EU-Chile trade agreement: broad cross-border data flow commitment with ...

The EU/Chile Advanced Framework Agreement has two elements, a part the EU can conclude itself, the interim agreement, and a part that also needs ratification by member states, the broader framework with, for instance, investment arbitration. Here, we can skip the broader framework.

The relevant articles in the EU-New Zealand and EU-Chile trade agreements are identical or similar. As they are sufficiently similar, I will refer to earlier analysis.

Documents: Text of the interim agreement ; Commission page ; Council decision framework ; Council decision interim agreement ; EP decision framework ; EP decision interim agreement ; EP additional resolution; Annexes one, two

Procedure files: 2023/0260(NLE) (Advanced Framework) ; 2023/0259(NLE) (Interim); 2023/0260R(NLE) (Parliament statement)

The Volkswagen emissions scandal has shown that devices can be programmed to be misleading. In addition, algorithms in decision making software can be biased. And Facebook’s role in elections and referendums shows that the use of personal data is not only a civil rights issue, but may compromise the integrity of our institutions. In order to have regulatory supervision, we need access to source code and algorithms.

The EU - Chile agreement contains a software code clause (article 19.13) that limits regulatory supervision. The clause creates a new intellectual property right not created through the legislative process but by trade agreements. A scandal.

The prohibition of data localisation is formulated in an absolute, industry-centered, way. A developmental issue may arise. Would developing countries still have the ability to build up their own digital infrastructure and companies, or will ruling out data localisation “kick away the ladder”? Does ruling out data localisation have an imperialistic aspect? ⁴

Jane Kelsey argued that trade agreements may cement the oligopoly that entities like Google, Amazon, Facebook and Apple (GAFA) have established in the absence of domestic regulation. ⁵ These companies seek, Kelsey argues, to lock in the regulatory void through binding international rules that prevent governments from regulating their operations, as the risks become more apparent.

Kelsey notes various issues: predatory practices to drive competitors out of business; lack of onshore presence for consumer complaints; regulatory evasion by defining itself as a computer rather than as more regulated service; tax avoidance; anti-competitive network effects; dynamic pricing depending on users’ profiles; gender, race, nationality and class profiling when displaying commercial, advertising and news information; manipulation of political and social views, for instance the Cambridge Analytica scandal; purportedly self-employed workers who are denied the protections of domestic labour laws; and more. ⁶

Wendy Li worked as a special assistant in the U.S. trade representative’s office (USTR). A few years later she returned to Washington to do field work. A decade ago the big tech companies let go their allergy to Washington and formed and joined trade organisations, networked, socialised, hired former government officials, and got lobbyists appointed at USTR. They positioned themselves as experts with essential information and propagated a libertarian construction in which regulations are seen as illegal barriers to commerce. They provided input before the text phase of trade negotiations, and later provided suggestions on the text. They informed a quasi-governmental research body and managed to replicate successes: regulatory capture. ⁷ Li:

USTR has effectively internalized technology industry interests into their own mission.

Rules in trade agreements before local legislation is ready. We see the same end result in the EU with the software code clause (noted above) and the prohibition of data localisation is formulated in an absolute, industry-centered, way.

The U.S. now want policy space for a limited digital trade rethink.

It would seem the European Commission made a mistake with most-favoured nation clauses. This clause imports into the agreement older data flow commitments with weaker exceptions. This undercuts the new exception. The EU could limit these clauses.

The new exception to the data flow commitment is unconditional. This is much stronger than earlier conditional exceptions. Still, there may be some potential weaknesses and limitations. These potential weaknesses and limitations are structural, come from the trade system. Margot Kaminski argued that trade is not the place for the EU to negotiate privacy.

It will remain important to choose trade partners wisely, and even, ever more wisely. Using the new approach in a WTO agreement would seem imprudent.

Ruling out data localisation may come with a developmental issue. The EU could consider to add an exception for development to a ban on localisation.

International trade creates multinationals, with great lobby powers, enabling rent seeking. Networked societies create network effects, leading to winners take most. The combination of these two dynamics creates behemoths, with outsized effects on democracies and fundamental rights. We may be insufficiently prudent regarding this.

Cross-border data flows are not new.

The WTO 1995 General Agreement on Trade in Services (GATS) has a cross-border supply mode. The WTO writes about it: “defined to cover services flows from the territory of one member into the territory of another member (e.g. banking or architectural services transmitted via telecommunications or mail)”. This was defined before the internet took off commercially. The related safeguard in article XIV contains a necessity test which has been applied in strict ways by trade arbitrators. This undermines the safeguard.

The EU General Data Protection Regulation allows limited, specific cross-border data flows to non-EU countries.

The EU can allow cross-border data flows through an adequacy decision.

Earlier EU trade agreements, such as the one with Canada, have explicit data flow commitments in the financial chapter. I don’t think these chapters have a strong safeguard.

These earlier EU trade agreements also have implicit data flow commitments: cross-border services commitments imply cross-border data flows. The related safeguards are based on GATS article XIV – with the same weaknesses.

In the case of Japan, at the time of the conclusion of the trade agreement, the EU used a simultaneous finding of an adequate level of protection by both sides as a means to allow data flows.

In 2018 the EU commission presented a new approach. Broad and strong data flow commitments with an unconditional safeguard. This safeguard is a major improvement over earlier ones based on GATS article XIV, which contain conditions, among them a necessity test. The mention of data protection and privacy as a fundamental right in trade agreements is a positive development. NGOs welcomed the decision. For a broad discussion, see Svetlana Yakovleva and Kristina Irion (2020). I was somewhat more skeptical.

The agreement with the UK fell short of the new 2018 approach. The mention of data protection and privacy as a fundamental right went missing and the parties used other formulations. Fundamentally, Margot Kaminski argued that trade is not the place for the EU to negotiate privacy. The EU - UK agreement confirms this.

In the newer trade agreements (Chile, New Zealand) the EU used the approach presented in 2018. The digital chapter has the new data flow commitment with the new unconditional exception, which looks very strong at first sight, but has some potential weaknesses and limitations. The older commitments in the financial chapter and the cross-border services chapter are still present through most-favoured nation clauses. New Zealand has adequacy status, Chile does not.

Allowing cross-border data flows through an adequacy decision seems in principle the correct way to approach the issue. Such decisions are EU decisions. If data protection in a third country deteriorates the EU can revoke the adequacy status – in principle.