order to enhance confidence in electronic commerce, (b) accept the duty to adopt or
maintain a legal framework, (c) accept that the Parties will take into account rules
from international bodies to set their legal frameworks, (d) accept that domestic
practices shall be non-discriminatory, (e) are obliged to publish information on
remedies and legal requirements, (f) recognise different legal approaches,
(f) recognise the advantages of the compatibility between domestic systems,
(h) recognise the need of cooperation to establish compatible legal systems,
(i) recognise that regulatory jurisdiction on transfer of information belong to the
Parties, (j) accept the obligation to allow cross-border transfer of information,
including personal data, (k) keep policy space to the adoption of measures for
legitimate public policy objective, and (l) do not admit the use of policy space to
“arbitrary or unjustifiable discrimination or a disguised restriction to trade” or
disproportional to the purpose of the policy.
The Mexico-Panama FTA (2015) regulates the personal data protection through
the obligation to endeavour the creation and maintenance of legal rules on data
protection observing the “international practice” (“tomarán en consideración las
prácticas internacionales”). It also includes in the chapter on electronic commerce a
provision on the cross-border flow of information that, nevertheless, is somehow
vague, since the obligation to allow the transmission is accompanied by a loose
reference to the “applicable law” that specifies no connecting criterion and a
legal framework that provides for the protection of the personal information of the users of
electronic commerce. In the development of its legal framework for the protection of personal
information, each Party should take into account principles and guidelines of relevant international
bodies. (Ã) 3. Each Party shall endeavour to adopt non-discriminatory practices in protecting users
of electronic commerce from personal information protection violations occurring within its
jurisdiction. 4. Each Party should publish information on the personal information protections it
provides to users of electronic commerce, including how: (a) an individual can pursue remedies;
and (b) business can comply with any legal requirements. 5. Recognising that the Parties may take
different legal approaches to protecting personal information, each Party should encourage the
development of mechanisms to promote compatibility between these different regimes. These
mechanisms may include the recognition of regulatory outcomes, whether accorded autonomously
or by mutual arrangement, or broader international frameworks. To this end, the Parties shall
endeavour to exchange information on any such mechanisms applied in their jurisdictions and
explore ways to extend these or other suitable arrangements to promote compatibility between them
(Ã) [footnote] For greater certainty, a Party may comply with the obligation in this paragraph by
adopting or maintaining measures such as comprehensive privacy, personal information or personal
data protection laws, sector-specific laws covering privacy, or laws that provide for the enforcement
of voluntary undertakings by enterprises relating to privacy.” Article 13: “Cross-Border Transfer of
Information by Electronic Means. 1. The Parties recognise that each Party may have its own
regulatory requirements concerning the transfer of information by electronic means. 2. Each
Party shall allow the cross-border transfer of information by electronic means, including personal
information, when this activity is for the conduct of the business of a covered person. 3. Nothing in
this Article shall prevent a Party from adopting or maintaining measures inconsistent with paragraph 2 to achieve a legitimate public policy objective, provided that the measure: (a) is not applied
in a manner which would constitute a means of arbitrary or unjustifiable discrimination or a
disguised restriction on trade; and (b) does not impose restrictions on transfers of information
greater than are required to achieve the objective.”
Data Protection in International Trade Law
505
maintain a legal framework, (c) accept that the Parties will take into account rules
from international bodies to set their legal frameworks, (d) accept that domestic
practices shall be non-discriminatory, (e) are obliged to publish information on
remedies and legal requirements, (f) recognise different legal approaches,
(f) recognise the advantages of the compatibility between domestic systems,
(h) recognise the need of cooperation to establish compatible legal systems,
(i) recognise that regulatory jurisdiction on transfer of information belong to the
Parties, (j) accept the obligation to allow cross-border transfer of information,
including personal data, (k) keep policy space to the adoption of measures for
legitimate public policy objective, and (l) do not admit the use of policy space to
“arbitrary or unjustifiable discrimination or a disguised restriction to trade” or
disproportional to the purpose of the policy.
The Mexico-Panama FTA (2015) regulates the personal data protection through
the obligation to endeavour the creation and maintenance of legal rules on data
protection observing the “international practice” (“tomarán en consideración las
prácticas internacionales”). It also includes in the chapter on electronic commerce a
provision on the cross-border flow of information that, nevertheless, is somehow
vague, since the obligation to allow the transmission is accompanied by a loose
reference to the “applicable law” that specifies no connecting criterion and a
legal framework that provides for the protection of the personal information of the users of
electronic commerce. In the development of its legal framework for the protection of personal
information, each Party should take into account principles and guidelines of relevant international
bodies. (Ã) 3. Each Party shall endeavour to adopt non-discriminatory practices in protecting users
of electronic commerce from personal information protection violations occurring within its
jurisdiction. 4. Each Party should publish information on the personal information protections it
provides to users of electronic commerce, including how: (a) an individual can pursue remedies;
and (b) business can comply with any legal requirements. 5. Recognising that the Parties may take
different legal approaches to protecting personal information, each Party should encourage the
development of mechanisms to promote compatibility between these different regimes. These
mechanisms may include the recognition of regulatory outcomes, whether accorded autonomously
or by mutual arrangement, or broader international frameworks. To this end, the Parties shall
endeavour to exchange information on any such mechanisms applied in their jurisdictions and
explore ways to extend these or other suitable arrangements to promote compatibility between them
(Ã) [footnote] For greater certainty, a Party may comply with the obligation in this paragraph by
adopting or maintaining measures such as comprehensive privacy, personal information or personal
data protection laws, sector-specific laws covering privacy, or laws that provide for the enforcement
of voluntary undertakings by enterprises relating to privacy.” Article 13: “Cross-Border Transfer of
Information by Electronic Means. 1. The Parties recognise that each Party may have its own
regulatory requirements concerning the transfer of information by electronic means. 2. Each
Party shall allow the cross-border transfer of information by electronic means, including personal
information, when this activity is for the conduct of the business of a covered person. 3. Nothing in
this Article shall prevent a Party from adopting or maintaining measures inconsistent with paragraph 2 to achieve a legitimate public policy objective, provided that the measure: (a) is not applied
in a manner which would constitute a means of arbitrary or unjustifiable discrimination or a
disguised restriction on trade; and (b) does not impose restrictions on transfers of information
greater than are required to achieve the objective.”
Data Protection in International Trade Law
505