The Korea-United States FTA (2012)
43 and the Peru-Korea FTA (2011)
44 secure
the normal transfer of information “required in the institution’s ordinary course of
business” with no specific exception concerning data protection or privacy measures.
The EU-Canada Comprehensive Economic and Trade Agreement (CETA)
(2017) also generally allows the trans-boundary data transfer “required in the
ordinary course of business”. Nevertheless, it is stricter in terms of protection of
personal data and privacy, since it sets a duty upon Parties to “maintain adequate
safeguards to protect privacy” and defines as applicable the law of the territory of
origin of data. The question, in this instance, does not concern the risk of undue use
of data protection measures to circumvent the treaty effects. The provision is
concerned to the establishment of a positive duty to lay down adequate regulation
and a conflict of laws provisions on basis of the place of origin of information.
45
Similar solutions are given in the Mexico-Panama FTA (2015)
46 and the Pacific
Alliance (2016),
47 although they adds the requirement of a previous permission from
the regulating authority.
43 KOR-USA FTA (2012), Section B—Transfer of information: “Each Party shall allow a financial
institution of the other Party to transfer information in electronic or other form, into and out of its
territory, for data processing where such processing is required in the institution’s ordinary course
of business. Korea shall give effect to this commitment no later than two years after the date this
Agreement enters into force.”
44 PER-KOR FTA (2011) Annex 12C, Section A: “Transfer of information. Each Party shall allow a
financial institution of the other Party to transfer information in electronic or other form, into and out
of its territory, for data processing where such processing is required in the institution’s ordinary
course of business 1. Korea shall give effect to this commitment no later than two years after the
date of entry into force of this Agreement.”
45 EU-CAN CETA, Chapter 13, Article 13.15: “1. Each Party shall permit a financial institution or a
cross-border financial service supplier of the other Party to transfer information in electronic or
other form, into and out of its territory, for data processing if processing is required in the ordinary
course of business of the financial institution or the cross-border financial service supplier. 2. Each
Party shall maintain adequate safeguards to protect privacy, in particular with regard tithe transfer of
personal information. If the transfer of financial information involves personal information, such
transfers shall be in accordance with the legislation governing the protection of personal information of the territory of the Party where the transfer has originated.”
46 MEX-PAN FTA, Chapter 11, Article 11.8: “Data processing. 1. Under previous authorization of
the regulator or authority in charge, whenever required, each Party shall permit a financial
institution from the other Party to transfer information into or out of the Party’s territory, by any
means authorised therein, to its processing, whenever necessary to perform the ordinary course of
business of these institutions. 2. To greater clarity, whenever the information referred to in
paragraph 1 is composed of or includes personal data or confidential information, the transfer of
such information is performed in conformity to the domestic law on protection of persons regarding
the transfer and processing of personal data from the Party in which or from which territory the
information is transferred.” (My translation.)
47 Pacific Alliance, Article 11.7: “Data processing. 1. Under previous authorization of the regulator
or authority in charge, whenever required, each Party shall permit a financial institution from the
other Party to transfer information into or out of the Party’s territory, by any means authorised
therein, to its processing, whenever necessary to perform the ordinary course of business of these
institutions. 2. To greater clarity, whenever the information referred to in paragraph 1 is composed
of or includes personal data or confidential information, the transfer of such information is
Data Protection in International Trade Law
499
43 and the Peru-Korea FTA (2011)
44 secure
the normal transfer of information “required in the institution’s ordinary course of
business” with no specific exception concerning data protection or privacy measures.
The EU-Canada Comprehensive Economic and Trade Agreement (CETA)
(2017) also generally allows the trans-boundary data transfer “required in the
ordinary course of business”. Nevertheless, it is stricter in terms of protection of
personal data and privacy, since it sets a duty upon Parties to “maintain adequate
safeguards to protect privacy” and defines as applicable the law of the territory of
origin of data. The question, in this instance, does not concern the risk of undue use
of data protection measures to circumvent the treaty effects. The provision is
concerned to the establishment of a positive duty to lay down adequate regulation
and a conflict of laws provisions on basis of the place of origin of information.
45
Similar solutions are given in the Mexico-Panama FTA (2015)
46 and the Pacific
Alliance (2016),
47 although they adds the requirement of a previous permission from
the regulating authority.
43 KOR-USA FTA (2012), Section B—Transfer of information: “Each Party shall allow a financial
institution of the other Party to transfer information in electronic or other form, into and out of its
territory, for data processing where such processing is required in the institution’s ordinary course
of business. Korea shall give effect to this commitment no later than two years after the date this
Agreement enters into force.”
44 PER-KOR FTA (2011) Annex 12C, Section A: “Transfer of information. Each Party shall allow a
financial institution of the other Party to transfer information in electronic or other form, into and out
of its territory, for data processing where such processing is required in the institution’s ordinary
course of business 1. Korea shall give effect to this commitment no later than two years after the
date of entry into force of this Agreement.”
45 EU-CAN CETA, Chapter 13, Article 13.15: “1. Each Party shall permit a financial institution or a
cross-border financial service supplier of the other Party to transfer information in electronic or
other form, into and out of its territory, for data processing if processing is required in the ordinary
course of business of the financial institution or the cross-border financial service supplier. 2. Each
Party shall maintain adequate safeguards to protect privacy, in particular with regard tithe transfer of
personal information. If the transfer of financial information involves personal information, such
transfers shall be in accordance with the legislation governing the protection of personal information of the territory of the Party where the transfer has originated.”
46 MEX-PAN FTA, Chapter 11, Article 11.8: “Data processing. 1. Under previous authorization of
the regulator or authority in charge, whenever required, each Party shall permit a financial
institution from the other Party to transfer information into or out of the Party’s territory, by any
means authorised therein, to its processing, whenever necessary to perform the ordinary course of
business of these institutions. 2. To greater clarity, whenever the information referred to in
paragraph 1 is composed of or includes personal data or confidential information, the transfer of
such information is performed in conformity to the domestic law on protection of persons regarding
the transfer and processing of personal data from the Party in which or from which territory the
information is transferred.” (My translation.)
47 Pacific Alliance, Article 11.7: “Data processing. 1. Under previous authorization of the regulator
or authority in charge, whenever required, each Party shall permit a financial institution from the
other Party to transfer information into or out of the Party’s territory, by any means authorised
therein, to its processing, whenever necessary to perform the ordinary course of business of these
institutions. 2. To greater clarity, whenever the information referred to in paragraph 1 is composed
of or includes personal data or confidential information, the transfer of such information is
Data Protection in International Trade Law
499