Challenging Localization: Analyzing Data Localization against GATS

I. Introduction

The recently released revised Report on Non-Personal Data has against brought to relevance data localization measures as a means to protect privacy. Many countries are resorting to data localization measures in order to protect personal data of their citizens and also to have ease of access to such data for administrative purposes. The increased focus on personal data and privacy protection is largely attributed to the Snowden leaks which have revealed the abuses of information by online platforms.

Data localization requires information relating to users of a country to be stored within the territory of that country and such data of the users would not be allowed to be taken outside the country unless permitted by the government.² These measures are taken by the government primarily as protective measures of privacy and national security; however they also have an effect on free trade amongst countries. Apart from protecting privacy, measures requiring data localization create restrictions on the market for Foreign Service Providers, thus acting as trade barriers which would give advantage to the domestic market to grow.

Countries rely on the WTO mechanism to challenge these localization measures, however there is no particular WTO agreement which explicitly deals with the issue of data localization, but General Agreement on Trade of Services (GATS) can be used to decide the compliance of such measures if they are challenged. As part of my analysis, I will be considering the effects of data localization measures to service providers like social networking sites, social media, data storage services etc.

In evaluating data localization against GATS, the following aspects have to be analyzed - the mode of supply of services, the nature of services, the commitment made by the country under national treatment and market access, and the effect of the measure. Further it is also necessary to look if there are any justifications which can be taken by member states in the instance of violation of specific obligation. In furtherance of this, we will also examine general exception provision of GATS. When WTO Dispute Resolution bodies adjudicate on disputes, it is first the duty of the complainant to establish a prima facie case of violation. Thus in the First chapter will establish a prima facie case, and then in the next chapter I will examine the defense that can be taken for justification.

II. Prima facie violation of gats

For this part of analysis, I will assume that the member country has made the commitment of “none” for cross border supply of telecommunication services. An effect of such a commitment of “none” would be that the country will be bound to follow a policy of not introducing any further restrictions on cross border supply of telecommunication services, as mentioned under Article XVI of GATS.

Telecommunication Service

There is often confusion as to whether social media services can be characterized as telecommunication services. CPC³ and services sectoral classification list⁴ entries are the aids used by the WTO to understand ambit of a particular entry because these lists are also referred to by the member countries when making commitment.

Telecommunication Services is the sub heading that falls under CPC entry under the head of ‘communication services’.⁵ This classification of service is not conclusive because services cannot be strictly labeled under any head owing to the extreme boundless nature of services. Some of the functions might fall under one sub sector, while some might fall under some other sector, thus assessing the functions and the primary need of the service becomes important to understand the appropriate classification.⁶ The sub entries to telecommunication services include services of electronic mail, voice mail, online data processing, electronic data interchange, online database and information retrieval, etc.

Services like social networking primarily depend on database retrieval and online data processing.⁷ Some argue that social media or social networking platforms should not be included in the telecommunication head, but they should be classified under advertisement services which are covered by the head of ‘other business services’.⁸ This is because they consider the services of posting, sharing, electronic chatting and voice messages are all ancillary to them because the source of income for these platforms is to provide a database where people are exposed to advertisements. It is necessary to look at the source of income; however it cannot be the sole criteria to determine the relevant service sector. In the cases of social media and social networking websites, advertising becomes a major source of revenue, yet that does not make other services ancillary. Other services like messaging and data processing are the primary services which attract the consumers and their importance in creating a database for the advertising cannot be overlooked. Thus arguing social media websites to be included under business and related services will neglect the importance of other services provided by the platforms.

Some seminal authors have also argued that social media, social networking and data mining platforms can be characterized under Computer and Related services.⁹ They argue that based on component based approach is more apt than the teleological approach. The component based approach breaks down the services into its technical components and then the most significant determines the relevant service sector for classification¹⁰, while in the teleological approach the classification is made by analyzing the functions which the platform/services perform. Following of a component based approach for classification will not always be accurate or proper classification because components being inputs constitute elements of service and not the service itself; however the commitments in the CPC are not based on inputs, but on the services provided.

In addition, if the component based approach is given greater importance than the teleological approach then most of the digital services would be classified as data transmission services because data transmission is the major component in supplying the digital services. Thus the teleological approach to interpreting CPC has to be the primary approach. Further, analyzing the US Gambling case¹¹ and the China–Publications and Audiovisual Products case¹² illustrate that the Appellate Body relies on teleological approach when deciding relevant W/120 and corresponding CPC classification. Applying the teleological approach, it is established that the functions of social media and social networking platforms can be classified as telecommunication services corresponding to CPC 7523 which covers data and message transmission system.

Mode of Supply of Services

GATS was agreed upon at a time when internet services were not developed and the extent of cross border trade of services could not be expected.¹³ All the services talked about earlier are provided to the customers with the aid of internet. The services are supplied through the internet to different regions throughout the world and the service supplier need not be present within the region where services are provided. Such supply of services squarely falls under the definition of cross-border supply of information.¹⁴ Further the delivery of service through electronic means will be covered under cross border supply. This was the conclusion reached in US Gambling case, Mexico Telecom¹⁵ case and further in the China Audiovisual case. Apart from this the confusion was also caused by the submissions of the United States¹⁶, who argued that services over internet could also fall under ‘consumption abroad’ on the logic that when the services are being utilized, the user is transferred electronically to the place where the services are produced. This argument become difficult to hold because if it is said that the user is electronically transferred, it can also be looked at from the point that when services are supplied the supplier is transferred electronically makes the mode of supply commercial presence¹⁷. Further if such an interpretation were to be accepted, it would run counter to US Gambling and idea of technological neutrality, making it impossible for electronic mode of transfer of service to be cross border in nature. Thus the services requiring data processing, storage or retrieval, would be classified under cross-border mode of supply.

Based on the above explanations, we understand that there is a commitment of ‘none’ in the relevant service sectors. Hence we now proceed with establishing violation of specific commitment.

Market Access Obligation

Market access obligation under GATS lays down certain restrictions which cannot be imposed by the member countries unless they have been scheduled. This is based on the understanding that the aim of the agreement is to ensure predictability and certainty for other members who wish to trade with another country.¹⁸ For market access obligation to be violated, it has to be established that the restriction on trade of service falls under one of the paragraphs mentioned under Article XVI:2. There is a bit of uncertainty around paragraph one and two of Article XVI, and this confusion stems from the overbroad wording of paragraph one. The confusion is whether Article XVI:1 extends to prevent member from introducing any measure which would cause any form of restriction, even those not mentioned in XVI:2. This was resolved by the Panel in US Gambling¹⁹ case where it clarified that both the paragraphs complement each other and have to be read together. A combined reading of both the paragraphs would clarify that for a violation of market access obligation of GATS, one of the sub-clauses in Article XVI:2 have to be fulfilled. Hence a violation of market access obligation will be established when restriction in any of the sub-clauses in XVI:2 is proved. The sub-clauses make a close list, the violation of which is necessary to prove that the challenged measure violates market access commitment of a member state.²⁰ There are six sub-clauses in this provision out of which sub-clauses (a) –(d) are of a quantitative or numeric nature²¹, and (e)-(f) are limitations based on incorporation.²² In the case of data localization measure, Article XVI:2(a) and XVI:2(c) are violated.

Due to the technological neutrality of GATS, this provision makes it irrelevant how the services are supplied to the consumers once it is established that a commitment of ‘none’ was made by the member state in the relevant service sector. The Appellate Body has expressed that GATS is a technological neutral agreement; thus once it is established that commitment was made in the specific sector, then all modes of delivery of the service would be covered by the commitment and the member state will be prohibited from placing limitation on the modes of delivery.²³ If the member state specifically excludes a mode of delivery in their schedule, then the technological neutrality will not extend to those modes of delivery. GATS allows the member states to have the right to regulate their market, but all that is needed from them is that they make it known to other members about their intentions.

Article XVI:2(a)- measure imposing limitation on number of service suppliers

The thrust of this provision remains in the numeric limitation and not the form of limitation, thus to establish a prima facie case of violation, the measure has to be a numeric restriction on the service suppliers. The Appellate Body expanded the scope of this provision in the US Gambling case, holding that it is not just the formal treatment of the measure which will be assessed to check for violation but also the effect the measure has in application which will be part of analysis of market access violation.²⁴ Thus a total prohibition of supply of service of a particular mode of supply will amount to ‘zero quota’ which is covered by the numeric quota under Article XVI:2(a) and XVI:2(c).²⁵ In the case of US- Gambling, the measure in challenge was US law which prohibited cross border supply of gambling services in the US market. The AB concluded that such a measure will in effect lead to ‘zero quota’ limitation which will comprise numeric or qualitative effect under Article XVI:2(a) and XVI:2(c). This conclusion was based on the reasoning that the words ‘in form’ have a broad understanding and should not be understood as having a mechanical understanding; thus the phrase ‘in form of’ will include effects of a measure.²⁶

Based on the above case, we understand that an absolute prohibition of a particular mode of supply of service would amount to violation of Article XVI:2(a). In the present case of data localization, the requirement of creating a data storage centre to store data of users of that particular country would change the mode of supply of service from cross-border to commercial presence. For social media and social networking platforms, the storage and transmission of data of individuals is at the forefront.²⁷ The services to users are provided through the data centres. Localization requirement in effect prohibits the cross-border supply of services and the now it is no longer possible to provide the services as cross-border, thus in effect creating a zero quota restriction on number of cross-border service suppliers. Hence the data localization measure would be a restriction in form of numeric quota, as required by Article XVI:2(a).²⁸

Apart from establishing a complete and total prohibition, it can be argued that even a restriction which cannot be expressed in number can violate this provision if the restriction is placed on service suppliers. It is understood by some that market access obligation is violated only when there is a specific numbered effect.²⁹ This misunderstanding stems from the wording of the provision which says “form of numerical quotas”. This understanding of the provision is used to argue that data localization measures do not violate market access obligation as there is no numbered effect. To support this, reliance is placed on cases decided by WTO as the dispute resolution bodies have been sticking to the numbered effect understanding in its cases relating to market access. I argue that this is a flawed understanding of the provision as it fails to account for GATT jurisprudence and that no conclusive determination has been made on the issue as there has not been any challenge to measures which cannot be characterized as having numbered effect. So it would be erroneous to say that the interpretation is clear from the cases decided by the DSB.

Further, the Panel in the US Gambling case raised its concerns over the restricted understanding of numeric quotas and expressed its concerns by pointing out that the restricted understanding of having a specific numbered effect will mean that a measure causing prohibition to majority of service supplier, but not expressible in specific number, would not be a restriction of market access obligation.³⁰ Such an outcome would be make Article XVI an empty provision and would be pervasive to all notions of logic and rationality. In addition to this, Article XI of GATT related to quantitative restrictions on the sale of goods. The provision in GATT is similar to Article XVI:2(a) of GATS. The WTO has in numerous cases ruled that quantitative restrictions under Article XI of GATT do not require any specified numeric effect.³¹ Trade in service cannot be quantified unlike trade in goods, this shows that putting a specific numeric requirement under GATS would be useless. A data localization measure would restrict majority, if not all, service suppliers. Hence it will violate Article XVI:2(a) of GATS.

Violation of Article XVI:2(c)- limitation on total number of service operations or total quantity of service output

In this provision it has to be established that the effect is on the output of the service supplied or the service operations involved in the delivery of service. The effect however has to be such that it can be said to be a restriction or a limitation, implying that it has to cause some negative impact. This aspect is necessary as a violation of market access obligation needs to be some sort of restriction because a measure which further liberates trade will not be covered by market access obligation.³² The language of this provision is similar to Article XVI:2(a), thus the understanding of this provision will be similar to what has been explained above. Hence, any restriction to the number of service operations or to service output would be covered under this provision. A data localization measure requires that the users’ data shall not be transferred outside the limits of the country. This would place a restriction on the transferability of information of users and thus limiting interaction with services because before this the users could freely interact with the users outside the country and now they are limited to the users within the country. This restriction to the transfer of data would amount to a restriction in output as the output for platforms in question is greatly dependent on transferring of user’s data. In the present case the effect of a data localization measure will have huge implications to the business platform because the reason all social media or social networking platforms is popular amongst individuals is due to the large user base it provides and the capability to communicate without borders. Connecting individuals from across the world is what creates the market for such platforms and what makes them successful platforms. A data localization measure would prevent transfer of data outside borders and would hugely restrict the services available to users and would affect the total service output.³³

Through the above analysis we see that data localization measure will violate Article XVI:2(a) and XVI:2(c) of GATS.

III. Justification under general exceptions

Though GATS intends to liberalize trade in service, it recognizes genuine situations of restricting trade and provides for exceptions where trade restrictions of the nature of market access and national treatment are permissible. These exceptions are found in Article XIV and XIV bis of GATS as general exception and security exception respectively.³⁴ We will discuss the general exception justification as it what is generally invoked and invocation of security exception requires certain specific situations prevailing in the country. General exception is a more objective analysis of the measure challenged as compared to security exception because general exception has the requirement to prove that the challenged measure was a necessary measure, thus the analysis involves analyzing whether there were alternative measures available which could have been taken. When applying security exceptions, the DSB does not go into availability of alternatives, but is only required to be satisfied that there was a situation prevailing which would be covered under Article XIVbis, and adoption of this measure was proportional to the threat.³⁵

A perusal of Article XIV of GATS will show that amongst various grounds, XIV(c)(ii) is relevant for the analysis of data localization measure. The justification or the defense of general exception is taken when the complainant has established a prima facie case of violation of specific commitment, in this case the market access violation. After establishing a prima facie case of violation, the burden of establishing justification is on the respondent member. In order to establish that a measure comprises general exception under Article XIV, it has to be established that; the measure in challenge is was necessary for purposes specified in one of the clauses of the provision, and that the measure satisfies the chapeau of Article XIV. The chapeau requires that a measure should not be “applied in a manner that constitutes arbitrary or unjustifiable discrimination between countries where like conditions prevail, or a disguised restriction on international trade”.³⁶ Data localization requirement would satisfy this requirement because the localization requirement is usually for all service providers of a particular class. However the important analysis is of the measure being necessary for purposes specified in one of the clauses of the provision. Data localization is usually employed to ensure dual goal of getting access to information needed to enforce law and order situation from service providers in timely manner, and also to ensure that the privacy of its citizens are protected. These goals will fall under general exception. Apart from the measure being for purposes specified in one of the clauses of the provision, it also has to be necessary.

The test of necessity is complicated as it requires the member to show that there were no other alternatives available which provided the same level of protection and was less trade restrictive. This is an objective analysis and thus there is less discretion with the member state in taking measures.³⁷ With regards to objective of ensuring that member states have access to information for law enforcement, merely having data localized does not ensure that the law enforcement agencies will have access to the information. The access to information has more to do with the laws and conditions under which the platforms function. Thus instead of localizing data centres, a mechanism to providing access which is properly backed by law would be a less trade restrictive measure and also would fulfill the ail of the state. With regard to the privacy concern, end to end encryption and duties on data principals as in the GDPR would in fact be better alternatives to privacy and would not restrict trade.³⁸ Hence it can be seen that there are other alternatives available to data localization, which would provide the same level of protection. Thus data localization will fail to pass the necessity test, unless it is established that the alternatives are ineffective or there is another object which the measure seeks to achieve and localization is the only method to achieve it.

IV. Conclusion

Analyzing the market access obligation and the general exceptions under GATS, it is evident that there is a prima facie violation of market access obligation by data localization measures, provided that the member state has made a commitment of none in the relevant service sector and mode of supply of service as has been explained in the article. Further a measure of data localization will not be covered under general exception because there are other less restrictive alternatives available which will provide the same level of protection to personal data and privacy of users. Before the GDPR came into force, the EU also discussed about the possibility of adopting a data localization provision, however being mindful of the impact of such a measure the EU decided to not adopt a trade restrictive practice. The approach of EU through the GDPR is a testament to obsolete and unnecessary nature of data localization. There being a less restrictive measure providing the same amount of protection to privacy makes a solid case to conclude that data localization measures is a violation GATS.