As U.S. and European regulators and businesses work toward solutions in the wake of last month's decision by the Court of Justice of the European Union that invalidated the EU-U.S. Safe Harbor framework for cross-border data transfers – previously discussed here and here – the Trans-Pacific Partnership (TPP) trade agreement seeks to facilitate cross-border data sharing and would restrict the ability of member countries to demand local storage of information.
More than five years in the making, the TPP is a comprehensive trade agreement negotiated among the U.S., Canada, Mexico, and nine other Pacific Rim countries (Australia, Brunei Darussalam, Chile, Japan, Malaysia, New Zealand, Peru, Singapore, and Vietnam). It is aimed at opening up markets and easing trade barriers, covering issues ranging from workers' rights and intellectual property to anticorruption and the environment. As we discussed during earlier TPP negotiations, the TPP also contains binding, enforceable provisions that would prevent TPP members from blocking cross-border data transfers or requiring companies to locate data servers in the country as a condition of doing business there.
According to the TPP's Electronic Commerce provisions (Article 14), each country "shall allow the cross-border transfer of information by electronic means, including personal information, when this activity is for the conduct of the business." The text of the TPP does not define "for the conduct of the business," leaving the door open for a broad interpretation that could encompass a wide variety of purposes. Similar to the EU's definition of "personal data," the TPP broadly defines "personal information" to mean "any information, including data, about an identified or identifiable natural person."
The TPP prominently recognizes the need to establish comprehensive and compatible privacy laws across the 12 TPP countries. According to Article 14.8, "each Party shall adopt or maintain a legal framework that provides for the protection of the personal information of the users of electronic commerce. In the development of its legal framework for the protection of personal information, each Party should take into account principles and guidelines of relevant international bodies."
The TPP recognizes that although countries may take different legal approaches to protecting personal information, TPP members should strive to develop "mechanisms to promote compatibility between these different regimes." Although the TPP permits each country to adopt measures aimed at protecting personal information (which might otherwise be inconsistent with the free flow of cross-border data), they may do so only if those measures are (1) not applied in a manner that discriminates or unreasonably restricts trade; and (2) the least restrictive means for achieving a "legitimate public policy objective."
The TPP also addresses concerns regarding data localization by stating that no TPP country "shall require a covered person to use or locate computing facilities in that Party's territory as a condition for conducting business in that territory." As we previously discussed regarding Russia's data protectionism, in recent years data localization laws have become a concern for many companies operating globally. For example, in 2013, Vietnam enacted the Decree on Management, Provision, and Use of Internet Services and Information Content Online, which required certain companies to maintain, within Vietnam, a copy of their data to allow for inspection by government authorities.
As noted above, the TPP includes provisions that prohibit unreasonable limitations on the cross-border transfer, storage, and processing of data, which are intended to help establish a global framework for the free flow of information in the growing digital economy. If ratified by the 12 countries, the TPP will be the largest regional trade agreement to date, touching 40 percent of the global economy. Given recent developments in the EU, it will be interesting to see whether the TPP's cross-border data sharing provisions attract controversy or are modified prior to ratification.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.