Beyond the general WTO rules, a set of 75 agreements was used in the search for
provisions on personal data protection, notably those contained in their general
chapters, or in provisions on financial services and electronic commerce. The results
points to an unfinished picture.
As a matter of fact, general chapters are odd and concentrated on agreements with
European countries. Consequently, their purpose is not very clear beyond the
foreseeable enlargement of European legal and economic influence zone to eastern
countries. Nevertheless, some general provisions on the issue, as well as the fact that
it is addressed in chapters on investment, free movement of persons and cross-border
services, suggest that a possible development of increasingly complex agreements
could be to isolate these provisions in general chapters on exceptions and on
fundamental rights and duties.
The rules on financial services point at some stability, since the provisions on the
transfer and processing of information, as well as on the protection of certain
information, are very repetitive. However, there is a handful of innovations that
could have some impact on the design of similar dispositions in general or regarding
other cross-border services.
The treatment of electronic commerce is far richer. The many dimensions and
differences of treatments both regionally and chronologically suggest the need for
further debate in multilateral fora. United Nations commissions and conferences,
such as UNCITRAL and UNCTAD, could be good places to debate the issue, as well
as WTO and OECD.
Regarding the formal aspect of legal protection of personal data, there are two
possible radical approaches: the complete prevalence of domestic jurisdiction or the
predominance of international standards. The actual solutions are in the middle. The
agreements generally secure the application of reasonable and proportional domestic
regulation and measures on data protection, although they do not admit it as a means
to unduly discriminate or close markets. In other words, there is no agreement that
regards the domestic jurisdiction on data protection, as well as on any other right, as
absolute and unchallengeable. There are limits set by the treaties in two ways:
(a) open principles and standards set by the own treaty or (b) reference to external
standards, namely international (UNCITRAL, OCDE etc.) or European (Council of
Europe, EU).
This formal approach is also reflected in the possible paths of substantive rules.
As a matter of fact, due to many reasons not under discussion in this report,
European regulation is quite complete and complex and, due to the intricate processes of decision making, difficult to change. Therefore, Europeans are concerned
with the maintenance and the dissemination of their own standards. The United
States have no such complex set of rules and resist laying it down, though the
adoption of the EU-US Privacy Shield in 2016 and, formerly, the safe harbour
principles, show the wilfulness to agree upon a common basis with the EU.
The analysis of international trade agreements evidences the advantages and a
possible need for common efforts of harmonisation and unification of legal standards
on personal data protection. It also clarifies that economic agreements may encourage
the adoption of domestic legislation and administrative measures that prevent a race to
the bottom and help disseminating higher standards of personal rights protection.
Data Protection in International Trade Law
517
provisions on personal data protection, notably those contained in their general
chapters, or in provisions on financial services and electronic commerce. The results
points to an unfinished picture.
As a matter of fact, general chapters are odd and concentrated on agreements with
European countries. Consequently, their purpose is not very clear beyond the
foreseeable enlargement of European legal and economic influence zone to eastern
countries. Nevertheless, some general provisions on the issue, as well as the fact that
it is addressed in chapters on investment, free movement of persons and cross-border
services, suggest that a possible development of increasingly complex agreements
could be to isolate these provisions in general chapters on exceptions and on
fundamental rights and duties.
The rules on financial services point at some stability, since the provisions on the
transfer and processing of information, as well as on the protection of certain
information, are very repetitive. However, there is a handful of innovations that
could have some impact on the design of similar dispositions in general or regarding
other cross-border services.
The treatment of electronic commerce is far richer. The many dimensions and
differences of treatments both regionally and chronologically suggest the need for
further debate in multilateral fora. United Nations commissions and conferences,
such as UNCITRAL and UNCTAD, could be good places to debate the issue, as well
as WTO and OECD.
Regarding the formal aspect of legal protection of personal data, there are two
possible radical approaches: the complete prevalence of domestic jurisdiction or the
predominance of international standards. The actual solutions are in the middle. The
agreements generally secure the application of reasonable and proportional domestic
regulation and measures on data protection, although they do not admit it as a means
to unduly discriminate or close markets. In other words, there is no agreement that
regards the domestic jurisdiction on data protection, as well as on any other right, as
absolute and unchallengeable. There are limits set by the treaties in two ways:
(a) open principles and standards set by the own treaty or (b) reference to external
standards, namely international (UNCITRAL, OCDE etc.) or European (Council of
Europe, EU).
This formal approach is also reflected in the possible paths of substantive rules.
As a matter of fact, due to many reasons not under discussion in this report,
European regulation is quite complete and complex and, due to the intricate processes of decision making, difficult to change. Therefore, Europeans are concerned
with the maintenance and the dissemination of their own standards. The United
States have no such complex set of rules and resist laying it down, though the
adoption of the EU-US Privacy Shield in 2016 and, formerly, the safe harbour
principles, show the wilfulness to agree upon a common basis with the EU.
The analysis of international trade agreements evidences the advantages and a
possible need for common efforts of harmonisation and unification of legal standards
on personal data protection. It also clarifies that economic agreements may encourage
the adoption of domestic legislation and administrative measures that prevent a race to
the bottom and help disseminating higher standards of personal rights protection.
Data Protection in International Trade Law
517