European Commission compromises on cross-border data protection

On 31 January, the European Commission agreed on new plans for cross-border data flows and personal data protection in trade negotiations. Cross-border data flows are a difficult issue. Companies want them. The EU wants to open foreign markets for its strong services industry. But data protection is a fundamental right in the EU; it has to be protected also in cross-border data flows.

The commission’s proposal is a compromise. (leak) The commission’s safeguard is strong, about as strong as one can get in a trade agreement. 1 But as the trade community doesn’t care much for human rights, you can never be certain.

EU trade agreements already contain implicit and explicit data flow commitments, with weak safeguards. The commission’s proposal would be an improvement. Should we accept a compromise that normally speaking should be enough?

Sub-adequate protection

The commission notes that the new plans are meant for countries which do not have an adequate protection of personal data:

“The Commission has looked into how best to advance the EU’s interests in this area – especially in cases where an ‘adequacy decision’ (recognising an equivalent level of data protection of a third country) cannot be realistically reached in parallel to ongoing trade negotiations.”

Reuters gives an example: Russia. I understand that companies want to sell services in Russia. But Reuters skips the other part: our personal data would flow to Russia. We can expect that the Russian government will receive the personal data as well. In the US a criminal investigation takes place regarding Russian interference in elections. Would flows of personal data to Russia give Russia more leverage over us? An other often mentioned example is Turkey.

It seems fair to assume that things will go wrong, and that data protection will limp behind.

No exclusion for development

A main point in the commission’s proposal is banning localisation. Companies do not want to be forced to put servers in the countries they trade with. As Reuters formulates it, the technology industry warns that forcing companies to store data on local servers only serves to balkanise the internet.

Of course, I wouldn’t like to balkanise the internet. But I also don’t think this is the whole story.

A ban on localisation may prevent developing countries from building up their own digital companies. A ban could “kick away the ladder”. Companies from rich countries would not only extract oil and gold from poor countries, but also data, and add value and pay taxes elsewhere (in so far taxes are paid at all).

I’m not an expert on development, but adding an exception for development may make sense. As exploited countries may hardly be able to protect democracy and fundamental rights, this is also a democracy and fundamental rights issue.


Our democracies are under pressure, both from multinationals gaining leverage over our societies, as from growing support for populist authoritarian politicians.

Once the EU has ratified multiple agreements with the proposed cross-border data flow provisions, companies can choose from which country they offer services. Multinationals can already choose in which countries they produce, pay taxes, and from which country they sue governments. They can optimise avoiding regulation and taxes, and optimise impact on policy making. The commission’s plans strengthen these developments, as they will allow companies to choose the country in which they process and store data as well.

Furthermore, much of our data ends up in the hands of a few companies. Massive data sets make it possible to de-anonymise data. The commission’s proposal makes it possible to move and bring together data sets.

Regarding populist authoritarian parties, Ronald Inglehart and Pippa Norris argue that cultural backlash explains why given individuals support populist authoritarian movements, and that declining existential security explains why support for these movements is greater now than it was thirty years ago.

A knowledge society has a winner takes all economy. This aspect of the knowledge society, through declining existential security, may help the rise of authoritarian regimes. Cross-border data flows could strengthen the winner takes all aspect of knowledge societies.

A trade regime doesn’t put democracy and fundamental rights first. As democracy and fundamental rights are under pressure, we should take a hard look at our priorities.


The European Consumer Organisation (BEUC), European Digital Rights (EDRi), and the Transatlantic Consumer Dialogue (TACD) welcome the European Commission’s political decision. In a letter to the European Commission they have asked for clarification regarding the publication of the text and its application in trade agreements.

See also: Digital Trade: Is Data Treaty-Ready? Dan Ciuriak (CIGI) argues that data is not treaty-ready and draws the conclusion that Canada, which has much at stake in claiming a role in the data-driven economy, should be cautious about entering into international commitments, the implications of which are as yet unclear.

Arguably, this conclusion is all the more true for developing countries.



Some improvements are needed. For instance, the exclusion of the Investment Court System does not extend to the other implicit and explicit data flow commitments in trade agreements. It also doesn’t include the Multilateral Investment Court plans or EU member states’ ISDS treaties.