7 - Digital Trade

Summary

The chapter offers an insight into the highly fluid field of digital trade rulemaking as a direct reaction to digital transformations. Against the backdrop of the evolution of the trade policy discourse beyond online trade in goods and services and the emergence of new digital protectionism, the chapter explores the dynamics of digital trade regulation in the past decade in a complex geopolitical setting by looking at some broader trends, as well as distinct regulatory models (exemplified by the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), the United States–Mexico–Canada Agreement (USMCA), the European Union–United Kingdom Trade and Cooperation Agreement (TCA), and the Regional Comprehensive Economic Partnership (RCEP)) and the new templates of the digital economy agreements (DEAs) that also signal room for regulatory innovation in trade law. The chapter’s enquiry seeks to identify new design elements found in preferential trade agreements (PTAs), to trace how these have diffused over time, and to ask what their implications for domestic regulatory space may be. Finally and linking to the multilateral discussions on electronic commerce, the chapter tests to what extent PTAs have worked as regulatory laboratories and whether some of the newly emerged digital trade rules can be multilateralised.

7.1 Introduction

‘Digital trade’¹ can be said to be a relatively well-established topic in international economic rulemaking, if one considers that soon after the completion of the Uruguay Round, the Information Technology Agreement (ITA) (WTO 1996)² as a plurilateral arrangement aiming at zero tariffs for information technology (IT) products was adopted in 1996 and two years later the membership of the World Trade Organization (WTO) launched the Work Programme on Electronic Commerce (WTO 1998). The latter initiative sought to address the implications of the Internet that could potentially lead to adjustments in the existing rules for trade in goods, trade in services, and intellectual property (IP) rights protection. Interestingly, for those wishing to understand the broader context of emerging Internet governance, this was also the time when John Perry Barlow penned his declaration on the independence of cyberspace, claiming, in essence, that neither states nor companies will be able to control this new space of freedom (Barlow 1996). Since then, the perception that states should and can regulate online activities became a reality, and a flurry of regulations were adopted around the world that targeted commercial transactions, personal data protection, online gambling, and other types of illegal activity online.³ The WTO Work Programme on Electronic Commerce could not keep up with these developments and stalled for a variety of reasons, ultimately rendering WTO law dated in many aspects (Wunsch-Vincent and Hold 2012).

In the meantime, digital trade as practice and as a subject of regulation did substantially transform. On the one hand, this has been spurred by the progressively advancing digitisation of economies and societies as a whole with a number of palpable new trends in trade, such as the emergence of global value chains (GVCs) and increased servicification (Burri 2019; WTO 2019c), as well as by the more recently emerged critical importance of data (Manyika et al. 2011; Mayer-Schönberger and Cukier 2013; Henke et al. 2016; WTO 2018). On the other hand, the surge in digital trade rulemaking, which in this chapter covers both hard and soft rules creation (Abbott and Snidal 2000: 421–456; Shaffer and Pollack 2010), can be linked to the multiple new issues that the data-driven economy has raised. Some of them, such as those in the area of personal data protection, demand urgent regulatory responses (Burri 2021a; Chander and Schwartz 2023).

The chapter is set against this background and seeks to provide a better understanding and contextualisation of the highly dynamic field of digital trade rulemaking driven by preferential trade agreements (PTAs). The new rules found in bilateral and regional PTAs not only compensate for the lack of developments in the multilateral forum of the WTO (at least so far)⁴ but effectively create a comprehensive, albeit fragmented, governance framework for the data-driven economy. The chapter’s analytical lens is directed in particular towards the more recent and advanced models of digital trade rulemaking, such as those under the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) and the United States (US)–Mexico–Canada Agreement (USMCA), as well as those endorsed by dedicated digital economy agreements (DEAs). The chapter then covers the European Union’s (EU) new generation of trade deals, particularly the post-Brexit Agreement with the United Kingdom (UK), the agreement with New Zealand, and the currently negotiated deals with Australia and Tunisia. It looks at the Regional Comprehensive Economic Partnership (RCEP), as the first agreement with digital trade provisions that includes China, to give a sense of the dynamic governance environment on digital trade issues.

With the help of these enquiries, it is the chapter’s objective to identify new design elements found in PTAs and to trace how these have diffused, especially in recent years, and to what extent one can observe convergence or divergence across regulatory templates and issues in the digital trade domain.

7.2 The PTA Landscape of Digital Trade Rulemaking

7.2.1 Overview

As earlier noted, since the WTO law did not undergo any adaptation in the past two decades, the regulatory environment for digital trade has been shaped exclusively by developments in PTAs. Out of the 432 PTAs entered into between 2000 and 2023, 214 contain provisions relevant to digital trade and 122 have dedicated electronic commerce chapters.⁵ While it is true that the pertinent rules are very heterogeneous and differ as to issues covered, the scope and level of commitments, and their binding nature, it is apparent that the trend towards more detailed provisions on digital trade has intensified significantly over the years.⁶ This regulatory push in the digital trade domain can be explained by the increased importance of the issue over the years, as noted earlier, and the role played by the US as a legal entrepreneur (Elsig and Klotz 2021).

The US has, over the years, endorsed its ‘Digital Agenda’ (US Congress 2001; Wunsch-Vincent 2003; Gao 2018) through the PTA channel. The agreements reached since 2002 with Australia, Bahrain, Chile, Morocco, Oman, Peru, Singapore, the Central American countries,⁷ Panama, Colombia, and South Korea all contain important, albeit with different depths of commitment, provisions in the broader field of digital trade. However, it should be highlighted that the US is not a sole actor any longer, as the dynamic of digital trade rulemaking has changed over time. On the one hand, it is noteworthy that the US template is not limited to US agreements (Elsig and Klotz 2021) and has been replicated in a number of other PTAs as well, such as Singapore–Australia, Thailand–Australia, New Zealand–Singapore, Japan–Singapore, and South Korea–Singapore. On the other hand, it ought to be pointed out that smaller countries, in particular Singapore and New Zealand, have become the most innovative and bold rule-makers in the area of digital trade (Burri, Vasquez Callo-Müller and Kugler 2024). Although reckoned as a major actor in international economic law and policy, the EU has been, in comparison, a latecomer into the digital trade rulemaking domain, as the chapter reveals below.

The relevant aspects of digital trade governance can be found in: (1) the specifically dedicated electronic commerce PTA chapters; (2) the chapters on cross-border supply of services (with particular relevance of the telecommunications, computer and related, audiovisual, and financial service sectors); and (3) the IP chapters.⁸ This chapter focuses exclusively on the electronic commerce/digital trade chapters, as well as on the specific DEAs, which have become the critical source of new rulemaking in the area of digital trade and are also indicative of the novel legal design.

The electronic commerce/digital trade chapters play a dual role in terms of rule creation. For one, they represent an attempt to compensate for the lack of progress in the WTO and address many of the questions of the WTO Work Programme on Electronic Commerce that have been discussed but not resolved (Wunsch-Vincent 2006). For instance, a majority of the chapters recognise the applicability of WTO rules to electronic commerce (e.g. US–Singapore FTA, Article 14.1; US–Australia FTA, Article 16.1) and establish an express and permanent duty-free moratorium on electronic transmissions (e.g. US–Singapore FTA, Article 14.3, paragraph 1; US–Chile FTA, Article 15.3).⁹ In most of the templates tailored along the US model, the chapters also include a definition of ‘digital products’, which treats products delivered offline as equally as those delivered online (e.g. US–Singapore FTA, Article 14.3; US–Australia FTA, Article 16.4), so that technological neutrality is ensured and some of the classification dilemmas under the General Agreement on Trade in Services (GATS) are cast aside (in particular when combined with negative committing for services).¹⁰ In this context, one can observe some new design elements that essentially connect the multilateral discussions on e-commerce with actual rulemaking in the preferential forums. The level of legal certainty is increased for PTA partners even on some ‘older’ issues, such as the moratorium on customs duties on electronic transmissions, normally extended at the WTO Ministerial Conferences (MC), but the acceptance of which may be waning among WTO Members.¹¹

The electronic commerce/digital trade chapters also include novel regulatory questions that have not been treated in the WTO context – the so-called ‘WTO-extra’ issues that have become increasingly important in the data-driven economy. One can group these rules into two categories: (1) rules that seek to facilitate digital trade, by tackling distinct issues, such as paperless trading, electronic contracts, and electronic authentication, as well as by increasing business and consumer trust; and (2) rules that address data governance, in particular cross-border data flows, and new data economy issues that can be of various natures. It should be noted that as to the first cluster of issues on the facilitation of digital trade, the number of PTAs containing such rules is often substantial,¹² and one can observe some convergence regarding treaty language. Only a few agreements still include rules on data, and the data flow conditionalities may differ substantially.¹³

7.2.2 Emerging Templates for Digital Trade and Stakeholders’ Positioning

In the following sections, the chapter looks at the new rules created in recent agreements through a detailed analysis of the most advanced electronic commerce/digital trade chapters thus far – those of the CPTPP, the USMCA, and the dedicated DEAs. We complement this analysis with an enquiry into the EU treaties, the EU’s repositioning on data flows in particular, and into the RCEP as the first agreement with digital trade provisions to include China. The purpose is twofold: on the one hand, to highlight legal innovation in these treaties and, on the other, to give a sense of the positions of the major stakeholders.

7.2.2.1 The CPTPP

The Comprehensive and Progressive Agreement for Trans-Pacific Partnership was agreed upon in 2017 between eleven countries in the Pacific Rim¹⁴ and entered into force on 30 December 2018. Beyond the economic significance of the agreement (Torrey 2018) and the new approach of a ‘mega-regional’ PTA (Kingsbury et al. 2019a, 2019b), the CPTPP chapter on electronic commerce created at that time the most comprehensive template in the landscape of PTAs. Despite the US having dropped out from the Trans-Pacific Partnership Agreement (TPP) with the start of the Trump Administration, the CPTPP chapter reflects the US efforts under its updated ‘Digital 2 Dozen’ agenda¹⁵ to secure obligations on digital trade¹⁶ and is a verbatim reiteration of the TPP chapter. A closer look at the CPTPP electronic commerce chapter is, therefore, well-deserved.

In the first part, and not unusually for US-led and other PTAs, the CPTPP electronic commerce chapter clarifies that it applies ‘to measures adopted or maintained by a party that affect trade by electronic means’ (Article 14.2(2) CPTPP). But it excludes from this broad scope (1) government procurement and (2) information held or processed by or on behalf of a party, or measures related to such information, including measures related to its collection (Article 14.2(3) CPTPP).¹⁷ The following provisions address, again as customarily, some of the leftovers of the WTO Work Programme on Electronic Commerce and provide for the facilitation of online commerce. In this sense, Article 14.3 CPTPP bans the imposition of customs duties on electronic transmissions, including content transmitted electronically, and Article 14.4 endorses the non-discriminatory treatment of digital products,¹⁸ which are defined broadly pursuant to Article 14.1 CPTPP.

With regard to digital trade facilitation, a number of provisions should be mentioned: Article 14.5 CPTPP is meant to shape the domestic electronic transactions framework by including binding obligations for the parties to follow the principles of the UNCITRAL Model Law on Electronic Commerce 1996 or the UN Convention on the Use of Electronic Communications in International Contracts. Parties must endeavour to (1) avoid any unnecessary regulatory burden on electronic transactions and (2) facilitate input by interested persons in the development of its legal framework for electronic transactions (Article 14.5(2) CPTPP). The provisions on paperless trading (Article 14.9 CPTPP) and electronic authentication and electronic signatures (Article 14.6 CPTPP) complement this by securing the equivalence of electronic and physical forms.

The remainder of the provisions found in the CPTPP electronic commerce chapter can be said to belong to the second and more innovative category of rulemaking that tackles the emergent issues of the data-driven economy. Most importantly, in this context, the CPTPP seeks to curb data protectionism. First, it does so through an explicit ban on the use of data localisation measures. Article 14.13(2) prohibits the parties from requiring a ‘covered person to use or locate computing facilities in that party’s territory as a condition for conducting business in that territory’. Second, the CPTPP includes a hard rule on data flows: ‘[e]ach Party shall allow the cross-border transfer of information by electronic means, including personal information, when this activity is for the conduct of the business of a covered person’ (Article 14.11(2) CPTPP). The rule has a broad scope and most data transferred over the Internet is likely to be covered.

Measures restricting digital flows or implementing localisation requirements are permitted only if they do not amount to ‘arbitrary or unjustifiable discrimination or a disguised restriction on trade’ and do not ‘impose restrictions on transfers of information greater than are required to achieve the objective’ (Article 14.11(3) CPTPP). These non-discriminatory conditions are similar to the strict test formulated by Article XIV GATS and Article XX General Agreement on Tariffs and Trade (GATT) 1994 – a test that is intended to balance trade and non-trade interests by ‘excusing’ certain violations but that is also extremely hard to pass, as the WTO jurisprudence has thus far revealed (Andersen 2015). The CPTPP test differs from the WTO norms in two significant elements: (1) while there is a list of public policy objectives in the GATT 1994 and the GATS, the CPTPP provides no such enumeration and simply refers to a ‘legitimate public policy objective’ (Article 14.11(3) CPTPP); and (2) in the chapeau-like reiteration of ‘arbitrary or unjustifiable discrimination’, there is no GATT- or GATS-like qualification of ‘between countries where like conditions prevail’. The scope of the exception is thus unclear – it can be linked to legal uncertainty, as well as to potentially unworkable safeguards for domestic constituencies.¹⁹ Lastly, it should be noted that the ban on localisation measures is softened on financial services and institutions;²⁰ government procurement is also excluded (Article 14.8(3) CPTPP).

The CPTPP addresses other novel issues as well – one of them is source code. Pursuant to Article 14.17, a CPTPP Member may not require the transfer of, or access to, source code of software owned by a person of another party as a condition for the import, distribution, sale, or use of such software, or of products containing such software, in its territory. The prohibition applies only to mass-market software or products containing such software (Article 14.17(2) CPTPP), which means that tailor-made products, as well as the software used for critical infrastructure and in commercially negotiated contracts, are excluded (Article 14.17(2) CPTPP).²¹ This ban on forced technological transfer aims to protect IT companies and address their concerns about loss of IP or cracks in the security of their proprietary code. It may also be seen as a reaction to China’s demands to access source code from software producers selling in its market (Joint Statement on Trilateral Meeting of the Trade Ministers of the United States, Japan, and the European Union 2020).

These provisions illustrate an important development in the PTA rulemaking in that they do not merely seek the reduction in trade barriers but effectively shape the regulatory space domestically. Particularly critical in this context are also the rules in the area of data protection. Article 14.8(2) requires every CPTPP party to ‘adopt or maintain a legal framework that provides for the protection of the personal information of the users of electronic commerce’. Yet, there are no standards or benchmarks for the legal framework specified, except for a general requirement that CPTPP parties ‘take into account principles or guidelines of relevant international bodies’ (Article 14.8(2) CPTPP). A footnote provides some clarification in saying that: ‘… a Party may comply with the obligation in this paragraph by adopting or maintaining measures such as a comprehensive privacy, personal information or personal data protection laws, sector-specific laws covering privacy, or laws that provide for the enforcement of voluntary undertakings by enterprises relating to privacy’ (Article 14.8(2) CPTPP, at footnote 6). These norms can be interpreted as a prioritisation of trade over privacy rights. This has been pushed by the US during the TPP negotiations, as the US subscribes to a relatively weak and patchy protection of privacy (Whitman 2004; Schwartz and Solove 2014; Burri 2021a), which, among other things, means that the US has encountered difficulties in securing unhindered transatlantic data transfers (Burri 2021a; Chander and Schwartz 2023).

Next to the data protection provisions, the CPTPP also includes norms on consumer protection (Article 14.17 CPTPP), spam control (Article 14.14 CPTPP), and net neutrality (Article 14.10 CPTPP), as well as rules on cybersecurity cooperation (Article 14.16 CPTPP). The provisions are of soft law nature but are nonetheless important in trying to provide interoperability between domestic regimes and enhance business trust.

The accession of the UK to the CPTPP and recent requests for accession by China, Costa Rica, Taiwan and other countries (US Congressional Research Service 2021) will potentially expand this agreement’s commercial reach and geopolitical dimension. Next to these possibilities for an enlarged CPTPP membership, it should also be pointed out that the CPTPP model has diffused in a substantial number of other agreements, such as the 2016 Chile–Uruguay FTA, the 2016 updated Singapore–Australia FTA (SAFTA), the 2017 Argentina–Chile FTA, the 2018 Singapore–Sri Lanka FTA, the 2018 Australia–Peru FTA, the 2019 Brazil–Chile FTA, the 2019 Australia–Indonesia FTA, the 2018 USMCA, the 2019 Japan–US Digital Trade Agreement (DTA), as well as a number of DEAs. The chapter discusses first the USMCA and then looks at selected DEAs.

7.2.2.2 The USMCA

After the US withdrew from the TPP, there was some uncertainty about the direction the US would take on matters of digital trade. The renegotiated North American Free Trade Agreement (NAFTA), now referred to as the ‘USMCA’, provides a useful confirmation of the US approach. The USMCA has a comprehensive ‘Digital Trade’ chapter that follows all critical lines of the CPTPP and creates an even more ambitious template. With regard to replicating the CPTPP model, the USMCA follows the same broad scope of application (Article 19.2 USMCA), bans customs duties on electronic transmissions (Article 19.3 USMCA), and binds the parties to non-discriminatory treatment of digital products (Article 19.4 USMCA). Furthermore, it provides for a domestic regulatory framework that facilitates online trade by enabling electronic contracts (Article 19.5 USMCA), electronic authentication and signatures (Article 19.6 USMCA), and paperless trading (Article 19.9 USMCA).

The USMCA replicates the CPTPP model also with regard to data issues and ensures the free flow of data through a clear ban on data localisation (Article 19.12 USMCA) and a hard rule on free information flows (Article 19.11 USMCA). Article 19.11 specifies further that parties can adopt or maintain a measure inconsistent with the free flow of data provision, if this is necessary to achieve a legitimate public policy objective, provided that there is no arbitrary or unjustifiable discrimination nor a disguised restriction on trade; and the restrictions on transfers of information are not greater than necessary to achieve the objective (Article 19.11(2) USMCA).²²

Beyond these similarities, the USMCA introduces some novelties. The first is that the USMCA departs from the standard US approach and signals abiding by some data protection principles and guidelines of relevant international bodies. In this sense, Article 19.8 USMCA requires the parties to ‘adopt or maintain a legal framework that provides for the protection of the personal information of the users of digital trade. In the development of its legal framework for the protection of personal information, each Party should take into account principles, and guidelines of relevant international bodies, such as the APEC Privacy Framework and the OECD Recommendation of the Council concerning Guidelines governing the Protection of Privacy and Transborder Flows of Personal Data (2013)’ (Article 19.8(2) USMCA). The parties also recognise key data protection principles, including: limitation on collection, choice, data quality, purpose specification, use limitation, security safeguards, transparency, individual participation, and accountability (Article 19.8(3) USMCA), and aim to provide remedies for any violations (Article 19.8(4) and (5) USMCA). This is interesting because it may go beyond what the US has in its national laws on data protection (at least so far) (Chander and Schwartz 2023). Also it reflects some of the privacy protection principles the EU has advocated for, not only within the Union boundaries, but also under the Council of Europe. One can ponder whether this is a development caused by the so-called ‘Brussels effect’, whereby the EU ‘exports’ its own domestic standards and they become global (Bradford 2012, 2020), or whether a shift in the US privacy protection regime is underway (Chander et al. 2021).

Beyond data protection, three further innovations of the USMCA may be mentioned. The first refers to the inclusion of ‘algorithms’, the meaning of which is ‘a defined sequence of steps, taken to solve a problem or obtain a result’ (Article 19.1 USMCA), and has become part of the ban on requirements for the transfer or access to source code in Article 19.16.²³ The second novum refers to the recognition of ‘interactive computer services’ as particularly vital to the growth of digital trade. Parties pledge in this sense not to ‘adopt or maintain measures that treat a supplier or user of an interactive computer service as an information content provider in determining liability for harms related to information stored, processed, transmitted, distributed, or made available by the service, except to the extent the supplier or user has, in whole or in part, created, or developed the information’ (Article 19.17(2) USMCA).²⁴ This provision is important, as it seeks to clarify the liability of intermediaries and delineate it from the liability of host providers with regard to infringement of IP rights. It also secures the application of Section 230 of the US Communications Decency Act,²⁵ which insulates platforms from liability (Goldman 2019; Goldman 2020; Bone 2021) but has been recently under attack in many jurisdictions in the face of fake news and other negative developments related to platforms’ power (Feine 2020; Burri 2022).

The third and rather liberal commitment of the USMCA parties is with regard to open government data. This is truly innovative and very relevant in the domain of domestic regimes for data governance. In Article 19.18, the parties recognise that facilitating public access to and use of government information fosters economic and social development, competitiveness, and innovation. ‘To the extent that a Party chooses to make government information, including data, available to the public, it shall endeavour to ensure that the information is in a machine-readable and open format and can be searched, retrieved, used, reused, and redistributed’ (Article 19.18(2) USMCA). There is in addition an endeavour to cooperate, so as to ‘expand access to and use of government information, including data, that the Party has made public, with a view to enhancing and generating business opportunities, especially for small and medium-sized enterprises’ (Article 19.8(3) USMCA). Finally, it can be mentioned that the cooperation provision of the USMCA goes beyond the CPTPP²⁶ and envisages an institutional setting to enable this cooperation, ‘or any other matter pertaining to the operation of this chapter’ (Article 19.14(2) USMCA).

The US approach towards digital trade issues has been confirmed by the recent US–Japan DTA, signed on 7 October 2019, alongside the US–Japan Trade Agreement.²⁷ The US–Japan DTA replicates almost all provisions of the USMCA and the CPTPP,²⁸ including the rules on open government data (Article 20 US–Japan DTA), source code (Article 17 US–Japan DTA), and interactive computer services (Article 18 US–Japan DTA)²⁹ but notably covering also financial and insurance services as part of the scope of the agreement. In the current WTO negotiations on electronic commerce, the US endorsed for a number of years an ambitious template, which was essentially a compilation of the USMCA and the DTA (WTO US Communication 2019a, 2019b). Yet, in October 2023, the United States rather surprisingly announced that it would not further pursue provisions on data flows, data localisation and source code, so as to safeguard ‘policy space’ for a digital trade rethink.³⁰

7.2.2.3 DEAs

The increased preoccupation of policymakers with digital trade issues can be perhaps best exemplified by the new generation of the so-called digital economy agreements. This is a relatively new phenomenon in the trade rulemaking landscape and so far only six such treaties have been adopted – the aforementioned US–Japan DTA; the 2019 ASEAN Agreement on Electronic Commerce (within the context of ASEAN); the 2020 Singapore–Australia Digital Economy Agreement (SADEA); the 2020 Digital Economy Partnership Agreement (DEPA) between Chile, New Zealand, and Singapore; the 2021 Korea–Singapore DEA; and the 2022 UK–Singapore DEA. What is important to mention at the outset is that these agreements can be adopted as standalone initiatives, such as the DEPA, or as part of existing or new trade agreements, such as the ones between Singapore and Australia, and the UK and Singapore. The DEAs may also differ in scope and the extent to which they include new items on the regulation of the data-driven economy. So, while, for instance, the US–Japan DTA still very much resembles a conventional, albeit extended, digital trade chapter, the ASDEA, the DEPA, and the UK–Singapore DEA go beyond this and engage in entirely new areas of regulatory cooperation, including a mixed set of hard and soft law provisions. This section looks more closely at the DEPA as a representative of this latter category and a model of innovative digital trade rulemaking.

The 2020 DEPA between Chile, New Zealand, and Singapore,³¹ all parties also to the CPTPP, is, as noted earlier, not conceptualised as a pure trade agreement but one that is meant to address the broader issues of the digital economy. In this sense, its scope is wide, open, and flexible and covers several emergent issues, such as those in the areas of artificial intelligence (AI) and digital inclusion. The agreement is also not a closed deal, but one that is open to other countries (Article 16.2 DEPA) and the DEPA is meant to complement the WTO negotiations on electronic commerce and build upon the digital economy work underway within Asia-Pacific Economic Cooperation (APEC), the OECD, and other international forums. To enable flexibility and cover a wide range of issues, the DEPA follows a modular approach that provides countries with more options to pick and choose from and is very different from the ‘all-or-nothing’ approach of conventional trade treaties (Bacchus 2021: 8). After Module 1, specifying general definitions and initial provisions, Module 2 focuses on ‘Business and Trade Facilitation’; Module 3 ‘Treatment of Digital Products and Related Issues’; Module 4 ‘Data Issues’; Module 5 ‘Wider Trust Environment’; Module 6 ‘Business and Consumer Trust’; Module 7 ‘Digital Identities’; Module 8 ‘Emerging Trends and Technologies’; Module 9 ‘Innovation and the Digital Economy’; Module 10 ‘Small and Medium Enterprises Cooperation’; and Module 11 ‘Digital Inclusion’. The rest of the modules deal with the operationalisation and implementation of the DEPA and cover common institutions (Module 12); exceptions (Module 13); transparency (Module 14); dispute settlement (Module 15); and some final provisions on amendments, entry into force, accession, and withdrawal (Module 16).

The type of rules varies across the different modules. On the one hand, all rules of the CPTPP are replicated; some of the USMCA rules, such as the one on open government data (Article 9.4 DEPA) (but not source code), and some of the US–Japan DTA provisions, such as the one on information and communication technology (ICT) goods using cryptography (Article 3.4 DEPA),³² have been included too. On the other hand, there are many other rules – so far unknown to trade agreements – that try to facilitate the functioning of the digital economy and enhance cooperation on key issues. So, for instance, Module 2 on business and trade facilitation includes, next to the standard CPTPP-like norms,³³ additional efforts ‘to establish or maintain a seamless, trusted, high-availability and secure interconnection of each Party’s single window to facilitate the exchange of data relating to trade administration documents, which may include: (a) sanitary and phytosanitary certificates and (b) import and export data’ (Article 2.2(5) DEPA).³⁴ Parties have also touched upon other important issues around digital trade facilitation, such as electronic invoicing (Article 2.5), express shipments and clearance times (Article 2.6), logistics (Article 2.4), and electronic payments (Article 2.7). Module 8 on emerging trends and technologies is also particularly interesting to mention, as it highlights a range of key topics that demand attention from policymakers, such as in the areas of fintech and AI. In the latter domain, the parties agree to promote the adoption of ethical and governance frameworks that support the trusted, safe, and responsible use of AI technologies, and in adopting these AI Governance Frameworks, parties would seek to follow internationally recognised principles or guidelines, including explainability, transparency, fairness, and human-centred values (Article 8.2(2) and (3) DEPA). The DEPA parties also recognise the interfaces between the digital economy, government procurement, and broader competition policy and agree to actively cooperate on these issues (Articles 8.3 and 8.4 DEPA). Along this line of covering broader policy matters in order to create an enabling environment that is also not solely focused on and driven by economic interests, DEPA deals with the importance of a rich and accessible public domain (Article 9.2 DEPA) and digital inclusion, which can cover enhancing cultural and people-to-people links, including between Indigenous peoples, as well as improving access for women, rural populations, and low socio-economic groups (Article 11.2 DEPA).

Overall, the DEAs are a new phenomenon in international trade law with the distinct objective of reflecting the broad range of issues the digital economy impinges upon. Digital economy agreements offer a good basis for harmonisation and interoperability of domestic frameworks and international cooperation that adequately takes into account the complex challenges of contemporary data governance that has essential trade but also non-trade elements. The appeal of the DEAs as a form of enhanced, but also flexible, cooperation on issues of the data-driven economy has been confirmed by South Korea’s accession to the treaty in 2024 and Canada’s (Government of Canada 2021) interest in joining the DEPA. Another example is the follow-up UK–Singapore DEA, which goes in some aspects beyond the DEPA and covers issues, such as lawtech cooperation and decent work for workers in the digital sector.

7.2.2.4 EU’s Approach to Digital Trade

The EU has been a relatively late mover on digital trade issues and, for a long time, did not develop a distinct strategy. Although EU’s PTAs did include provisions on electronic commerce, such as the 2002 agreement with Chile, the language tended to be cautious, with commitments not exceeding GATS levels, and limited to soft cooperation pledges in the services chapter (Article 102 EU–Chile FTA)³⁵ and in the fields of IT, information society, and telecommunications (Article 37 EU–Chile FTA). In more recent agreements, such as the EU–South Korea FTA (signed in 2009), the first EU Agreement with a dedicated electronic commerce chapter, the language is more concrete and binding, imitating some of the US template provisions, for instance, by confirming the applicability of the WTO agreements to measures affecting electronic commerce and subscribing to a permanent duty-free moratorium on electronic transmissions. Cooperation is also increasingly framed in more concrete terms and includes mutual recognition of electronic signature certificates, coordination on Internet service providers’ liability, consumer protection, and paperless trading (Article 7.49 EU–South Korea FTA). As particularly insistent on data protection policies, the EU has also sought commitments from its PTA partners that the development of electronic commerce must be fully compatible with the international data protection standards (Article 7.48 EU–South Korea FTA).

The 2016 EU Agreement with Canada – the Comprehensive Economic and Trade Agreement (CETA) – goes a step further. The CETA provisions concern commitments ensuring (a) clarity, transparency, and predictability in their domestic regulatory frameworks; (b) interoperability, innovation, and competition in facilitating electronic commerce; as well as (c) facilitating the use of electronic commerce by small and medium-sized enterprises (Article 16.5 CETA). The EU succeeded in deepening the privacy commitments as the CETA has a specific norm on trust and confidence in electronic commerce, which obliges the parties to adopt or maintain laws, regulations, or administrative measures for the protection of personal information of users engaged in electronic commerce in consideration of international data protection standards (Article 16.4 CETA). Yet, there are no deep commitments on digital trade, or any rules on data and data flows (Wolfe 2019).

It is only very recently that the EU took up a more modern, CPTPP-comparable, approach towards the regulation of digital trade. Some indications for this turn were given by the 2018 EU–Japan Economic Partnership Agreement (EPA) (Article 8.81 EU–Japan EPA) and the modernisation of the trade part of the EU–Mexico Global Agreement. In these agreements, data flows were mentioned for the first time but still cautiously, as the parties only committed to ‘reassess’ within three years of the agreement’s entry into force. The new EU approach towards the issue of cross-border data is now fully endorsed in the EU’s currently negotiated deals with Australia and Tunisia, the 2020 post-Brexit Trade and Cooperation Agreement (TCA) with the UK,³⁶ as well as the 2022 Agreement with New Zealand. These PTAs’ digital trade chapters include norms on the free flow of data and data localisation bans. However, this repositioning and newer commitments are also linked with high levels of data protection (European Commission 2018).

The EU wishes to permit data flows only if coupled with the high standards of its General Data Protection Regulation (GDPR)³⁷ and endorses a distinct model of privacy as a fundamental right. While the EU and its partners seek to permit the flow of data, these commitments are conditioned: first, by a dedicated article on data protection, which clearly states that: ‘Each Party recognises that the protection of personal data and privacy is a fundamental right and that high standards in this regard contribute to trust in the digital economy and to the development of trade’ (e.g. Article 6(1) draft EU–Australia FTA (emphasis added)),³⁸ followed by a paragraph on data sovereignty: ‘Each Party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through the adoption and application of rules for the cross-border transfer of personal data. Nothing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards’ (e.g. Article 202(2) TCA).³⁹ The EU also wishes to retain the right to see how the implementation of the provisions on data flows impacts the conditions of privacy protection, so there is a review possibility within three years of the entry into force of the agreement, and parties remain free to propose to review the list of restrictions at any time (e.g. Article 201(2) TCA).⁴⁰ In addition, there is a broad carve-out, in the sense that: ‘The Parties reaffirm the right to regulate within their territories to achieve legitimate policy objectives, such as the protection of public health, social services, public education, safety, the environment including climate change, public morals, social or consumer protection, privacy and data protection, or the promotion and protection of cultural diversity’ (e.g. Article 198 TCA).⁴¹ The EU thus reserves ample regulatory leeway for its current and future data protection (and other) measures. The exceptions are also fundamentally different than the objective necessity test under the CPTPP and the USMCA, or that under WTO law, because it is subjective and safeguards the EU’s right to regulate (Yakovleva 2020: 496; Burri and Kugler 2024).

Beyond the topic of data flows and its interface with data protection, it should be noted that the rest of the EU digital trade template includes the issues covered by the CPTPP/USMCA model, such as software source code (Article 207 TCA),⁴² facilitation of electronic commerce (Articles 205 and 206 TCA), online consumer protection (Article 208 TCA), spam (Article 209 TCA), and open government data (Article 210 TCA). However, provisions on non-discrimination of digital products are missing and audiovisual services are excluded from the scope of application of the digital trade chapter (Article 197(2) TCA).

7.2.2.5 The RCEP

An interesting and much-anticipated development against the backdrop of the diverging, at least on data flows, EU and US positions has been the RCEP, signed on 15 November 2020 between the ASEAN Members,⁴³ China, Japan, South Korea, Australia, and New Zealand. The RCEP has been in force since 1 January 2022.⁴⁴

Chapter 12 of the RCEP includes the relevant electronic commerce rules. In a similar fashion to the CPTPP, it clarifies its application ‘to measures adopted or maintained by a Party that affect trade by electronic means’ but excludes from this broad scope (1) government procurement and (2) information held or processed by or on behalf of a party, or measures related to such information, including measures related to its collection. Regarding trade facilitation, the RCEP includes provisions on paperless trading, electronic authentication, and electronic signatures (Article 12.6 RCEP). On paperless trading, the RCEP Members avoid entering into binding commitments. They, instead, commit to ‘work toward’, ‘endeavour’, or ‘cooperate’ (Article 12.5 RCEP). The norms on accepting the validity of electronic signatures are more binding but, in contrast to the CPTPP and USMCA, permit domestic laws and regulations to provide otherwise and prevail in case of inconsistency.

Regarding commitments to create a conducive environment for electronic commerce, the inclusion of provisions on online personal information protection (Article 12.8 RCEP) and cybersecurity (Article 12.13 RCEP) is remarkable. On the former, RCEP Members establish that they shall adopt or maintain a legal framework that ensures personal information protection. Unsurprisingly, the RCEP is not prescriptive as to how parties may comply with this obligation. As for the latter aspect of cybersecurity, the parties do not establish a binding provision but recognise the importance of building capabilities and using existing collaboration mechanisms to cooperate. The RCEP Members also commit to adopt or maintain laws or regulations regarding online consumer protection (Article 12.7 RCEP), unsolicited commercial electronic messages (Article 12.9 RCEP), and a framework governing electronic transactions that take into account international instruments (Article 12.10 RCEP), as well as commit to transparency (Article 12.12 RCEP).

Concerning data flows, in essence, and similar to the EU PTAs, the RCEP provides only for conditional data flows, while preserving room for domestic policies, which may be of a data-protectionist nature. So, while the RCEP electronic commerce chapter includes a ban on localisation measures (Article 12.14 RCEP), as well as a commitment to free data flows (Article 12.15 RCEP), there are clarifications that give RCEP Members a lot of policy space and essentially undermine the impact of the made commitments. In this line, there is an exception possible for legitimate public policies and a footnote to Article 12.14.3(a), which says that: ‘For the purposes of this subparagraph, the Parties affirm that the necessity behind the implementation of such legitimate public policy shall be decided by the implementing Party.’⁴⁵ This essentially goes against any exceptions assessment, as we know it under WTO law, and triggers a self-judging mechanism. In addition, subparagraph (b) of Article 12.14.3 says that the provision does not prevent a party from taking ‘any measure that it considers necessary for the protection of its essential security interests. Such measures shall not be disputed by other Parties’.⁴⁶ Article 12.15 RCEP on cross-border transfer of information follows the same language and thus secures plenty of policy space, for countries like China or Viet Nam, to control data flows without further justification.

Noteworthy are also some things missing from the RCEP: in comparison to the CPTPP, the RCEP does not include provisions on customs duties, non-discriminatory treatment of digital products, source code, principles on access to and use of the Internet for electronic commerce, and Internet interconnection charge sharing. It is finally interesting to observe that the RCEP did not, at least initially, reflect China’s position in the WTO negotiations, where China was more cautious and somewhat fuzzy in its demands. For instance, at the WTO, China subscribed to a very narrow definition of digital trade, arguing that the negotiations should focus on the discussion of cross-border trade in goods enabled by the Internet, together with relevant payment and logistics services, while paying attention to the digitisation trend of trade in services (WTO China Communication 2019: paragraph 2.5), and not engaging in commitments on data flows. This did change in later stages of the negotiations on the Joint Statement Initiative on Electronic Commerce, where China became more open to committing on digital trade issues, particularly those that facilitate it. This can be seen as a shift in China’s position that now views a more open data economy as a key contributor to growth and can also be linked to China’s wish to join the CPTPP.

7.3 The New Design Elements on Digital Trade in PTAs: Concluding Remarks

The above analysis of the developments in PTAs reveals the critical importance of digital trade as a negotiation topic and the substantial efforts made, particularly in recent years, to address it and create an adequate rule framework that goes beyond conventional trade liberalisation efforts. The achievements made by some PTAs and the dedicated DEAs are quite impressive. New and innovative approaches seek to address not only the ‘old’ issues raised under the 1998 WTO Work Programme on Electronic Commerce but also the contemporary issues in the context of a global data-driven economy. However, the new set of regulatory questions is not neatly defined and encompasses miscellaneous subject matters – from electronic contracts through source code to open government data. The question of free data flows and how to balance these against demands of digital sovereignty has become critical in recent years (Burri and Kugler 2024). In this context, the topic of personal data protection, typically one of fundamental rights’ protection, has become a new preoccupation for trade negotiators (Burri 2021a; Chander and Schwartz 2023). The latter development attests to the fact that datafication has extended the scope of trade-related issues and that the electronic commerce/digital trade chapters have turned into centres of gravity to regulate all these.

One can also observe convergence on certain issues, in particular in the area of digital trade facilitation, but also divergence, in particular with regard to permitting and/or conditioning cross-border data flows, as this impacts on the sovereignty of states and their ability to protect the interests of their citizenry. This complex interface between domestic and international data governance regimes can be linked to crafting new reconciliation mechanisms in trade agreements but also to radical shifts and disengagement on data issues, as exemplified by the change in the US position from one of a legal demandeur to a more conservative stance (at least for now).

Finally, in terms of the overall evolution of international economic law, it is apparent that PTAs can serve as regulatory laboratories – testing new approaches as to scope, depth, different treaty language, and even new treaty forms, such as the DEAs. However, the political economy of this legal experimentation is complex, as it is linked to the formation of geopolitical blocks with overlaps that may lead to potential contestations and uncertainties as to the impact of the agreements on the ground. In this context, we see, for instance, that New Zealand is a member of the CPTPP, the RCEP, and the DEPA and also has an agreement with the EU; similarly, the UK has a deal with the EU, while also entering into ambitious digital trade commitments under DEAs and the CPTPP.

Overall, the landscape of digital trade rulemaking is likely to remain highly dynamic. We are bound to see the development of even newer design elements in PTAs as technology advances and as countries continue to position themselves – in particular in the area of AI regulation. The coming years will test the willingness for international cooperation in the domain of digital trade regulation and to what extent achievements made in the PTA venues can be translated to the multilateral forum of the WTO (Burri 2023a, 2023c). It would also test to what extent the digital trade agreements will be able to take up the new slew of issues that the data-driven economy affects – such as those around sustainability, platform power, and the protection of fundamental rights that are not solely focused on privacy (Burri 2023b). There are certain challenges intrinsic to these developments that would demand that treaty language adequately reflects the often precarious balance between economic and non-economic objectives, between domestic regulatory efforts and their external trade aspect. Moreover, digital trade rulemaking ought to become more inclusive and take the interests of developing and least developed countries on board.