use/processing or transfer of data significantly increase compliance costs for companies.Footnote 34 Further, domestic companies that depend on or use digital services as well as end consumers have reduced access to competitive foreign services and lose significant business and other opportunities.Footnote 35
Given that data localization measures are economically inefficient and even disruptive, several policy communities are concerned about the sharp rise in such measures, particularly since 2013.Footnote 36 This includes the internet technical and policy community, consisting of various multistakeholder organizations involved in internet governance;Footnote 37 trade institutions such as the WTO;Footnote 38 human rights bodies;Footnote 39 as well as few governments, particularly digital leaders such as Japan and the US.Footnote 40 Amongst the recurring concerns against data localization are fragmentation of the global network of the internet into inefficient, localized internets;Footnote 41 rise in digital protectionism leading to reduced economic opportunities and productivity;Footnote 42 and an increase in online surveillance and oppressive censorship.Footnote 43
On the other hand, certain governments advance strong policy rationales to justify data localization. Countries such as China and Russia propagate the need for increased sovereign control over domestic cyberspace (or what China has re-branded as cyber sovereignty).Footnote 44 Others have advocated the need for data localization to achieve more specific objectives such as protecting data and network security (without necessarily distinguishing it from national security),Footnote 45 preventing cybercrimes, assisting in domestic investigations and law enforcement, and compliance with domestic laws such as privacy and intellectual property laws.Footnote 46 However, very rarely do countries admit that their data localization measure has a protectionist rationale, although this is often the case in practice, irrespective of how the measure is framed.Footnote 47 As will be discussed later in Sections 4 and 5, GATS Art. XIV can facilitate detecting the disguised protectionist rationale behind data localization measures.
3. Privacy and Cybersecurity as Drivers of Data Localization: Conflicting Perspectives
Cybersecurity and data protection/privacy are perhaps the two most challenging issues in internet governance today.Footnote 48 The ubiquity of internet data flows in both economic and socio-cultural aspects of human lives also exposes us to new forms of risks, including hacking, malware, and distributed denial of service attacks, massive surveillance programmes, phishing attacks, fake news, etc. Therefore, unsurprisingly, all major stakeholders, including governments, private companies, and the internet technical community, are extremely focused on these issues. However, the perspectives of these stakeholders are often distinct and conflicting, resulting in a fragmented, complex, and uncertain regulatory environment for data flows.
The internet technical community tends to view cybersecurity and privacy as being fundamental for a free and open internet.Footnote 49 In other words, free flow of data is not considered prejudicial to online privacy or security, provided the underlying technical protocols and designs are robust and secure, and promote interoperability across the different layers of the internet, across networks, and various digital services. Further, free flow of data is only possible in networks that are secure and where the digital services providers comply with best practices in privacy and cybersecurity.Footnote 50 The internet technical community, therefore, emphasizes the importance of implementing open and transparent standards through discussions in multistakeholder fora such as the IETF and W3C rather than closed standards implemented by governments. Government-mandated digital standards not only affect openness and interoperability of the internet and data flows but are also less secure as the secrecy of the applicable standard(s) increases chances of security flaws going undetected by the internet technical community.Footnote 51
Today, the technology industry faces immense pressure from both governments and civil society to provide secure and reliable digital services, and curb exploitation/misuse of personal data collected from internet users.Footnote 52 Typically, private companies prefer a self-regulatory approach so that they can adopt best-in-class and the most innovative security and privacy practices and technical standards, instead of being subject to excessive government regulations or prescriptive standards that restrict market access and increase compliance costs.Footnote 53 With increasing pressure from governments and civil society, however, the private sector is now showing greater openness towards a co-regulatory approach; for example, engaging in dialogues or partnering with governments to frame regulatory solutions for cross-border data flows that are reasonable, well-balanced, and promote digital innovation and growth.Footnote 54
However, at the domestic level, several governments believe that free flow of data across national borders undermines cybersecurity and data protection, and, therefore, governments should intervene to restrict data flows across borders to safeguard their citizens against various cyber risks. For example, the EU has adopted an extensive data protection regime under the General Data Protection Regulation (GDPR); China has enforced a cybersecurity law which inter alia requires data localization;Footnote 55 Russia has an extensive data protection law which inter alia mandates data localization;Footnote 56 Australia,Footnote 57 India,Footnote 58 Turkey,Footnote 59 and CanadaFootnote 60 impose data localization requirements in specific sectors. As governments remain highly suspicious of foreign companies’ use of personal data and their security practices, data localization remains a feasible policy tool. However, certain countries have a much broader vision of exercising greater control over all activities in domestic cyberspace through data localization, including the information available to its citizens. This idea of control over domestic cyberspace is rhetorical as the internet is not circumscribed by territorial boundaries, and, hence, not designed to be subject to sovereign controls.Footnote 61
The prescriptive regulatory approach envisaged by governments does not align with the multistakeholder approach envisaged by experts in the internet technical community as well as the private sector.Footnote 62 Further, even among governments, a huge divide exists on the appropriate framework for cybersecurity and privacy laws and regulations. For example, the US and EU backlash against the Chinese cybersecurity law at the WTO,Footnote 63 and the tension between data transfer mechanisms of the Asia Pacific Economic Cooperation (APEC) and the EU reflects the deep divide among countries on privacy and cybersecurity issues.Footnote 64 As the conflicts between these perspectives remain unresolved, no international consensus exists on how to synergize different standards of data protection and conflicting perspectives on cybersecurity. Consequently, governments find it tactically convenient to restrict data flows through data localization rather than attempting a middle path on these issues. This conflict has also incentivized certain governments to attempt exporting their regulatory models on data protection or cybersecurity to other countries, particularly through regional trade agreements,Footnote 65 causing further fragmentation in the global regulatory framework on data flows.Footnote 66
Unlike issues of public morals or public order which are largely influenced by domestic values/ideals,Footnote 67 cybersecurity and data protection are unique issues because both governments and multistakeholder internet communities consider them as fundamental policy issues. The private sector also has a special role because of their responsibility for installing security and privacy controls in the technical protocols of the internet and design of digital services.Footnote 68 However, even if the private sector designs and adopts interoperable, robust, and secure protocols and standards, governments have the ability to block these protocols and standards by either exercising control over the physical infrastructure (such as server farms or Internet Exchange Points) or imposing mandatory domestic technical standards that do not align with best practices in the digital industry. Such measures are particularly facilitated by the lack of international consensus on legal principles governing cybersecurity and online privacy in international organizations, including the UN,Footnote 69 ITU,Footnote 70 and other platforms such as the World Summit on the Information Society.Footnote 71 In the absence of relevant international law or norms, the divide between the multistakeholder norms, private sector views, and domestic public policy appears to be irreconcilable.
4. Assessing Data Localization Measures under GATS General Exception
If a data localization measure fails to comply with a Member's GATS obligations, GATS Art. XIV can be used by a Member to justify derogation from its legal obligations. However, these exceptions cover a limited, exhaustive list of policy objectives. Therefore, this section investigates whether data localization measures, based on grounds of cybersecurity or privacy, can fit into one of the sub-sections of GATS Art. XIV and, thereafter, satisfy the conditions of the necessity test as well as the chapeau of GATS Art. XIV. I argue that data localization measures implemented to achieve data protection/privacy and cybersecurity fall under the exceptions available under GATS Art. XIV(c) and GATS Art. XIV(a). However, assessing the necessity of such measures under these sub-provisions entails a tough balancing of trade and the domestic understanding of internet policy goals. The tools available to Panels and the Appellate Body (AB)Footnote 72 under the weighing and balancing test developed under GATS Art. XIV can often be helpful to weed out protectionist data localization measures. However, in cases where such measures have multiple objectives (for example, a privacy measure incidentally favouring indigenous digital sector(s)) or are based on contested regulatory standard(s) (for example, determining adequacy of privacy laws of data recipient countries based on specific criteria),Footnote 73 the effectiveness of GATS Art. XIV in balancing various trade and non-trade policy considerations is less certain. To some extent, the design and implementation of such measures can be investigated by thoughtfully using relevant technical and factual evidence to detect any disguised protectionist intent. However, in the absence of specific international law, norms, or standards on cybersecurity and privacy, and divided views among technical experts regarding the most effective standards for data protection and cybersecurity, WTO tribunals will inevitably face limitations in deciding on the legitimacy of such measures in many disputes.
4.1 Contextualizing Privacy and Cybersecurity under GATS Art. XIV
Being a pre-internet era treaty, the provisions contained in GATS were not designed keeping in mind the public policy challenges of a digital era, particularly those related to cross-border data transfers via the internet. For example, GATS does not contain any rules requiring its Members to adopt basic domestic frameworks on privacy and cybersecurity (unlike rules in recent PTAs such as the CPTPP and USMCA which provide for explicit commitments).Footnote 74 Certain experts therefore argue that GATS obligations are outdated, including those related to telecommunications services, posing severe challenges in addressing data-related disputes.Footnote 75 Others argue that GATS disciplines are relevant but need to be updated or reformed to reflect the unique challenges of a data-driven economy.Footnote 76
Although the exceptions contained in GATS Art. XIV can be creatively interpreted to cover contemporary policy challenges arising in domestic internet and data regulation, these policy objectives were clearly not envisaged at the time of the formulation of the treaty. Therefore, this section explores if and how GATS Art. XIV(c) and (a) covers data localization measures implemented on grounds of privacy and cybersecurity by reference to the principle of evolutionary interpretation of treaties.
4.1.1 GATS Art. XIV(c) Can Cover Both Privacy and Cybersecurity-Related Measures
Under GATS Art. XIV(c), a data localization measure can be provisionally justified provided: (a) it is implemented to secure compliance with domestic ‘laws and regulations’Footnote 77 including those relating to:Footnote 78
(i) the prevention of deceptive and fraudulent practices or to deal with the effects of a default on services contracts;
(ii) the protection of the privacy of individuals in relation to the processing and dissemination of personal data and the protection of confidentiality of individual records and accounts;
(iii) safety;Footnote 79
(b) the above ‘laws and regulations’ are otherwise consistent with WTO law; and (c) the data localization measure is necessary to secure compliance with these laws and regulations.Footnote 80
In my view, an evolutionary interpretationFootnote 81 of the terms contained in the above exceptions cover different aspects of cybersecurity and internet privacy.Footnote 82 For instance, laws preventing ‘deceptive and fraudulent practices’ in GATS Art. XIV(c)(i) and ‘safety’ in GATS Art. XIV(c)(iii) could refer to domestic laws designed to protect consumers from cybercrimes resulting from unauthorized hacking by third parties, malware attacks, etc. The most commonly used tools to achieve this include imposing security standards, banning malicious software, or necessitating service providers to employ cybersecurity best practices. For example, UNCTAD has estimated that 72% of the countries in the world have adopted at least some cybercrime laws.Footnote 83 Further, several governments are now implementing data localization measures to enhance their cybersecurity environment and protect the interests of domestic internet users.Footnote 84
Further, to obtain stronger enforcement of domestic consumer protection or data protection laws, digital service providers are often required to provide tailored privacy and security undertakings in their terms of use or contractual arrangements between digital service providers and users. Some examples include obtaining informed consent for third-party use of personal data, protecting personal data from unauthorized use by third parties, protecting personal data against data breaches, and providing appropriate quality of digital services.Footnote 85 Similarly, certain domestic laws require mandatory notification of all data breaches to governments so as to hold the companies accountable for losses as well as safeguard consumer rights.Footnote 86 Such laws might increase compliance costs for companies, particularly where extensive cross-border data transactions are involved, and can be particularly burdensome for foreign companies.Footnote 87 However, they could be justified as measures necessary to achieve compliance with domestic laws dealing with ‘default on service contracts’ (with reference to contracts in the online environment) under GATS Art. XIV(c)(i).
Finally, ‘protection of privacy of individuals’ in GATS Art. XIV(c)(ii) can be interpreted in the context of the internet and online services, thus covering restrictions on data transfer contained in data protection laws, or other compliance requirements on service providers such as obtaining informed consent from internet users and preventing unauthorized use of personal data. The right to privacy has been widely recognized in the online context as a fundamental human right in other international treaties,Footnote 88 with 58% countries across the world having adopted data protection laws.Footnote 89 Therefore, considering the significance of these contemporary policy concerns, GATS Art. XIV(c)(ii) should also be interpreted to include domestic laws addressing privacy concerns in the online context.
In assessing whether the domestic laws and regulations are consistent with WTO law, Panels usually presume legitimacy unless shown otherwise.Footnote 90 Certain aspects of data protection or cybersecurity laws could be inconsistent with WTO law. If a data protection measure imposes certain conditions for cross-border data transfer (for example, that the recipient country has an equivalent level of data protection, also known as the adequacy mechanism), it can be challenged if these conditions are discriminatory or ambiguous. For example, in Russia, any country that is party to the Strasbourg ConventionFootnote 91 is deemed to have an adequate level of data protection irrespective of how the law might be implemented in that country.Footnote 92 Kuner also argues that the grounds for evaluation of adequacy under the GDPR are largely political rather than objective requirements.Footnote 93 Similarly, if a specific technical standard or regulatory requirement for cybersecurity is implemented without guidelines or in a discriminatory fashion, it could be inconsistent with WTO law. For example, the Chinese cybersecurity law requires all foreign service suppliers to adopt ‘secure and controllable’ standards without clearly specifying how they can meet this requirement.Footnote 94 Additionally, this law also forces foreign companies to disclose the source code of their digital services to the government.Footnote 95
A data localization measure ‘secures compliance’ with domestic laws and regulations when the measure is intended to enforce the said laws and regulations.Footnote 96 The AB has interpreted that securing compliance does not imply that the results of the measure can be guaranteed with ‘absolute certainty’.Footnote 97 For example, a Member can claim that a data localization measure achieves stronger enforcement against foreign companies breaching domestic data protection laws. A Panel may accept this assertion without sufficient quantitative evidence based on other considerations such as the regulatory capacity of the country and the importance of privacy within the specific cultural context of the society. For the purposes of this article, I assume that these conditions are satisfied to further my analysis, although these factors could be scrutinized further based on the context and design of the data localization measure.
4.1.2 GATS Art. XIV(a) Is Relevant in Cases Involving Cyber Risks to Maintaining Public Order
Certain cybersecurity laws and regulations may be designed to achieve the objective of maintaining public order (GATS Art. XIV(a)). This assessment needs to focus on whether there is a ‘genuine and sufficiently serious threat … to one of the fundamental interests of the society’.Footnote 98 The AB acknowledges that the notion of ‘public order’ can ‘vary in time and space, depending upon a range of factors, including prevailing social, cultural, ethical and religious values’.Footnote 99 Therefore, ‘public order’ in GATS Art. XIV(a) could be interpreted to cover measures designed to address cyberthreats affecting WTO Members.Footnote 100 For instance, GATS Art. XIV(a) could cover measures designed to address security threats to Internet of Things (IoT) that pose a ‘serious threat’ to security of all homes connected via smart gadgets.Footnote 101 Finally, given that in certain societies, protecting individual privacy has significant cultural and social connotations,Footnote 102 certain Members may argue that safeguarding individual privacy through data localization is fundamental to protection of public morals under GATS Art. XIV(a). However, because GATS Art. XIV(c) already contains an explicit provision for protection of privacy, this argument is less likely to be made in a dispute.
4.2 Necessity of Data Localization Measures to Achieve Privacy and Cybersecurity
In over two decades of its jurisprudence, WTO tribunals have developed a holistic necessity test to assess the necessity of a measure under GATS Art. XIV, consisting of: (i) assessing the relative importance of the interests and values underlying the measure; and (ii) a ‘weighing and balancing’ test in light of those policy objectives considering the contribution of the measure to the objective, the restrictive impact of the measure on international commerce, and availability of reasonable and less trade restrictive alternatives.Footnote 103
4.2.1 Relative Importance of Privacy and Cybersecurity
Protecting privacy of internet users, and achieving cybersecurity are fundamental requirements for maintaining the stability of the internet and enabling a trusted environment for cross-border data flows.Footnote 104 Key players in the international community, including the UN and its agencies, and internet governance organizations pay close attention to issues of cybersecurity and privacy in the context of international relations.Footnote 105 As the internet is integrated into the day-to-day lives of people, and cybercrimes are on the rise, governments are also resorting to new measures to ensure that digital services are secure, and internet users are not exploited by internet platforms; these include implementing national cybersecurity strategiesFootnote 106 and full-fledged data protection frameworks.Footnote 107 The protection of individual privacy is also explicitly covered under GATS Art. XIV(c), given that service providers undermining privacy was a serious concern, even in the pre-internet era.Footnote 108 Given the strategic importance of protecting privacy and cybersecurity, including the enormous risks associated with failing to provide for these frameworks in a digitalized economy, Panels are likely to accord very high priority to these objectives in a data localization-related trade dispute.
4.2.2 How Data Localization Achieves Privacy and Cybersecurity
In justifying a measure under GATS Art. XIV, the defendant must provide objective evidence of the necessity of a measure, rather than asserting or stating its policy objectives.Footnote 109 Therefore, a ‘genuine relationship of means and ends’ between the measure and policy objective is essential to prove that a data localization measure contributes to the stated policy objective(s).Footnote 110 As discussed in Section 2, data localization measures aimed at cybersecurity and privacy usually interfere with the standard end-to-end architecture of the internet, and potentially affect the technical design of digital products. Thus, in assessing the contribution of a data localization measure in achieving compliance with cybersecurity and privacy laws, the Panel is likely to examine evidence on how the specific measure impacts the underlying technical features of a digital service, whether it enhances (or has the potential to improve) security of the networks and/or security and privacy of data, and how it impacts data flows. However, this examination is restricted to examining the sufficiency of evidence regarding the effectiveness of the measure (i.e. whether it contributes to cybersecurity and privacy); but in appreciating such evidence,Footnote 111 the Panel cannot become an ‘arbiter’ of various technical opinions on cybersecurity or privacy measures.Footnote 112
Technical evidence often weighs against the ability of data localization measures to contribute to policy objectives of cybersecurity and privacy.Footnote 113 Data localization does not reduce network vulnerabilities such as cyberattacks, vulnerability to natural disasters, or data fraud.Footnote 114 On the contrary, localizing makes data less secure as it becomes concentrated in specific servers, and, hence, an easier target for cyberattacks and surveillance.Footnote 115 Further, data localization does not increase government access to the data if the data are encryptedFootnote 116 or enhance governmental control if multiple jurisdictions can simultaneously claim right to that data.Footnote 117 Technical evidence also indicates that data localization causes engineering inefficiencies; for instance, interfering with underlying transfer protocols of the network to route data in a specific manner and, thereby, disrupting trade in digital services.Footnote 118
However, data localization could enable easier monitoring of local servers or taking actions against operators breaching data protection or cybersecurity laws, particularly considering the low levels of international cooperation on these issues. For example, tracking down violations or pursuing civil/criminal action against violators in one's territory might be easier than taking actions against those companies operating and providing their services from abroad. Further, data localization may be justified if a country prevents transfer of data to countries with a very poor track record of cybersecurity or data protection; for example, where governments are known to force companies to hand over data coercively. In such cases, investigating the technical efficacy of a data localization measure in addition to other factual evidence may provide meaningful input in assessing the contribution of the measure to the stated policy objective.
The territorial logic behind data localization measures however does not align well with the nature of digital data flows, particularly in the age of ubiquitous cloud computing.Footnote 119 Experts argue that cloud computing enables instantaneous and automatic routing of data packets to several locations in the world simultaneously, usually broken down into several smaller packets through a process known as sharding.Footnote 120 Thus, the location of internet users is irrelevant to where/how their data are stored.Footnote 121 Consequently, the location of the data, i.e. whether they are located in domestic or foreign servers, a single server, or across multiple servers in different parts of the world, cannot be determinative of the security, quality, or privacy of data.Footnote 122 Rather, the robustness of the technical designs and protocols underlying the internet network and digital services determine data security and privacy.
4.2.3 Trade Restrictive Impact of Data Localization
Several studies have focused extensively on the disruptive economic impact of data localization, and its threat to trade in a digital economy.Footnote 123 Compliance with data localization measures inevitably disrupts the technological and commercial arrangements inherent to the digital sector, particularly as a majority of players rely on economies of scale in the digital sector.Footnote 124 Further, a foreign service supplier might be unwilling to relocate servers to the territories of WTO Members a with poor regulatory or physical infrastructure.Footnote 125 Smaller companies might lack sufficient resources to build local servers and thus might be prohibited from entering markets with data localization laws. These factors indicate that data localization measures have an over-all trade-inhibiting effect, by significantly reducing exports by foreign service providers.
However, the direct economic impact of cross-border data flows is not easily measurable,Footnote 126 and thus presenting robust quantitative evidence of the restrictive impact of data localization is not always possible.Footnote 127 Even in such scenarios, the Panel could be presented with other evidence by the complainant; for example, surveys showing less open or less competitive markets for foreign digital services in a specific market, low trust levels in indigenous digital services or local cloud computing facilities, and lack of sufficient digitally driven services in the domestic market. All these factors could indicate reduced opportunities for export of digital services into the market of a particular Member. Sometimes, understanding the way a data localization measure blocks cross-border data flows can be instructive in assessing the degree of trade restrictiveness. For example, if a data localization measure affects underlying transfer protocols or the integrity of the domain name system, its trade-restrictive impact is far deeper than when it forces a few digital service providers to make cosmetic modifications to their technical design or terms of use.
4.2.4 Availability of Reasonable and Less Trade Restrictive Measures
In conducting a holistic necessity analysis through a ‘weighing and balancing’ test,Footnote 128 alternative measures proposed by the complainant, which are less trade-restrictive, reasonably available to the defendant, and achieve an equivalent level of protection, have been considered very carefully in WTO disputes.Footnote 129 For example, can a government compel foreign companies to comply with domestic data protection or cybersecurity laws without necessarily using data localization measures? One commonly discussed alternative is holding service providers accountable for circumventing domestic laws related to data protection and security for breaching domestic laws, irrespective of the location of the data or service provider (also known as the accountability approach). Theoretically, this approach is flexible because instead of imposing fixed standards or highly prescriptive compliance requirements such as data localization, the digital service providers have the freedom to adopt any practices and standards that meet the basic principles of a Member's privacy and cybersecurity laws.Footnote 130 However, as argued below, significant debate exists regarding its effectiveness in ensuring data privacy and security compared to prescriptive restrictions on cross-border data transfer.Footnote 131 An example is the GDPR, which holds companies liable for applying all the rules in relation to data processing of EU residents, irrespective of where the digital services originate.Footnote 132 Some experts like Kuner argue that the above provision negates the need for restrictions on cross-border data transfers in GDPR.Footnote 133
A defending Member is likely to argue that the above alternative is either not ‘reasonably available’ because of its inadequate regulatory capacity or that it does not achieve an equivalent level of cybersecurity and privacy as a data localization measure. Several experts argue that an accountability approach in data protection is more viable than a prescriptive approach resulting in de facto localization.Footnote 134 However, in certain cases, a provision requiring accountability of digital service providers can be ineffective by itself – for example, monitoring, or auditing, the data processing facilities of all digital service suppliers (particularly from outside the country) is practically impossible, even for the most developed Members. Further, when the chances of being caught are negligible, foreign digital providers are likely to avoid the excessive requirements in domestic laws (despite their binding nature), making data processing potentially more unsafe and susceptible to security and privacy breaches.Footnote 135 Thus, a Member may argue that data localization measures may be more effective in addressing such security and privacy risks. At best, an accountability approach appears to be a useful complement to strict data privacy and security requirements, including those restricting cross-border data transfers.
Additionally, a complainant might propose that privacy trustmarks or a self-certification mechanism (including for security of digital services and applications) are less trade restrictive than data localization measures.Footnote 136 An example of a voluntary certification system is the APEC Cross-border Privacy System (CBPR),Footnote 137 where an independent body (either a public entity or private company) certifies that policies and practices of all participating businesses are compliant with the APEC Privacy Framework.Footnote 138 However, certain experts have questioned its effectiveness, including its ability to promote a high standard of data protection in participating countries.Footnote 139 For instance, TrustArc (formerly, Truste) (an accountability agent for APEC CBPR) has been penalized for fraudulent certifications.Footnote 140
A complainant may also argue that a mandatory requirement for privacy and security-by-design in all digital products and services are sufficient to ensure data privacy and security of data flows and are a less trade restrictive alternative to data transfer restrictions. In other words, if all digital service providers adopt highly secure and privacy-enabling technologies, data localization measures to achieve privacy and cybersecurity become redundant. The 32nd International Conference of Data Protection and Privacy Commissioners unanimously passed a resolution in 2010 recognizing ‘Privacy by Design as an essential component of fundamental privacy protection’ and encouraging ‘the adoption of Privacy by Design's Foundational Principles … as guidance to establishing privacy as an organization's default mode of operation’.Footnote 141 The EU has included a mandatory privacy requirement and security by design in the GDPR.Footnote 142 However, a defending Member is likely to argue that mandatory privacy and security-by-design are at best complementary measures due to the lack of global norms on data privacy and security as well as the dearth of international benchmarks.
In each of the above cases, the Panels consider whether these evidently less trade restrictive alternatives are reasonably available to the defendant, practicable, and whether they achieve an equivalent (or better) regulatory outcome as data localization. Under GATS, Members have autonomy to choose their desired level of protection and the means to safeguard their domestic policy objective.Footnote 143 Thus, the Panel is only able to evaluate the efficacy of the data localization measure, or any other tools used to achieve cybersecurity/privacy, along with the proposed less trade restrictive alternatives by looking at the evidence presented in a dispute. This evidence can sometimes be instructive in detecting disguised security/privacy measures. For example, if a Member claims that its data localization measure will prevent all security or privacy breaches, no evidence is likely to support such an assertion. However, to date, no international consensus exists on the viability of many of the above-discussed alternatives, despite several efforts of the industry and certain governments (for instance, making the APEC CBPR compatible with the GDPR). Therefore, even if sufficient evidence were presented by technical experts supporting the efficiency of the above discussed alternative measures, which are potentially less trade-restrictive, the Panel will most likely refrain from considering them due to the absence of international standards on data privacy and cybersecurity.Footnote 144 Such a restrained approach is perhaps more judicious, given that WTO tribunals are not appropriately equipped to prescribe or favour specific technical or domestic policy standards, and lack the mandate and expertise to prescribe internet policies.
4.2.5 Outcomes of Weighing and Balancing Test
The outcome of the weighing and balancing test would depend on several factors in each dispute, such as the design and implementation of the measure, the stated motive behind the measure, the evidence presented by the disputing and third parties, the availability of other technical experts, and finally, the alternatives advanced by the complainant to the data localization measure. The assessment in the above section indicates that a clear motive of disguised protectionism would usually be caught by GATS Art. XIV. For example, if a Member claims that a certain measure has a security or privacy objective but evidence suggests no such causal link, then the measure would be illegal under GATS. A case in point is the Russian Data Localization LawFootnote 145 – the rationale of protecting the privacy of Russian citizens by forcing all foreign companies to store a master copy of all personal data locally is unclear given that data localization: (i) significantly increases the costs borne by foreign companies;Footnote 146 and (ii) reduces the quality of services available (and, hence, security and privacy of data).Footnote 147
Even if a data localization measure has a strong privacy or cybersecurity rationale, it might be based on a contested regulatory standard or benchmark, which might represent a specific country's vision of desirable internet policy but does not necessarily reflect the values of the internet governance community. For example, several experts (particularly in the private sector) argue that the security standards in the Chinese cybersecurity law are disproportionate, deliberately ambiguous, and geared towards achieving cybersovereignty, rather than ensuring high levels of security or privacy.Footnote 148 Similarly, the application of the test is less clear when a data localization measure has multiple objectives. For example, a data protection law resulting in localization also creates economic advantage for the domestic digital industry, such as the increase in data centers in the EU to facilitate compliance with GDPR.Footnote 149
4.3 Assessing Data Localization Measures under GATS Art. XIV Chapeau
Assuming a data localization measure satisfies the exception provided under one or more of the sub-clauses of GATS Art. XIV, it should also be examined for consistency with the chapeau of GATS Art. XIV which reads:
Subject to the requirement that such measures are not applied in a manner which would constitute a means of arbitrary or unjustifiable discrimination between countries where like conditions prevail, or a disguised restriction on trade in services, nothing in this Agreement shall be construed to prevent the adoption or enforcement by any Member of measures.
The chapeau of GATS Art. XIV prevents abuse of the exceptions available under the sub-sections of this provision.Footnote 150 In conducting this assessment, a Panel examines the implementation and operationalization of the measureFootnote 151 in order to ensure that the measure is implemented in ‘good faith’.Footnote 152
First, a Panel should assess whether ‘like conditions’ prevail either (a) between the Member imposing the data localization measure and other exporting Members; or (b) in case a data localization measure, favours or disfavours specific exporting Members, then between those Members and other exporting Members. An example of (b) would be a data protection law with an adequacy mechanism which allows data transfers to specific Members but otherwise generally disallows cross-border transfer of data in order to achieve compliance with its domestic data protection laws. In assessing ‘like conditions’, the Panel could compare the internet regulatory conditions in different countries. For example, if a country has a very poor track record of cybersecurity, then it is unlike another country which has a strong framework for cybersecurity. Certain indices such as the Global Cybersecurity Index developed by the ITU could be helpful here.Footnote 153 Similarly, the Panel could also compare the regulatory culture of privacy in different Members; for example, Members with strong data protection laws, including those that recognize and enforce a fundamental right to privacy, might be unlike those Members that either have a weak regime or have been known to violate the privacy rights of their citizens.
Further, in examining whether the measure constitutes ‘arbitrary or unjustifiable discrimination’ or is a ‘disguised restriction on trade in services’, different aspects of the design, structure, and implementation of data localization measure could be informative.Footnote 154 For example, if a specific domestic law prevents commercial surveillance by foreign companies, including assembling and manipulating data for estimating market trends, but imposes no similar requirement on domestic companies, then it could qualify as ‘arbitrary or unjustifiable discrimination’ if regulatory conditions in those countries are otherwise similar.
A measure may constitute a ‘disguised restriction on trade in services’ if it favours domestic providers to conduct extensive data analysis across their entire customer network while depriving foreign providers of similar benefits, particularly if they cannot have comparable data processing expertise in that country. Another scenario could be when a domestic law prohibits commercial surveillance, while providing extensive powers to the domestic government to breach the privacy of its citizens in an unreasonable manner, or when domestic laws on privacy or security are not seriously enforced against domestic offenders while forcing foreign companies to relocate. For example, despite implementing a blanket data localization law for personal data to safeguard the privacy of its citizens, the Russian government also has a large number of domestic laws that authorize the government to intrude on the privacy of its residents in an unreasonable manner.Footnote 155 Finally, certain regulatory requirements might be so excessive or unreasonable that foreign companies might not be able to enter the market altogether (for example, obtaining necessary licenses or permissions to transfer data while providing digital services in that country), thus also qualifying as a disguised restriction on trade in services.
5. Eliminating Protectionist Data Localization Measures, Promoting Free Flow of Data and Preserving Privacy and Cybersecurity: Balancing Trade and Internet Regulation
In applying GATS Art. XIV to data localization measures, two distinct perspectives on internet policy come to the forefront: the views of the internet technical and policy community and those of governments. Clearly, the multistakeholder and transnational norms of internet governance often conflict with domestic cyber policies. However, the principles in international trade agreements, such as GATS, can be read harmoniously with multistakeholder or transnational views on internet governance. Although GATS lacks explicit rules on digital trade and internet data flows, its underlying principle of progressive trade liberalizationFootnote 156 can align with several norms in internet governance. For example, ensuring free flow of data, one of the fundamental principles in internet governance, is also important to ensure that the internet can be utilized as a platform for trade.Footnote 157 Similarly, ensuring internet security and facilitating trust in the internet, including protecting privacy of internet users, are not only compelling goals in internet governance, but also increasingly recognized as a precondition for facilitating digital trade.Footnote 158 In contrast, domestic policy is often focused on the internet from narrower economic and socio-cultural standpoints. For example, a country might view internet security only from the perspective of national security rather than cybersecurity, or recognize only a very prescriptive model of data protection.
The most judicious approach to remove protectionist data localization measures without intruding into domestic internet policy is to conduct a closer examination of the technical and factual evidence available on a case-by-case basis. GATS Art. XIV provides WTO tribunals the chance to delve into the efficacy of a data localization measure without interfering with the desired level of privacy or cybersecurity of a country. For example, technical or factual evidence is unlikely to support a claim by any government that data localization will eliminate cybercrimes or prevent all data breaches but may suggest that certain forms of localization can be conducive to better security or effective domestic legal enforcement. Conversely, certain forms of localization are unnecessary when they involve transfer of less sensitive data such as day-to-day business data constituting disaggregated and anonymized datasets primarily consisting of non-personal data,Footnote 159 or when the underlying technology of a digital service is highly secure and robust. These assessments can be made without assessing whether a Member can pursue cybersecurity or privacy policies within its jurisdiction, and to what degree, thus maintaining the inherent balance enshrined in GATS Art. XIV. In undertaking this assessment, the expertise of the internet technical community can be fruitful as they have precise knowledge of security and privacy technologies, and can provide an objective assessment of the effectiveness of the measure, irrespective of whether the stated objective is rational or excessive.
The reliance on technical or factual evidence will not however reduce the discretion of Panels to assess legitimacy of data localization measures. As security and privacy tools continue to evolve rapidly, the internet technical community is constantly redefining best practices in these areas. Further, due to the diversity of stakeholders in the internet technical and policy community, no single body controls all aspects of digital data transfers.Footnote 160 While it is within the powers of the Panel to use external expert evidence,Footnote 161 the question is whether certain multistakeholder bodies such as the IETF, W3C, or the IGF can provide relevant inputs in trade disputes. Are technical codes, private standards, and multistakeholder norms relevant in assessing the necessity of a data localization measure? In practice, these questions are not straightforward and will require WTO tribunals to have at least a functional knowledge of internet governance. Further, the status of such transnational, multistakeholder, and extra-legal instruments (such as technical codes) is unclear in WTO law.Footnote 162 However, despite this unclear relationship, it is possible for Panels to consider some of these instruments as factual evidence in disputes even when they cannot be clearly used as legal tools for interpretation.Footnote 163
In exercising its discretion under GATS Art. XIV and whilst weighing and balancing various trade and internet policy goals, WTO tribunals should remain cognizant that robust and effective technical standards on cybersecurity and privacy facilitate the free flow of data, rather than constrain it, as discussed in Section 3. On the other hand, non-transparent and unreasonable technical standards are usually ineffective in making data more secure and impede internet openness.Footnote 164 As argued previously, available evidence to date suggests that if a data localization measure adversely affects the open architecture of the internet,Footnote 165 it becomes undesirable both from a commercial point of view and from a security/privacy point of view.Footnote 166 For example, data localization measures requiring local routing of data interfere with the autonomy of the technical protocols and the reliability of the internet, including accessibility to websites.Footnote 167 Measures enforcing specific technical standards can damage interoperability and security, and make data transfer unsafe, particularly if the standards do not reflect industry best practices.Footnote 168 If technical standards prescribed by a specific country were indeed effective in ensuring better security or privacy in the network, they would have automatically emerged as global best practices in the technology industry, enhancing internet openness rather than inhibiting free flow of digital services.Footnote 169
On a cautionary note, the role of GATS should not be misplaced or overestimated in the regulation of digital data flows. First, GATS does not recognize cybersecurity and privacy as preconditions for digital trade but rather limits their relevance to GATS Art. XIV (and also, GATS Art. XIV bis, when national security issues are involved).Footnote 170 WTO Members are still divided on the role of cybersecurity and privacy in international trade law.Footnote 171 This situation is further complicated by the absence of binding international legal principles on internet governance.Footnote 172 Thus, the capacity of WTO tribunals to resolve the divide between multistakeholder norms and domestic public policy goals, such as privacy and cybersecurity, is limited. One example here is assessing whether self-regulatory standards in security and privacy can be viable alternatives to data localization. Here, certain types of evidence may assist, such as how similar standards have functioned in countries with similar levels of development or regulatory infrastructure, and the potential costs of monitoring. But, in the end, a Panel may refrain from this exercise to avoid causing dissatisfaction in the broader international community.Footnote 173
Second, given the limited list of policy objectives under GATS Art. XIV, certain evidence from the internet community might be irrelevant, despite reflecting fundamental engineering principles. For example, evidence that a data localization measure affects the integrity of the domain name system may not be as relevant in international trade law,Footnote 174 unless it also results in discriminatory treatment of foreign services and service providers, or violates GATS obligations on transparency or domestic regulations.
Addressing data localization measures ultimately necessitates a sophisticated and multidimensional response bringing together several areas of international governance, including international trade law and internet governance. Some policy initiatives that could influence building of better linkages between international trade law and internet governance and policy in the near future include: (i) developing global/transnational consensus in non-trade disciplines, such as data protection, cybersecurity, and international human rights, as well as development of new binding international standards or norms; (ii) developing new rules within the multilateral framework, seeking a better balance between internet openness, security, and privacy, including considering new disciplines on electronic commerce (for example, under GATS Art. VI:4),Footnote 175 and provisions on cross-border data flows; and (iii) exploring routes to develop more dialogue and partnerships between trade policymakers and internet experts, particularly while negotiating new rules on electronic commerce.Footnote 176
6. Conclusion
The absence of international consensus on internet governance issues coupled with the dated nature of GATS will pose complex problems if disputes on data localization measures are brought before the WTO. To a certain extent, GATS Art. XIV can be creatively and thoughtfully applied to reduce protectionist data localization barriers while preserving a country's right to regulate on grounds of cybersecurity and privacy. However, the application of GATS Art. XIV entails extensive assessment of complex technical issues to balance free flow of data with legitimate public policy concerns. In assessing such issues, WTO tribunals can consider a range of technical and factual evidence to assess the technical efficacy of data localization measures in achieving privacy and cybersecurity. However, as the broader internet regulatory framework is deeply divided between multistakeholder/transnational internet governance norms and domestic public policy, this assessment is not always straightforward. Ultimately, the role of international trade law in data flow regulation is circumscribed by the lack of binding norms in internet governance.
This article also points out the importance of understanding the broader relationship between international trade law and internet governance in the context of cross-border data flows. To play a meaningful role, international trade law should not interfere with both the fundamental infrastructure of the internet and the exercise of regulatory autonomy in the domestic space for legitimate public policy objectives. While the latter can often be read into GATS Art. XIV (and XIV bis), the former is typically based on transnational norms and extra-legal codes outside the scope of GATS. Thus, applying international trade law to data localization effectively not only requires contextualizing existing rules to the digital economy but also contingent on the development of norms and standards in internet policy and governance. Ultimately, synergy between different fields of international governance, including trade law and internet governance, is essential for building a global network for communication and data flows. Moving forward, in developing solutions to address data localization or other restrictions on data flows, one should remain wary of placing excessive emphasis on disciplines in GATS or other trade agreements, and instead work towards developing a more balanced, multidimensional framework addressing various facets of internet and data regulation.
Author ORCIDs
Neha Mishra, 0000-0003-3028-2734
