DIGITALEUROPE Comments on European Commission’s Draft Provisions for Cross-border Data Flows

DIGITALEUROPE fully agrees that the protection of personal information is of utmost importance to create trust in the digital environment: FTAs should not be used to challenge or circumvent EU privacy rules. Neither the WTO rules nor any modern FTA (including the recently agreed Trans-Pacific Partnership Agreement) pose a challenge to the EU rules. In fact, these existing provisions do recognize protection of privacy as a legitimate purpose for measures, and the European regime has never been subject to challenges e.g. from the GATS. What most recent agreements have tried to do instead is to design broad commitments and narrow exceptions which create a balanced, workable and enforceable mechanism for cross-border data flows.

1.2. Equipping the EU against raising protectionism

For the EU, the reason why such provisions are vital in going forward is the need to provide a means for EU- based businesses and governments to address protectionist measures and forced localization requirements in third countries. Evidence shows how this type of measures have negative impact on GDP, jobs and innovation.1

Restrictive measures, e.g. unjustifiable limitations to cross-border data flows, and forced localization measures in third countries, present significant barriers for European-based companies to expand their IT services in the EU, e.g. distributed cloud services for Industrial Internet, Industry 4.0 or cloud facilities. They illustrate barriers across all industry sectors – not only the digital sector – which risk not to benefit from digitization and the data economy. Unrestricted cross-border data flows in FTAs is thus as much about enabling the flows of personal data and mixed data sets into the EU.2 This would likely lead to increased market-driven inbound data flows to the EU particularly pertinent for Industry 4.0. This type of offensive provision does not exist under the EU acquis while the recent European Commission proposal fails to address the risks identified above. Limitations to unrestricted cross-border data flows expressed in Article B.2 are expressed in an arbitrary and unrestricted manner. The proposal does not provide for any provisions to secure non-personal cross-border data transfers either.

2. An effective toolbox

2.1. Why current existing solutions are not enough

While reciprocal adequacy decisions are welcomed, they do not provide investors with sufficient investment confidence for EU-based data processing beyond the scale of the European market, since adequacy decisions can be unilaterally revoked and cannot address a broader set of digital market access barriers in third countries. Thus, adequacy decisions are complementary to, but never substitutes of, FTA disciplines on data flows.

We are also deeply concerned with the formulation in the EU-Japan revision clause, Article 8.81, (“The Parties shall reassess within three years of the date of entry into force of this Agreement the need for inclusion of provisions on the free flow of data into this Agreement.”)3 as this formulation implies that the very essential need for digitisation of European and Japanese economies and the associated data flows are questioned by this formulation, not only at the point in time of the conclusion of the text but also 3 years later on. Unfortunately, the very recent political agreement on the EU-Mexico FTA includes the same review clause.