Canada: The Limits Of Data Localization Laws: Trade, Investment, And Data

Last Updated: September 16 2019
Article by Sean Stephenson and Paul M. Lalonde

On the 8th and 9th of June, 2019, the G20 Ministerial Meeting on Trade and Digital Economy took place in Tskuba, Japan. In a Ministerial Statement released after the meeting, the Ministers reaffirmed their commitments to transborder data flows noting that it generates higher productivity, greater innovation, and improved sustainable development, while acknowledging certain challenges related to "privacy, data protection, intellectual property rights, and security".

Indeed, with the increasing importance of data in everything from cloud computing, the internet of things and big data analytics, the free flow of data is essential to unlocking the full potential of global e-commerce and modern business in data driven economy. This is true not only for multinational corporations but also as noted in a recent report from the International Chamber of Commerce, small to medium enterprises that use online e-commerce are five times more likely to engage in import-export trade than enterprises that do not engage in e-commerce.

To address certain concerns relating to data protection, privacy, national security, law enforcement and industrial policy several countries have recently considered and adopted laws to regulate data flows. "Data localization" laws require certain types of data to be stored/ located within a certain country. To date, at least thirty-four countries have adopted data localization laws, including Germany, Russia, Greece, Taiwan, China, Vietnam, Malaysia, Brazil, Australia.

The Canadian federal government, in its recent announcement of the creation of Canada's Digital Charter, said that Canada continues to support bilateral and multilateral commitments relating to the cross-border transfer of information, as well as commitments, which seek to prevent data localization requirements. At the same time, provincial governments across Canada often impose data localization requirements in procurement tenders, presumably taking advantage of the exceptions to such new rules. Canada is also engaged internationally to promote the global interoperability of privacy frameworks. This is especially important in the context of data flows supporting the development of artificial intelligence. Following the commitment made by G7 Innovation Ministers during their Ministerial Meeting on Preparing for Jobs of the Future, Canada hosted a G7 Multi-stakeholder Conference on Artificial Intelligence on December 6, 2018 in Montréal. This built on the G7 Innovation Ministers' Statement on AI, and the G7 Leaders' Charlevoix Common Vision for the Future of Artificial Intelligence.

Trade and investment agreements provide a framework that govern transborder data flows, promote openness and, more recently, certain mega-regional trade agreements, such as the ones reviewed below, provide express guidance on the balance that may be struck between free flowing data and limitations based on legitimate policy concerns.

Where personal information is involved, countries may seek to impose data localization requirements in the context of privacy legislation. The Office of the Privacy Commissioner of Canada recently announced a consultation on transborder flows of personal information, intending to explore effective privacy protections "in the context of transborder data flows and transfers for processing, accepting that transborder flows are the subject of international trade agreements and that both domestic and international transfers bring significant benefits to individuals and organizations."

Trade Agreements

WTO

From a trade perspective, while the World Trade Organization (WTO) and other international fora are now more directly engaged in developing rules on international e-commerce and digital trade, cross-border data flow is primarily governed by WTO agreements, 21st century free trade agreements and investment treaties.

The WTO General Agreement on Trade and Services (GATS) applies to services, including where data storage is an element in the provision of the service. The GATS requires, subject to any specific exclusions for particular services, that data localization legislation respect the core obligations of the trading system. For data, this includes:

  • Most Favored Nation treatment: data localization laws may not be imposed selectively on nationals of any given country;
  • National Treatment: data localization laws may not provide preferences to locals over foreign nationals and greater burdens could not be imposed on foreign nationals;
  • Market Access: Access to a country's market may not be accessible on the condition that data is stored locally.
  • Any data laws must not be applied in a manner, which would constitute a means of arbitrary or unjustifiable discrimination or a disguised restriction on trade.

The GATS provides for limited exceptions to these obligations. Most relevant to data localization provisions are the exceptions relating to laws necessary to protection public morals or public order, and the protection of privacy in relation to the processing dissemination of personal data and the protection of confidentiality of individual records and accounts. The GATS also contains a national security exception.

Under the GATS, a data localization law that breach the above commitments may be challenged by another WTO member, among other things, on the basis that a less-trade restrictive measure may fulfill the stated objective of the targeted data law. Any such challenge may question and scrutinize the nexus between the stated policy rationale and the effects of data localization as well as any discriminatory elements stemming from a law's effect that may not be justified by legitimate policy objectives.

CPTPP & USMCA

Transborder data flows are explicitly governed in certain recent mega-regional trade agreements as part of new digital economy and e-commerce chapters. These modern agreements include express prohibitions on data localization laws with a limited number of exceptions.

The Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), which entered into force a majority of signatories in January 2019, contains specific provisions prohibiting data localization. While recognizing that each country may regulate data, Article 14.13 of the CPTPP includes a prohibition on data localization as a condition for conducting business in that territory. The CPTPP includes a broad exception to the localization rule. To fall within the exception any such law must (i) serve a legitimate public policy objective, (ii) must not be applied in an manner that does not constitutes arbitrary or unjustifiable discrimination or disguised restriction on trade, and (iii) does not impose restrictions on the use or location of computing facilities greater than are required to achieve the law's objective. The specific policy objective of any law may be set by each country, and is not subject to contestation.

Additionally, the CPTPP also includes a general national security exception for any measure that is limited to measures relating to the maintenance or restoration of international peace or security, or the protection of its own essential security interests.

Similarly, the recently signed, although not yet in force, USMCA between the US, Canada, and Mexico, also includes a general prohibition on data localization in Article 19.12. Under the USCMA there are no exceptions to this rule contained in the digital trade chapter, although Chapter 32 of the agreement incorporates a limited number of the GATS exceptions into the digital trade chapter as discussed above. The USCMA also includes an identical national security exception as included in the CPTPP.

CETA

The Comprehensive Economic and Trade Agreement (CETA) between Canada and the EU and its member states does not contain any specific provisions on data localization, although it includes provisions for future dialogue or consideration of issues concerning cross border data flows. Similarly, other EU agreements with Japan, and Mexico also do not provide for any specific provisions on data localization.

Investment Treaties and Data

Although investment treaties do not explicitly address data or data localization, they provide certain protections to investments made by foreign nationals. Most investment treaties provide for the basic protections of most favored nation, and national treatment, fair and equitable treatment, prohibitions against performance requirements, and expropriation. While these protections are similar to those included in trade agreements, one key difference between trade and investment treaties is that investment treaties allow investors to bring actions directly against a non-complying country, whereas any non-compliance and dispute resolution under trade agreements is dealt with between the signatory states. To the extent that data localization favors domestic companies or individuals, or may be viewed as unfair to foreign investors, such laws and regulations may form the basis of an investment claim. Although to date, there has not yet been any such investment claim, it is possible that data localization forms the basis or part of an investment claim.

Conclusion

In brief, to date, trade and investment treaties are the only binding legal framework for data localization. Through their core norms of non-discrimination and minimum standards of fairness they provide support for open transborder data flows and protections against unjustified data localization requirements. More recent trade agreements address data localization directly, with prohibitions against that practice, save for situations that may fit into express exceptions. Legitimate privacy-related data flow measures are likely to fall within the exceptions, although the specific intent of the legislation, and overarching trade law framework in place would need to be considered. These mega-regional agreements are developing the standards of openness which must be taken into account when legislating and regulating data localization and against which data localization may be tested.

Footnotes

1 G20 Ministerial Statement on Trade and Digital Economy, June 9, 2019.

2 We note that the specific data covered in data localization legislation varies. For instance, the British Columbia Freedom of Information and Protection of Privacy Act applies to "all records in the custody or under the control of a public body". Freedom of Information and Protection of Privacy Act RSBC 1996, Chap. 165, at art. 3.

About Dentons

Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries. www.dentons.com

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances. Specific Questions relating to this article should be addressed directly to the author.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Authors
 
In association with
Related Topics
 
Related Articles
 
Related Video
Up-coming Events Search
Tools
Print
Font Size:
Translation
Channels
Mondaq on Twitter
 
Mondaq Free Registration
Gain access to Mondaq global archive of over 375,000 articles covering 200 countries with a personalised News Alert and automatic login on this device.
Mondaq News Alert (some suggested topics and region)
Select Topics
Registration (please scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.

Disclaimer

The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.

General

Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions