Recently, the European Commission endorsed draft horizontal provisions for cross-border data flows and personal data protection in trade agreements – as personal data is a fundamental right, it is not something which can be the subject of negotiation in EU trade deals.
Relatedly, the Article 29 Working Party (A29WP) consultation on the guidelines under Article 49 of the General Data Protection Regulation (GDPR) concerning cross-border data transfer derogations has closed, paving the way for the guidance to be finalised and issued later this year.
Cross-border data flows
Cross-border data flows are key to most organisations, which include moving around employee information, sharing financial details for online transactions, and analysing individuals’ browsing habits to serve them targeted advertisements.
The European Commission is seeking to break down barriers to the flow of data between businesses in future trade deals as part of its push towards a more digital economy, while at the same time safeguarding these key fundamental data protection principles. The preferred approach to facilitate the ongoing trade negotiations and to legitimise cross-border data flows are ‘adequacy decisions’ – which means the European Commission (the Commission) identified the third country (which is outside the European Economic Area) as providing adequate protections to those data protection laws in the EU.The Commission has so far recognised Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and the United States (limited to the Privacy Shield framework) as providing adequate protection. Although it is important to note that these countries are currently under review by the Commission.
The Commission, in its communication paper Exchanging and Protecting Personal Data in a Globalised World, explicitly mentioned that it welcomes expressions of interest from other third countries that are willing to engage on these issues. Key factors affecting an adequacy decision include the rule of law and legal protections for human rights, access to transferred data by public authorities, the existence and effectiveness of function data protection authorities, and international commitments to the protection of personal data.
The draft provisions are designed to be inserted in future trade agreements and ensure the underlying principles of the GDPR are not undermined. The articles will be excluded from any investment court set up by a trade deal to arbitrate and settle disputes – which means the provisions will be subject to the jurisdiction of the EU’s highest court:
The draft provisions prohibit the following:
- the requirement that businesses use specific computing facilities in a country’s territory
- data localisation in a country’s territory for storage or processing
- storage or processing in the territory of the other party to the trade deal
- making cross-border transfers contingent upon the use of computer facilities or network elements in one country’s territory, or upon localisation requirements
GDPR Article 49
On the same topic of cross-border data transfers, the deadline for comments on the guidelines on Article 49 of the GDPR issued by A29WP (WP262) has closed.
Article 49 provides there are certain derogations to the rules requiring transfers of personal data to third countries to be based on an adequacy decision or subject to appropriate safeguards (such as EU Model Clauses and binding corporate rules), including:
- obtaining the individual’s explicit consent
- necessary to perform the contract between individual and controller or a contract which is in the individual’s interest
- necessary for important reasons of public interest or for establishment
- exercise or defence of legal claims
- to protect the vital interests of the individual
- the transfer is made from a public register
The Commission had stated in a letter to a member of the EU Parliament: “These horizontal provisions – once included in future trade and investment agreements – will for the first time provide for a straightforward prohibition of protectionist barriers to cross-border data flows, in full compliance with and without prejudice to the EU’s data protection and data privacy rules.”
The endorsement of draft provisions in trade deals, and the prospect of finalised guidelines on Article 49, is a step towards a greater free flow of data regarding cross-border transfers. Given that the EU has been negotiating a data transfer deal with Japan, we are seeing these developments already being made.