information is very important to direct the choices of international customers of these
services. Although it is generally accepted that access to financial data and the
identification of the natural and legal entities in the end of sometimes intricate and
complex chains of assets transfer and ownership is very important for tax and
security efforts, it is also fair to consider that a liberalisation agreement is not
necessarily the best place to set rules on access to private and sensitive information.
That is the rationale of rules in many agreements, as it will be shown below.
It is important to stress that this analysis does not cover the trans-border offer of
financial services of data processing. Although it is clear that these services often
depend on international information flow and treaty provisions in this regard impact
the legal regime of personal data protection, the relatively narrow scope of their
norms and their predominantly technical function suggest that it can be better studied
in connection to financial services.
7.1 Transfer and Processing of Information
The Agreement Establishing the ASEAN-Australia-New Zealand Free Trade Area
(ASEAN-AUT-NZL FTA) (2010) prohibits, in its annex on financial services,
measures that prevent the transfer or processing of information “necessary for the
conduct of the ordinary business of a financial service supplier” (Art. 7 (1) (a) (b)).
Moreover, Art. 7 (2) (a) makes clear that States can protect personal data in
according to domestic law and regulations “so long as such right shall not be used
as means of avoiding the Party’s commitments or obligations under this Agreement”.
21 There are also provisions that secure the power of administrative or
regulatory authorities. The Chile-Thailand FTA (2015) holds very similar rules
21 Agreement Establishing the ASEAN-Australia-New Zealand Free Trade Area, Annex on Financial Services, Article 7: “Transfers of Information and Processing of Information 1. A Party shall
not take measures that: (a) prevent transfers of information, including transfers of data by electronic
means, necessary for the conduct of the ordinary business of a financial service supplier;
115 (b) prevent the processing of information necessary for the conduct of the ordinary business
of a financial service supplier; or (c) prevent transfers of equipment necessary for the conduct of the
ordinary business of a financial service supplier, subject to importation rules consistent with
international agreements. 2. Nothing in Paragraph 1: (a) restricts the right of a Party to protect
personal data, personal privacy and the confidentiality of individual records and accounts including
in accordance with its domestic laws and regulations so long as such right shall not be used as a
means of avoiding the Party’s commitments or obligations under this Agreement; (b) prevents a
regulator of a Party for regulatory or prudential reasons from requiring a financial service supplier in
its territory to comply with domestic regulation in relation to data management and storage and
system maintenance, as well as to retain within its territory copies of records; or (c) shall be
construed to require a Party to allow the cross-border supply or the consumption abroad of services
in relation to which it has not made specific commitments, including to allow non-resident suppliers
of financial services to supply, as a principal, through an intermediary or as an intermediary, the
provision and transfer of financial information and financial data processing as referred to in Article
2(a)(xv) (Definitions).”
Data Protection in International Trade Law
493
services. Although it is generally accepted that access to financial data and the
identification of the natural and legal entities in the end of sometimes intricate and
complex chains of assets transfer and ownership is very important for tax and
security efforts, it is also fair to consider that a liberalisation agreement is not
necessarily the best place to set rules on access to private and sensitive information.
That is the rationale of rules in many agreements, as it will be shown below.
It is important to stress that this analysis does not cover the trans-border offer of
financial services of data processing. Although it is clear that these services often
depend on international information flow and treaty provisions in this regard impact
the legal regime of personal data protection, the relatively narrow scope of their
norms and their predominantly technical function suggest that it can be better studied
in connection to financial services.
7.1 Transfer and Processing of Information
The Agreement Establishing the ASEAN-Australia-New Zealand Free Trade Area
(ASEAN-AUT-NZL FTA) (2010) prohibits, in its annex on financial services,
measures that prevent the transfer or processing of information “necessary for the
conduct of the ordinary business of a financial service supplier” (Art. 7 (1) (a) (b)).
Moreover, Art. 7 (2) (a) makes clear that States can protect personal data in
according to domestic law and regulations “so long as such right shall not be used
as means of avoiding the Party’s commitments or obligations under this Agreement”.
21 There are also provisions that secure the power of administrative or
regulatory authorities. The Chile-Thailand FTA (2015) holds very similar rules
21 Agreement Establishing the ASEAN-Australia-New Zealand Free Trade Area, Annex on Financial Services, Article 7: “Transfers of Information and Processing of Information 1. A Party shall
not take measures that: (a) prevent transfers of information, including transfers of data by electronic
means, necessary for the conduct of the ordinary business of a financial service supplier;
115 (b) prevent the processing of information necessary for the conduct of the ordinary business
of a financial service supplier; or (c) prevent transfers of equipment necessary for the conduct of the
ordinary business of a financial service supplier, subject to importation rules consistent with
international agreements. 2. Nothing in Paragraph 1: (a) restricts the right of a Party to protect
personal data, personal privacy and the confidentiality of individual records and accounts including
in accordance with its domestic laws and regulations so long as such right shall not be used as a
means of avoiding the Party’s commitments or obligations under this Agreement; (b) prevents a
regulator of a Party for regulatory or prudential reasons from requiring a financial service supplier in
its territory to comply with domestic regulation in relation to data management and storage and
system maintenance, as well as to retain within its territory copies of records; or (c) shall be
construed to require a Party to allow the cross-border supply or the consumption abroad of services
in relation to which it has not made specific commitments, including to allow non-resident suppliers
of financial services to supply, as a principal, through an intermediary or as an intermediary, the
provision and transfer of financial information and financial data processing as referred to in Article
2(a)(xv) (Definitions).”
Data Protection in International Trade Law
493