enact normative instruments similar to EU law in areas related to economic
integration.
Regarding the data protection system, all EU and EFTA Members are Parties of
the CE Convention 108. Moreover, EFTA EEA Members adopt the EU norms on
this issue through the incorporation of dispositions recollected in the Annex XI of
the EEA Agreement on “Electronic Communication, Audiovisual Services and
Information Society”, which incorporates one EU Regulation (611/2013/EU), the
two EU Directives on the issue (95/94/EC and 2002/58/EC), as well as many
Decisions (namely Decisions nos. 2000/518/EC, 2001/497/EC, 2002/2/EC, 2003/
490/EC, 2003/821/EC, 2004/411/EC, 2004/915/EC, 2008/393/EC, 2010/87/EU,
2010/146/EU, 2010/625/EU, 2011/61/EU, 2012/484/EU, 2013/65/EU, 2016/2295/
EU, 2012/2297/EU, 2016/1250/EU, and 2016/2297/EU).
6.3 The EU-CARIFORUM Agreement
The general structure of a chapter on data protection that can perform these functions
needs to include at least two aspects: the material scope of the chapter and the
establishment of a legal duty to adopt and make effective a minimum regime of data
protection. The EU-CARIFORUM Agreement (2008) sets the scope by articles on
objectives and definitions. An article on principles describes the minimum regime,
which is composed both of a set of standards and rights, and of indicative rules on
enforcement. The chapter is complemented by hortatory rules on cooperation and
mandatory notification and consultation procedures to keep the international coherence of the standards agreed.
The objectives make clear the double nature of data protection: a principiological
one, which protects privacy, freedom and rights of natural persons, and a functional
one, which is justified by the need to increase cross-border flows of personal data for
a more efficient international market. It also includes principles of transparency and
fairness. Moreover, the central objective of the chapter is the agreement on the duty
to establish “appropriate regulatory regimes” and “appropriate administrative capacity”, including independent supervisory authorities, to “ensure and adequate level of
protection” in line with “high international standards”.
6 The definitions include
6 EU-CARIFORUM FTA (2008), Chapter 6, Article 197: “General Objective. 1. The Parties and the
Signatory CARIFORUM States, recognising: (a) their common interest in protecting fundamental
rights and freedoms of natural persons, and in particular their right to privacy, with respect to the
processing of personal data, (b) the importance of maintaining effective data protection regimes as a
means of protecting the interests of consumers, stimulating investor confidence and of facilitating
transborder flows of personal data; (c) that the collection and processing of personal data should be
accomplished in a transparent and fair manner, with due respect accorded to the data subject, agree
to establish appropriate legal and regulatory regimes, as well as appropriate administrative capacity
to implement them, including independent supervisory authorities, in order to ensure an adequate
level of protection of individuals with regard to the processing of personal data, in line with existing
high international standards (1). 2. The Signatory CARIFORUM States shall endeavour to
Data Protection in International Trade Law
487
integration.
Regarding the data protection system, all EU and EFTA Members are Parties of
the CE Convention 108. Moreover, EFTA EEA Members adopt the EU norms on
this issue through the incorporation of dispositions recollected in the Annex XI of
the EEA Agreement on “Electronic Communication, Audiovisual Services and
Information Society”, which incorporates one EU Regulation (611/2013/EU), the
two EU Directives on the issue (95/94/EC and 2002/58/EC), as well as many
Decisions (namely Decisions nos. 2000/518/EC, 2001/497/EC, 2002/2/EC, 2003/
490/EC, 2003/821/EC, 2004/411/EC, 2004/915/EC, 2008/393/EC, 2010/87/EU,
2010/146/EU, 2010/625/EU, 2011/61/EU, 2012/484/EU, 2013/65/EU, 2016/2295/
EU, 2012/2297/EU, 2016/1250/EU, and 2016/2297/EU).
6.3 The EU-CARIFORUM Agreement
The general structure of a chapter on data protection that can perform these functions
needs to include at least two aspects: the material scope of the chapter and the
establishment of a legal duty to adopt and make effective a minimum regime of data
protection. The EU-CARIFORUM Agreement (2008) sets the scope by articles on
objectives and definitions. An article on principles describes the minimum regime,
which is composed both of a set of standards and rights, and of indicative rules on
enforcement. The chapter is complemented by hortatory rules on cooperation and
mandatory notification and consultation procedures to keep the international coherence of the standards agreed.
The objectives make clear the double nature of data protection: a principiological
one, which protects privacy, freedom and rights of natural persons, and a functional
one, which is justified by the need to increase cross-border flows of personal data for
a more efficient international market. It also includes principles of transparency and
fairness. Moreover, the central objective of the chapter is the agreement on the duty
to establish “appropriate regulatory regimes” and “appropriate administrative capacity”, including independent supervisory authorities, to “ensure and adequate level of
protection” in line with “high international standards”.
6 The definitions include
6 EU-CARIFORUM FTA (2008), Chapter 6, Article 197: “General Objective. 1. The Parties and the
Signatory CARIFORUM States, recognising: (a) their common interest in protecting fundamental
rights and freedoms of natural persons, and in particular their right to privacy, with respect to the
processing of personal data, (b) the importance of maintaining effective data protection regimes as a
means of protecting the interests of consumers, stimulating investor confidence and of facilitating
transborder flows of personal data; (c) that the collection and processing of personal data should be
accomplished in a transparent and fair manner, with due respect accorded to the data subject, agree
to establish appropriate legal and regulatory regimes, as well as appropriate administrative capacity
to implement them, including independent supervisory authorities, in order to ensure an adequate
level of protection of individuals with regard to the processing of personal data, in line with existing
high international standards (1). 2. The Signatory CARIFORUM States shall endeavour to
Data Protection in International Trade Law
487