The European Parliament gave consent to the EU - Chile trade agreement. The agreement’s digital chapter contains a new, broad cross-border data flow commitment, while Chile does not have a data protection adequacy status. As far as I know, this is a first.
The data flow commitment rules out data localisation. A new exception to the commitment allows measures to ensure privacy and data protection.
Chile’s current data protection law is “seriously outdated”; Chile is working on a new one. The EU-Chile trade agreement may enter into force before the new data protection law in Chile enters into force. Legally, qualitatively, nothing changes for EU outgoing data flows regarding data protection as the EU General Data Protection Regulation (GDPR) stays in force for data transfers, except that data localisation is ruled out for any reason other than the protection of privacy and personal data. Will “legally” match reality? Quantitatively flows may change.
When the EU commission first presented the new approach with broad data flows commitments with the new exception it noted that the new plans are meant for countries which do not have adequate protection of personal data. Reuters helpfully gave an example: Russia. Sweeping cross-border data flow commitments with Russia, under this or whatever safeguard would seem imprudent by now. It will remain important to choose trade partners wisely, and even, ever more wisely. Using the new approach in a WTO agreement would seem imprudent.
The new exception to the data flow commitment is unconditional. This is much stronger than earlier conditional exceptions. Still, there may be some potential weaknesses and limitations.
It would seem the European Commission made a mistake with most-favoured nation clauses. This clause imports into the agreement older data flow commitments with weaker exceptions. This undercuts the new exception. The EU could limit these clauses.
The prohibition of data localisation is formulated in an absolute, industry-centered, way. A developmental issue may arise. Would developing countries still have the ability to build up their own digital infrastructure and companies, or will ruling out data localisation “kick away the ladder”? Does ruling out data localisation have an imperialistic aspect?
Zooming out, international trade creates multinationals, with great lobby powers. Networked societies create network effects, leading to winners take most. The combination of these two dynamics creates behemoths, with outsized effects on democracies and fundamental rights. We may be insufficiently prudent regarding this.
