The Rise of Artificial Intelligence, Big Data, and the Next Generation of International Rules Governing Cross-border Data Flows and Digital Trade—part Ii

• Publication year: 2024
• Citation: Vol. 1 No. 3

[Page 173]

Frank J. Schweitzer, Ian Saccomanno, and Naoto Nelson Saika ^*

In this two-part article, the authors discuss the proliferation of barriers to cross-border data flows and the current global legal architecture that governs the digital economy, including current World Trade Organization and trade agreement disciplines applicable to such barriers. This article also addresses new digital trade initiatives and concludes with an outlook regarding ongoing U.S. efforts to negotiate new agreements that aim to strike an appropriate balance between facilitating digital trade and international data flows and preserving the space of governments to regulate in the public interest.

This two-part article is divided into eight sections. The first part was published in the March-April 2024 issue of The Global Trade Law Journal and covered the first four sections of the article, addressing the proliferation of barriers to cross-border data flows and the current global legal architecture that governs the digital economy. This second part contains the fifth, sixth, seventh, and eighth sections.

The fifth section discusses current trade agreement disciplines relevant to data flows, including the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) and the United States-Mexico-Canada Agreement (USMCA). The sixth section considers new trade initiatives, including the Indo-Pacific Economic Framework (IPEF), the U.S.-Taiwan Initiative, the EU's Digital Trade Agreements and implications of the EU's data privacy laws, new digital trade agreements in the Asia-Pacific, and emerging work in other international fora. The seventh section analyzes the U.S. political dynamic, the implications of the lack of

[Page 174]

U.S. trade promotion authority, and offers an outlook for pending negotiations. Finally, the eighth section contains key takeaways.

Modern Trade Agreement Disciplines on Digital Trade

Disciplines Relevant to Data Flows and Digital Trade Have Emerged in Modern Trade Agreements, Including the CPTPP and the USMCA

With the perceived relevance of the World Trade Organization's (WTO's) functions for rule making and dispute resolution diminishing, the importance of regional and bilateral initiatives increases. ¹ Digital trade rules have been a feature of U.S. Free Trade Agreements (FTAs) for nearly two decades. All U.S. FTAs signed since 2003 have included chapters on electronic commerce, starting with the U.S.-Singapore FTA. Disciplines on digital trade set forth in this first generation of FTAs covering digital trade rules, however, were limited in scope, in most cases dealing only with customs duties and discriminatory measures targeting digital products such as software and videos.

The first FTA to include a robust digital trade chapter was the Trans-Pacific Partnership (TPP), which the United States and 11 other countries signed in 2016. The TPP included groundbreaking new disciplines addressing data localization, cross-border data flows, and forced technology transfer, while also updating e-commerce disciplines found in prior agreements. The United States withdrew from the TPP in 2017, ² but the 11 remaining parties implemented the agreement (which is now known as the CPTPP). ³ Since its conclusion in 2016, China, Costa Rica, Ecuador, Taiwan, Ukraine, the United Kingdom, and Uruguay have applied to join, and numerous other countries have expressed interest. ⁴ In July 2023, the United Kingdom became the first new country to sign the agreement since its original negotiation. ⁵

As it grows to cover a wider swath of the global economy (and the United States continues to build on its provisions in other agreements), the principles in the CPTPP's digital trade chapter will become increasingly central to how governments manage digital trade. The CPTPP's digital trade chapter served as the template for subsequent U.S. agreements, including the USMCA and the

[Page 175]

U.S.-Japan Digital Trade Agreement (U.S.-Japan DTA), both of which updated the CPTPP rules in important ways. This second generation of digital trade agreements addresses a wide range of issues, from electronic signatures to online consumer protection and cybersecurity. The most commercially significant and politically sensitive provisions deal with the core issues of cross-border data flows, localization, forced technology transfer, and treatment of electronic transmissions.

Prohibiting Customs Duties on "Electronic Transmissions" and Underlying Content

The CPTPP prohibits the imposition of customs duties on "electronic transmissions" among the CPTPP Parties. ⁶ This provision goes beyond the WTO moratorium by making the prohibition permanent, and by clarifying that the prohibition extends to "content transmitted electronically" (not only to the transmissions themselves). Commitments of this kind can play an important role in ensuring the seamless global flow of data, software, media, and other digital content. Earlier FTAs such as the Korea-United States Free Trade Agreement (KORUS) included similar prohibitions but applied them only to "digital products" (e.g., computer programs, videos, and sound recordings), rather than extending them to all electronic transmissions and their contents. ⁷ The U.S.-Japan DTA mirrors the CPTPP's approach, whereas the USMCA reverts to the earlier FTA practice, applying the prohibition only to "digital products" produced for commercial sale. ⁸

Cross-Border Data Flows

The CPTPP requires Parties to "allow the cross-border transfer of information by electronic means, including personal information," when such transfers are for business purposes. ⁹ Cross-border data flow obligations represent a major advance given the critical importance of international data transfers in nearly every segment of the modern economy, including services, research and development, manufacturing, and even agriculture. However, the CPTPP's data flow obligation contains an exception that allows Parties to restrict cross-border data flows "to achieve a legitimate public policy objective," provided that the measure (1) is not applied in a manner that would constitute arbitrary or unjustifiable discrimination or a disguised restriction on trade; and (2) does not impose

[Page 176]

restrictions greater than are required to achieve the objective. The CPTPP does not define what constitutes a "legitimate public policy objective" and governments could potentially seek to justify a wide range of restrictions under this exception.

The USMCA and the U.S.-Japan DTA include similar data flow obligations. However, these agreements go further by providing that Parties may not "prohibit or restrict" cross-border data flows (whereas the CPTPP merely requires Parties to "allow" such data flows). ¹⁰ The scope of prohibited conduct therefore appears broader under the USMCA and the U.S.-Japan DTA (i.e., these agreements arguably prohibit measures that impose limits or conditions on international data transfers but fall short of an outright ban on such measures). These agreements also extend obligations related to cross-border data flows in the financial services sector. ¹¹ However, both the USMCA and the U.S.-Japan DTA replicate the CPTPP's exception for data flow restrictions taken in furtherance of "legitimate public policy objectives."

Data Localization Requirements

The CPTPP prohibits a Party from requiring businesses "to use or locate computing facilities in that Party's territory as a condition for conducting business in that territory." ¹² However, the obligation includes a broad exception for localization measures that a Party imposes to achieve a "legitimate public policy objective," mirroring the exception to the data flow obligation.

The USMCA and the U.S.-Japan DTA go further than the CPTPP rule on data localization. Both agreements replicate the CPTPP's prohibition on data localization measures, but they do not provide an exception for measures taken to achieve a "legitimate public policy objective." ¹³ In addition, the USMCA and the U.S.-Japan DTA prohibit data localization measures in the financial services sector, whereas the CPTPP did not do so. ¹⁴ Nevertheless, governments could still seek to justify data localization measures under the security and general exceptions applicable to these agreements.

Forced Disclosure of Software Source Code and Algorithms

Another novel provision in the CPTPP prohibits a Party from requiring "the transfer of, or access to, source code of software owned by a person of another Party, as a condition for the import, distribution, sale or use of such software, or of products containing

[Page 177]

such software, in its territory." ¹⁵ This obligation is intended to address the concern that source code obtained in such a manner could be disclosed to unauthorized recipients, including business competitors and particularly state-owned enterprises. In the CPTPP, this obligation extends only to "mass-market software," and does not apply to software used for critical infrastructure or to government measures relating to patent applications or granted patents.

The USMCA and the U.S.-Japan DTA both expand the scope of this obligation to cover source code for all software, as well as "an algorithm expressed in that source code." ¹⁶ However, these agreements include broad exceptions allowing a regulatory body or judicial authority of a Party to require companies "to preserve and make available the source code of software, or an algorithm expressed in that source code, to the regulatory body for a specific investigation, inspection, examination, enforcement action, or judicial proceeding, subject to safeguards against unauthorized disclosure."

Exceptions

The digital trade provisions of these agreements are subject to general and security exceptions. All three agreements incorporate by direct reference to certain of the general exceptions contained in the WTO's General Agreement on Trade...