regarding the transfer of data necessary to ordinary business and on confidential
information.
22 The EFTA-Colombia FTA (2011), although by a far simpler text, also
sets a general permission of data transfers “necessary for the conduct of regular
business” and reserves State jurisdiction to protect “personal data, personal privacy
and the confidentiality of individual records and accounts”, insofar as “not used to
circumvent” the provisions on trade in services.
23
The EU-CARIFORUM FTA (2008) also allows expressly the transfer of personal
data for normal business, although it sets a duty to “adopt adequate safeguards to the
protection of privacy and fundamental rights, and freedom of individuals”.
24 The
EU-Central America FTA (2013),
25 the EU-Colombia, Peru and Ecuador FTA
22 CHI-THA FTA, Chapter 10, Articles 10.7 and 10.8.: “Article 10.7: Data Processing in the
Financial Services Sector 1. In sectors where specific commitments are undertaken, each Party
shall permit a financial service supplier of the other Party to transfer information in electronic or
other forms, into and out of its territory, for data processing where such processing is required in the
ordinary course of business of such financial service supplier. 2. Nothing in paragraph 1 shall:
(a) restrict the right of a Party to protect personal data, personal privacy and the confidentiality of
individual records and accounts including in accordance with its domestic laws and regulations so
long as such right shall not be used as a means of avoiding the Party’s commitments or obligations
under this Agreement; (b) prevent a regulator of a Party for regulatory or prudential reasons from
requiring a financial service supplier in its territory to comply with domestic regulation in relation to
data management and storage, and system maintenance, as well as to retain within its territory
copies of records; or (c) be construed to require a Party to allow the cross-border supply or the
consumption abroad of services in relation to which it has not made specific commitments including
to allow non-resident suppliers of financial services to supply, as a principal, through an intermediary or as an intermediary, the provision and transfer of financial information and financial data
processing as referred to in subparagraph (o) of Article 10.1. Article 10.8: Confidential Information
Nothing in this Chapter shall: (a) require any of the Parties to provide confidential information, the
disclosure of which would impede law enforcement, or otherwise be contrary to the public interest,
or which would prejudice legitimate commercial interests of particular juridical persons, whether
public or private; and (b) be construed to require a Party to disclose information relating to the
financial affairs and accounts of individual customers, or any confidential or proprietary information
in the possession of public entities.”
23 EFTA-COL FTA, Annex XV, Article 8: “No Party shall take measures that prevent transfers of
information into or out of the Party’s territory or the processing of financial information, including
transfers of data by electronic means, or that, subject to importation rules consistent with international agreements, prevent transfers of equipment, where such transfers of information, processing
of financial information or transfers of equipment are necessary for the conduct of the ordinary
business of a financial service supplier of another Party. Nothing in this Article restricts the right of
a Party to protect personal data, personal privacy and the confidentiality of individual records and
accounts so long as such right is not used to circumvent the provisions of Chapter 4.”
24 EU-CARIFORUM FTA, Article 107: “Data processing. 1. The EC Party and the Signatory
CARIFORUM States shall permit a financial service supplier of the other Party to transfer
information in electronic or other form, into and out of their territory, for data processing where
such processing is required in the ordinary course of business of such financial service supplier.
2. The EC Party and the Signatory CARIFORUM States shall adopt adequate safeguards to the
protection of privacy and fundamental rights, and freedom of individuals, in particular with regard
to the transfer of personal data.”
25 EU-Central America FTA, Article 198: “1. Each Party shall permit a financial service supplier of
the other Party to transfer information in electronic or other form, into and out of its territory, for
494
J. A. F. Costa
information.
22 The EFTA-Colombia FTA (2011), although by a far simpler text, also
sets a general permission of data transfers “necessary for the conduct of regular
business” and reserves State jurisdiction to protect “personal data, personal privacy
and the confidentiality of individual records and accounts”, insofar as “not used to
circumvent” the provisions on trade in services.
23
The EU-CARIFORUM FTA (2008) also allows expressly the transfer of personal
data for normal business, although it sets a duty to “adopt adequate safeguards to the
protection of privacy and fundamental rights, and freedom of individuals”.
24 The
EU-Central America FTA (2013),
25 the EU-Colombia, Peru and Ecuador FTA
22 CHI-THA FTA, Chapter 10, Articles 10.7 and 10.8.: “Article 10.7: Data Processing in the
Financial Services Sector 1. In sectors where specific commitments are undertaken, each Party
shall permit a financial service supplier of the other Party to transfer information in electronic or
other forms, into and out of its territory, for data processing where such processing is required in the
ordinary course of business of such financial service supplier. 2. Nothing in paragraph 1 shall:
(a) restrict the right of a Party to protect personal data, personal privacy and the confidentiality of
individual records and accounts including in accordance with its domestic laws and regulations so
long as such right shall not be used as a means of avoiding the Party’s commitments or obligations
under this Agreement; (b) prevent a regulator of a Party for regulatory or prudential reasons from
requiring a financial service supplier in its territory to comply with domestic regulation in relation to
data management and storage, and system maintenance, as well as to retain within its territory
copies of records; or (c) be construed to require a Party to allow the cross-border supply or the
consumption abroad of services in relation to which it has not made specific commitments including
to allow non-resident suppliers of financial services to supply, as a principal, through an intermediary or as an intermediary, the provision and transfer of financial information and financial data
processing as referred to in subparagraph (o) of Article 10.1. Article 10.8: Confidential Information
Nothing in this Chapter shall: (a) require any of the Parties to provide confidential information, the
disclosure of which would impede law enforcement, or otherwise be contrary to the public interest,
or which would prejudice legitimate commercial interests of particular juridical persons, whether
public or private; and (b) be construed to require a Party to disclose information relating to the
financial affairs and accounts of individual customers, or any confidential or proprietary information
in the possession of public entities.”
23 EFTA-COL FTA, Annex XV, Article 8: “No Party shall take measures that prevent transfers of
information into or out of the Party’s territory or the processing of financial information, including
transfers of data by electronic means, or that, subject to importation rules consistent with international agreements, prevent transfers of equipment, where such transfers of information, processing
of financial information or transfers of equipment are necessary for the conduct of the ordinary
business of a financial service supplier of another Party. Nothing in this Article restricts the right of
a Party to protect personal data, personal privacy and the confidentiality of individual records and
accounts so long as such right is not used to circumvent the provisions of Chapter 4.”
24 EU-CARIFORUM FTA, Article 107: “Data processing. 1. The EC Party and the Signatory
CARIFORUM States shall permit a financial service supplier of the other Party to transfer
information in electronic or other form, into and out of their territory, for data processing where
such processing is required in the ordinary course of business of such financial service supplier.
2. The EC Party and the Signatory CARIFORUM States shall adopt adequate safeguards to the
protection of privacy and fundamental rights, and freedom of individuals, in particular with regard
to the transfer of personal data.”
25 EU-Central America FTA, Article 198: “1. Each Party shall permit a financial service supplier of
the other Party to transfer information in electronic or other form, into and out of its territory, for
494
J. A. F. Costa