Governing Cross-Border Data Flows: International Trade Agreements and Their Limits

Abstract

In modern international competition and cooperation, digital trade rules centered on the cross-border flow of data have become a competitive advantage for countries. Under the guidance of commercial freedom, the United States chooses to actively promote the free flow of data across borders. The European Union has placed the protection of personal data rights before the cross-border flow of data through the General Data Protection Regulation (GDPR), and developing countries generally reserve space for industry policy interpretation. As one of the world’s largest economies, facing the needs of domestic industrial development and the pressure of international systems, China’s cross-border data flows’ policy is to ensure data flows under the premise of security, protection of personal information, seek international coordination of rules, and the freedom of transmission. The key question, therefore, is how to facilitate interoperability or find a middle ground among the divergent approaches in order to avoid the fragmentation of the digital trade system. The article suggests that a thin and narrowly scoped WTO agreement on e-commerce rules on cross-border data flows with sufficient policy space to accommodate different needs, policy preferences and proprieties, and local contexts via legitimate exception provisions would be a welcome movement.

PDPHE: Personal Data Protection for Trans-Border Transmission Based on Homomorphic Encryption

“…In the case of PDPHE, within our tested range [2,11], the results were 100% successful in completing the encryption and decryption process without errors. However, in the case of homomorphic multiplication, within our tested range, when η ∈ [3,8], the model is unstable.…”

“…However, differences in legal frameworks are just one part of the many challenges, leading to the crucial issue of data security risks. Greenleaf (2016) [10] shifted the focus to data security, providing an overview of global data privacy laws, particularly in the context of security challenges during cross-border data transfers [11]. This study, starting from a legal perspective, explores the necessity of data protection but offers less discussion on technological implementation, naturally leading to issues of data sovereignty and jurisdiction.…”

“…Subsequently, Cate and Mayer-Schönberger (2016) [16] expanded the discussion to the impact of cultural and linguistic differences on data processing. This study, from a sociocultural perspective, explores the challenges in data interpretation and usage, supplementing the technological and legal viewpoints [11]. Finally, Cattaruzza [17] extended the perspective to the geopolitics of data, exploring how international relations and economic policies influence data flows.…”

Global governance and regulation of cybersecurity: Towards coherence or fragmentation?

“…According to Chin et al, the United States uses the Asia-Pacific Cooperation Cross-Border Privacy Rules to broaden the range of data flows. 741 The instrument follows the principle of accountability where the data controller remains accountable for the data regardless of where the data goes (organisation approach). 742 Therefore, the flow of information should be limited to economies that have legislative or regulatory instruments that give effect to the Framework and sufficient safeguards and appropriate measures exist, such as APEC Cross Border Privacy Rules (CBPR).…”

“…1097 For this organisation, data security not only includes the protection of availability, confidentiality and integrity of data, but also includes national security and sovereignty. 1098 On the other side of the spectrum, organisations such as the United Nations, the European Union or OECD see the flow of information as a value and a tool to "promote economic, social development and democratic governance." 1099 There is common understanding between these instruments that it is possible to restrict the flow of data in specific situations.…”