LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH...

28
1 | 28 Working Paper No. 223 June 2020 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS THE CASE OF THE RUSSIAN FEDERATION Simón Hernández Serrano Akhil Raina

Transcript of LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH...

Page 1: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

1 | 28

Working Paper No. 223 – June 2020

LEGAL PROBLEMS WITH DATA LOCALIZATION

REQUIREMENTS – THE CASE OF THE RUSSIAN

FEDERATION

Simón Hernández Serrano Akhil Raina

Page 2: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

2 | 28

LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE

CASE OF THE RUSSIAN FEDERATION

Dedicated to Anne-Claire González Goetghebuer

SIMÓN HERNÁNDEZ SERRANO AKHIL RAINA

Abstract

In times of turbulence for international trade, some issues stand out as ‘cutting-edge’. Trade in data,

and data-related services are a part of those ‘frontier’ conversations. To this end, a peculiar kind of

measure has emerged since 2013: data-localization requirements (DLRs) mandate that only

domestic service suppliers can process data of the citizens of a particular country. Several prominent

players in the trading landscape, including the United States and China, have imposed such

measures. Similar legislation has been enacted by the Russian Federation (RF), which is analysed

herein. Before assessing measures imposed by the RF, the authors set out the landscape of the

General Agreement on Trade in Services (GATS), particularly the obligations relating to Market

Access under Article XVI. Drawing heavily on World Trade Organization (WTO) jurisprudence, the

authors demonstrate that the RF measures in question fall within the scope of the GATS and violate

the RF’s obligations under Article XVI; and further, that such violation cannot be justified under

Articles XIV or XIVbis. To this end, the authors contribute to the existing literature on a subject which

is becoming exponentially significant as time moves on.

Keywords

World Trade Organization (WTO); General Agreement on Trade in Services (GATS); Data

Localization Requirements; Market Access; National Treatment; General and Security Exceptions;

Russian Federation.

Authors

Simón Hernández is an associate at Van Bael & Bellis. He taught WTO law at the Pontifica

Universidad Javeriana of Bogotá, Colombia. Contact: [email protected]

Akhil Raina is Marie S. Curie Fellow and PhD Candidate at the Leuven Centre for Global

Governance Studies and the Institute for International Law, KU Leuven, Belgium. He is also

Teaching Assistant at KU Leuven for the ‘Law of the WTO’. Contact: [email protected].

The arguments and claims expressed in this document correspond to the personal

views of the authors and not of the institutions and companies they are associated

with.

Page 3: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

3 | 28

Table of Contents

I. Introduction ............................................................................................................................................ 4

II. Conceptual Framework .......................................................................................................................... 6

1. Personal Data, Processing of Personal Data, and Data Localization ...................................... 6

2. Federal Law No. 242-FZ of 21 July 2014 of the Russian Federation ...................................... 8

III. Legality, Part I: The DLR of Article 2 of Federal law 242 of 2014 and the scope of application

of the GATS ........................................................................................................................................... 9

IV. Legality, Part II: The DLR of Article 2 of Federal Law 242 of 2014, the market access obligation

of the GATS and the Russian Federation’s GATS Schedule of Commitments ................................... 11

V. Defence, Part I: The DLR of Article 2 of Federal Law 242 of 2014 and Article XIV of the GATS

............................................................................................................................................................. 17

1. Article XIV(a) of the GATS ..................................................................................................... 18

2. Article XIV XIV(c)(ii) of the GATS ........................................................................................... 22

3. The chapeau of Article XIV of the GATS ................................................................................ 23

VI. Defence, Part II: The DLR of Article 2 of Federal Law 242 of 2014 and Article XIVbis of the

GATS ................................................................................................................................................... 24

VII. Conclusions ......................................................................................................................................... 26

Page 4: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

4 | 28

LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE

CASE OF THE RUSSIAN FEDERATION

I. INTRODUCTION

‘Fidelio’ is the story of a woman named Leonore, who disguised herself as a (male) prison guard

called Fidelio and rescued her husband from certain death during the French Revolution. If you are

a music enthusiast – as both present authors are – then you are probably also aware that ‘Fidelio’ is

an opera given to us by the same composer that bequeathed the world the glorious 9th. And even if

you are not a musical connoisseur, but were nevertheless piqued with curiosity, you may have by

now googled “Fidelio”, and found out that it was the only opera ever to be composed by Ludwig van

Beethoven.

Now, let us imagine that you are anywhere in the world, except the United States (“US”). What has

happened is that immediately, Google’s servers – all located in the US – have delivered you the

information you desired, without either the servers, or you, having to change location. Let us further

imagine, now, that persuaded by this preliminary discussion on music – and, luckily, not yet the law

– you decided to acquire Fidelio via Spotify. Within seconds, Spotify’s servers – again, mostly located

in the US – process your data, including your financial information, and deliver a copy of the opera

to your phone. This day-to-day example – where you completed a transaction and made use of

international trade rules – underscores how modern exchanges of information are intricately

connected to international trade, and in turn, how both are dependent on the supply of digital services

and the transfer of data across national borders.

It is no surprise then, that the 2016 study of the McKinsey Global Institute concluded that “cross-

border data flows now generate more economic value than traditional flows of traded goods”.1 Data

has such an immense impact in today’s trading world that it has been referred to as the “oil of the

twenty-first century”, and even the “currency for [the] digital economy”.2 The Economist has gone

even further, claiming that the world’s most valuable resource is no longer oil, but data.3 Data is as

important for modern economies, as its cross-border flow is for international trade.

Why is it then, that countries are attempting to limit or restrict the flow of data? Why are countries

imposing measures that require the local processing and storage of data? Such measures –

commonly known as data localization requirements (“DLR” in singular and “DLRs” in plural) –

1 Manyika, James et al., Digital Globalization: The New Era of Global Flows 2, McKinsey Global Institute, 2016; see also: Blume, Joshua D., Reading the Trade Tea Leaves: A Comparative Analysis of Potential United States WTO-GATS Claims Against Privacy, Localization, and Cybersecurity Laws, Georgetown Journal of International Law, 49 (801), 2018, page 1. 2 Sen, Nivedita, Understanding the Role of the WTO in International Data Flows: Taking the Liberalization or the Regulatory Autonomy Path?, Journal of International Economic Law, 2018, page 323. 3 The Economist, The World’s Most Valuable Resource is no Longer Oil, but Data’, 6 May 2017, available at: https://www.economist.com/leaders/2017/05/06/the-worlds-most-valuable-resource-is-no-longer-oil-but-data

Page 5: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

5 | 28

interfere with the technical infrastructure and ecosystem of the internet, and even affect the internet’s

reliability as a platform for transferring data.4 From a technical standpoint, DLRs contradict the

fundamental end-to-end architecture of the internet, which requires unhindered and instantaneous

flow of data across the network, irrespective of the origin or content of the data.5 From an economic

standpoint, these measures increase compliance and operational costs for foreign providers of digital

services since they are forced to build local services or use local services within the implementing

country.6 In turn, domestic companies and consumers that rely on digital services lose out on

significant business and other related opportunities.7 As it turns out, DLRs may have prevented you

from ever knowing that Beethoven composed not just symphonies, but also an opera.

Now, given that DLRs have seen a surge since 2013,8 the ontological question arises: how did we

get here? By this we mean: given that DLRs disrupt trade and data flows, why would a country impose

a measure that threatens the oil of the twenty-first century, or the currency of the contemporary digital

economy? A preliminary assessment of the specific DLR analysed below, yields the result that its

justifications range from the protection of the right to privacy while processing personal data, as well

as the protection personal and family secrecy. However, DLRs often seem to have a protectionist

intent, and thus could be found to be a “disguised restrictions on trade”.9 It is not a surprise then that

very recently, the US Trade Representative has released a robust report questioning the compliance

of certain DLRs with trade law.10

Noting that DLRs have an impact on international trade, the legal framework of the World Trade

Organization (“WTO”) – the main regulator of international trade, composed of treaties binding on its

Members – becomes relevant for this study. Under the aegis of the WTO, the General Agreement of

Trade in Services (“GATS”) was signed, acknowledging the importance of trade in services for the

growth and development of the world economy. This importance of services is borne out by recent

research as well.11 On the one hand, the GATS contains a set of multilateral principles and rules for

trade in services with a view to expand them under conditions of transparency and progressive

4 Mishra, Neha, Privacy, Cybersecurity, and GATS Article XIV: A New Frontier for Trade and Internet Regulation?, World Trade Review, 2019, page 5. 5 Garfinkel, Simson, ‘The End of End-to-End?’, MIT Technology Review, 1 July 2003; Hon, W. Kuan Hon, Data Localization Laws and Policy, Edward Elgar Publishing, 2003, page 32. 6 Ibid. 7 Mihaylova, Iva, ‘Could the Recently Enacted Data Localization Requirements in Russia Backfire?’, Journal of World Trade 50, no. 2, 2016, pages 317 to 319. 8 Hill, Jonah Force, ‘The Growth of Data Localization Post-Snowden’, SSRN Electronic Journal, 2014. 9 As expressly disallowed by the chapeau of GATS Article XIV; while justifications exist for hindering trade in light of legitimate policy objectives, they must not be protectionist in nature. See: Appellate Body Report, United States - Measures Affecting the Cross-Border Supply of Gambling and Betting Services, WT/DS285/AB/R, adopted 20 April 2005, para. 339. 10 United States Trade Representative, 2019 Report on the Implementation and Enforcement of Russia’s WTO Commitments, February 2020. 11 Rueda-Cantuche, José M., Kerner, Riina, Cernat, Lucian, Ritola, Veijo, Trade in Services by GATS Mode of Supply: Statistical Concepts and First EU Estimates, 3 Chief Economist Note (European Commission), 2016, page. 2; Sauvé, Pierre, To fuse, Not to Fuse, or Simply Confuse? Assessing the Case for Normative Convergence Between Goods and Services Trade Law, 22 Journal of International Economic Law, 2019, pages 355 to 356.

Page 6: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

6 | 28

liberalization.12 On the other hand, it recognizes the right of WTO Members to regulate, and to

introduce restrictions on, the supply of services within their territories with the objective of promoting

or meeting a national policy. These objectives, recognized in Articles XIV and XIVbis, include, inter

alia, public morals and public order; protection of human and plant life; protection of ‘essential security

interests’ etc. In this way, the GATS sets out to balance the liberalization of trade in services and the

right of sovereign nations to regulate such trade.13

The aim of this article is to contribute to existing literature on the subject, and test the WTO

compliance of certain DLS, by: (i) offering an introduction to the concepts of: personal data;

processing of personal data; data localization, in addition to sketching the specific DLR introduced

by the Russian Federation (Section II); (ii) demonstrating that these DLRs fall under the scope of the

GATS (Section III); (iii) evidencing that these DLRs constitute what is known as a ‘zero quota’, and

that they subsequently breach the market access obligation found in Article XVI of the GATS read

together with the Russian Federation’s Schedule of Specific Commitments on Services (“GATS

Schedule of Commitments”) (Section IV);14 (iv) revealing that these DLRs cannot be justified by the

exceptions clause in Article XIV of the GATS since they fail to satisfy the requirements of the

‘necessity test’ and that of the chapeau (Section V); (v) explaining further that the DLRs cannot also

be justified by the security exceptions clause found in Article XIV bis of the GATS (Section VI); and

(vi) offering some conclusions on the future of such measures and of the policy research surrounding

them (Section VII).

II. CONCEPTUAL FRAMEWORK

This section sets out the concepts of personal data, the processing of personal data, and of data

localization. It further includes an analysis of the specific measures introduced by the Russian

Federation.

1. Personal Data, Processing of Personal Data, and Data Localization

Personal data is a term that can roughly be defined as any information relating to an individual. A

relevant legal instrument in this regard is Regulation (EU) 2016/679, of the European Parliament and

of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of

12 GATS: General Agreement on Trade in Services, Apr. 15, 1994, Marrakesh Agreement Establishing the World Trade Organization, Annex 1B, 1869 U.N.T.S. 183, 33 I.L.M. 1167 (1994), recital 2. 13 The Panel in US – Gambling (“as defined below”) noted that “[p]rogressive liberalization entails including more sectors in Members' schedules and reduction or elimination of limitations, terms, conditions and qualifications on market access and national treatment through successive rounds of negotiations.”, para. 6.313. See further: Wouters, Jan and Coppens, Dominic, GATS and Domestic Regulation: Balancing the Right to Regulate and Trade Liberalization in (Alexander and Andenas eds.) The World Trade Organization and Trade in Services (2008), particularly page 441. 14 For now, we leave aside the question of whether such a measure can also be considered a ‘domestic regulation’ (i.e. internal instrument), covered by Article VI of the GATS. For distinction between the two fields of operation of rules, see: Pauwelyn, Joost, Rien ne Va Plus? Distinguishing Domestic Regulation from Market Access in GATT and GATS, 4 World Trade Review (2005).

Page 7: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

7 | 28

their personal data and on the free movement of such data (The General Data Protection Regulation

or “GDPR”).15 The GDPR defines personal data as “any information relating to an identified or

identifiable natural person; an identifiable natural person is one who can be identified, directly or

indirectly, in particular by reference to an identifier such as a name, an identification number, location

data, an online identifier or to one or more factors specific to the physical, physiological, genetic,

mental, economic, cultural or social identity of that natural person”.16

We bring the GDPR to this study since it is considered to be one of the most comprehensive legal

instruments regulating the processing of personal data.17 It further defines processing of personal

data as “any operation or set of operations which is performed on personal data or on sets of personal

data, whether or not by automated means, such as collection, recording, organisation, structuring,

storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,

dissemination or otherwise making available, alignment or combination, restriction, erasure or

destruction”.18

Moreover, a ‘controller’ of personal data is defined in the GDPR as “the natural or legal person, public

authority, agency or other body which, alone or jointly with others, determines the purposes and

means of the processing of personal data; where the purposes and means of such processing are

determined by Union or Member State law, the controller or the specific criteria for its nomination

may be provided for by Union or Member State law”.19 Additionally, the Convention for the Protection

of Individuals with regard to Automatic Processing of Personal Data of the Council of Europe – to

which the Russian Federation is a party and which has served as the basis for EU data protection

legislation – defines a ‘controller’ as the natural or legal person, public authority, agency or any other

body who is competent according to the national law to decide what should be the purpose of the

automated data file, which categories of personal data should be stored and which operations should

be applied to them”.20

Turning to DLRs, these can be defined as measures imposed by countries, which require the

processing of personal data to be conducted within their national territories. Crosby opines that DLRs

are government measures that restrict or prohibit the cross-border flow of data and require the local

storage and processing of data.21 Sen, on the other hand, defines DLRs as any legal limitation on

15 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, OJ L 119/1 of 4.5.2016. For a quick take, see: Coldicutt, Samuel and Sen, Nivedita, Testing the GDPR's WTO readiness, Linklaters, available at: https://www.linklaters.com/en/insights/blogs/tradelinks/testing-the-gdprs-wto-readiness (accessed 16/04/2020). 16 GDPR, Article 4(1). 17 Zarsky, Tal, Incompatible: The GDPR and the Age of Big Data? 47 Seton Hall Law Review (2016), page 995. 18 GDPR, Article 4(2). 19 GDPR, Article 4(7). 20 Council of Europe, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, European Treaty Series - No. 108, Strasbourg (1981). 21 Crosby, Daniel, Analysis of Data Localization Measures Under WTO Services Trade Rules and Commitments, International Centre for Trade and Sustainable Development (ICTSD), 2016, page 2.

Page 8: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

8 | 28

the ability for data to move globally and to remain locally.22 Mishra simply considers that DLRs are

any measure that specifically encumbers the transfer of data across borders.23 Previously, the

European Commission defined DLRs as “any obligation, prohibition, condition, limit or other

requirement provided for in the laws, regulations or administrative provisions of the Member States,

which imposes the location of data storage or other processing in the territory of a specific Member

State or hinders storage or other processing of data in any other Member State”.24

EU Regulation 2018/180725 aims to provide some flexibility within its rules: DLRs are to be prohibited,

unless justified on grounds of public security and in compliance with the principle of proportionality.26

The idea of proportionality is not only central to EU regulatory ambitions but also runs through the

spine of the WTO agreements;27 it is worth noting that two of the main regulatory agreements

regarding goods – the Agreement on Technical Barriers to Trade and the Agreement on the

Application of Sanitary and Phytosanitary Measures – both dictate that measures must be

proportional with the risk at hand.28

Now – having discussed DLRs in the abstract and noting that these are measures that require the

processing and/or storing of personal data within the jurisdictional borders of a certain country – we

turn our attention to a specific example of such measures such as the DLR imposed by the Russian

Federation. 29

2. Federal Law No. 242-FZ of 21 July 2014 of the Russian Federation

In July 2006, the Federal Assembly of the Russian Federation adopted Federal Law No. 152-FZ on

personal data (“Federal Law 152 of 2006”), which regulates activities related to the processing of

personal data by, inter alia, legal entities and physical persons. According to its text, the law has the

purpose of securing the “protection of a person's rights and liberties while processing his/her personal

data, including the right to privacy, personal and family secrecy”.30

22 Doc. cit. supra 2. 23 Doc. cit. supra 4. 24 European Commission, ‘Proposal for a Regulation of the European Parliament and of the Council on a Framework for the Free Flow of Non-Personal Data in the European Union’, Doc. no. 2017/0228 (COD) (13 September 2017), Art. 3(5). 25 Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018 on a framework for the free flow of non-personal data in the European Union, OJ L 3030/59 of 28.11.2018. 26 Ibid, Article. 4.1. 27 Desmedt, Axel, Proportionality in WTO Law, Journal of International Economic Law (2001); and Andenas, Mads and Zleptnig, Stefan, Proportionality: WTO Law: In Comparative Perspective, 42 Texas International Law Journal (2007). 28 Article 2.2 of the TBT provides that even given a legitimate policy objective, a WTO Member cannot impose a measure that is “more trade restrictive than necessary”. A similar dicta is expressed in Article 2.2. of the SPS which states that measures are to be applied “only to the extent necessary”. 29 For the readers’ further information, studies by Sen, doc. cit. supra 2, contain a snapshot of common DRLs imposed worldwide. 30 Federal Law 152 of 2006, Article 2.

Page 9: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

9 | 28

Subsequently, in July 2014, this law was amended by Federal Law No. 242-FZ of 21 July 2014 to

update the procedure for personal data processing in information-telecommunication networks

(“Federal Law 242 of 2014”). Article 2 of Federal Law 242 of 2014 provides:

“The following amendments are hereby made to [Federal Law 152 of 2006]:

1) Article 18 shall be supplemented with Part 5 of the following wording:

5. While collecting personal data, for instance by means of the information

telecommunication network "internet" the operator shall ensure the recording,

systematising, accumulating, storing, making more precise (updating, modifying) and

retrieving of the personal data of citizens of the Russian Federation by means of

databases located on the territory of the Federation” (emphasis and brackets not part of

the original text).

Article 18 of Federal Law 152 of 2006, contains obligations incumbent on the ‘operator’31 when

processing personal data. Article 2 of Federal Law 242 of 2014, then, in effect, imposes a new

obligation on operators by requiring them to have their databases located within the territory of the

Russian Federation, when conducting any activity relating to the processing of personal data of

Russian citizens. In our view, this provision contains a DLR.

III. LEGALITY, PART I: THE DLR OF ARTICLE 2 OF FEDERAL LAW 242 OF 2014 AND THE

SCOPE OF APPLICATION OF THE GATS

The measures of Article 2 of Federal Law 242 of 2014 fall under the scope of application of the GATS.

Unlike the General Agreement on Tariffs and Trade (“GATT”), the GATS, in its Article I, contains

specific rules that define its scope of application. The Appellate Body in Canada – Autos explained

that the “fundamental structure and logic of Article I:1, in relation to the rest of the GATS, require that

determination of whether a measure is, in fact, covered by the GATS must be made before the

consistency of that measure with any substantive obligation of the GATS can be assessed”.32 Thus,

before making substantive determinations, one is required to test whether the GATS even applies to

the measure at hand.33

Article I:1 of the GATS provides that the Agreement applies to measures by WTO Members “affecting

trade in services”. In EC – Bananas III, the Appellate Body concluded that the “ordinary meaning of

the word “affecting” implies a measure that has “an effect on”, which indicates a broad scope of

31 Defined in article 3(2) of Federal Law 152 of 2006 as a “state agency, municipal authority, legal entity or individual who independently or in cooperation with other entities organizes and/or processes personal data as well as determines the purposes and scope of personal data processing” 32 Appellate Body Report, Canada – Certain Measures Affecting the Automotive Industry, WT/DS139/AB/R WT/DS142/AB/R, adopted 19 June 2000, paras. 151, 152 and 155. 33 Rudolf Adlung, Public Services and the GATS, 9(2) Journal of International Economic Law (2006).

Page 10: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

10 | 28

application”.34 Further, Article I:2 of the GATS, defines trade in services in the paradigm of ‘modes’,

including: the supply of a service from the territory of one Member into the territory of any other WTO

Member35 or in the territory of one WTO Member to the service consumer of any other WTO

Member.36 What is known as ‘mode 1’ or ‘cross-border’ supply of services encompasses the ability

or possibility of non-resident (foreign) suppliers to provide services (cross-border) into the territory of

another WTO member.37 Finally, Article XXVIII(b) of the GATS defines the “supply of a service” as a

term that includes the ‘production, distribution, marketing, sale and delivery of a service’.

Another legal instrument under the WTO rubric is known as ‘Guidelines for the Scheduling of Specific

Commitments Under GATS’ (“Scheduling Guidelines”). These were adopted by the WTO Council for

Trade in Services in March 2001, intended to “assist in the preparation of offers, requests and national

schedules of specific commitments”.38 The Scheduling Guidelines provide that “the modes are

essentially defined on the basis of the origin of the service supplier and consumer, and the degree

and type of territorial presence which they have at the moment the service is delivered”.39 With

respect to Mode 1, the Scheduling Guidelines state that the “service supplier [is] not present [in] the

territory of the Member” imposing the measure and that the “service delivered [is] [in] the territory of

the Member [imposing the measure], from the territory of another Member”.40 In this regard, the Panel

in US – Gambling explained that “a market access commitment for mode 1 implies the right for other

WTO Members' suppliers to supply a service through all means of delivery, whether by mail,

telephone, Internet etc., unless otherwise specified in a Member’s GATS Schedule of

Commitments”.41 The Panel in Mexico – Telecoms further clarified that “cross-border supply does not

imply the presence of the service supplier in the market into which the service is delivered”.42

Five reasons lead to the conclusion that the Russian DLR falls under the scope of application of the

GATS. First, the DLR contained in Article 2 of Federal Law 242 of 2014 affects trade in internet

services by requiring the domestic location of the servers containing the databases.43 Second,

several widely used internet service suppliers – like Spotify – are non-resident suppliers in the

Russian Federation and provide services across the Russian border (Mode 1). Third, the supply of

the services originates, for example in the US, while the consumer is located in the Russian

Federation. Fourth, there is no territorial presence of these internet services suppliers in the Russian

34 Appellate Body Report, European Communities - Regime for the Importation, Sale and Distribution of Bananas, WT/DS27/AB/R, adopted 25 September 1997, para. 220. 35 GATS, Article I:2(a). 36 GATS, Article I:2(b). 37 WTO, Guide to reading the GATS schedules of specific commitments and the list of Article II (MFN) exemptions of the WTO, available at: https://www.wto.org/english/tratop_e/serv_e/guide1_e.htm (accessed 21/04/2020). 38 WTO Analytical Index, Article XX (Practice), page 1. 39 Scheduling Guidelines, S/L/92, 28 March 2001, para. 26. 40 Ibid, para. 26, table. 41 Panel Report, United States - Measures Affecting the Cross-Border Supply of Gambling and Betting Services, WT/DS285/R, adopted 20 April 2005, para. 6.285 (“Panel Report, US – Gambling”). 42 Panel Report, Mexico - Measures Affecting Telecommunications Services, WT/DS204/R, adopted 1 June 2004, para. 7.43. 43 Daniel Castro, The False Promise of Data Nationalism, ITIF Working Paper (December 2013).

Page 11: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

11 | 28

Federation, when the service is delivered. Fifth, the service is delivered into the Russian Federation

from a remote location in the US or elsewhere in the world.

Furthermore, Article I:3 of the GATS provides that for the purpose of determining the agreement’s

scope of application, measures by WTO Members include “measures taken by (i) central, regional or

local governments and authorities (…)”. It is well known that constitutional systems can take the form

of a central or a federal state – thus, a measure taken by a federal authority, like the Federal

Assembly of Russia, would also fall within the ambit of the GATS.

The DLR contained in Article 2 of Federal Law 242 of 2014 falls under the scope of application of the

GATS, as these are taken by a WTO Member, and have an effect on the cross-border supply of trade

in internet services where personal data is processed.

IV. LEGALITY, PART II: THE DLR OF ARTICLE 2 OF FEDERAL LAW 242 OF 2014, THE MARKET

ACCESS OBLIGATION OF THE GATS AND THE RUSSIAN FEDERATION’S GATS

SCHEDULE OF COMMITMENTS

The measures contained in Article 2 of Federal Law 242 of 2014 appear to violate the GATS rules

on market access.

Like other WTO agreements, the GATS is anchored in the idea of providing free and fair market

access to foreign suppliers. Unlike the GATT, however, this is a specific obligation under the GATS,

meaning that it applies to only those services and service-sectors in which the Member concerned

has taken up obligations.44 To this end, Article XVI:1 of the GATS, provides that a service supplier

can request market access through any of the modes defined in Article I:2 of the GATS. Under this

provision, WTO Members are required to not maintain measures that accord less favourable

treatment to (like) foreign suppliers of a (like) service,45 subject to the Member’s GATS Schedule of

Commitments. In this sense, it is a “specific expression” of the ‘most favoured nation’ principle in

Article II of the GATS. 46 The Appellate Body in US – Gambling clarified that Article XVI:1 of the GATS

is a link between, on the one hand, the market access commitments undertaken by a Member, and,

on the other, the “terms, limitations and conditions” inscribed in its respective GATS Schedule of

Commitments.47

44 Hoekman, Bernard and Sauve, Pierre, Liberalizing Trade in Services, Discussion Paper No.243 (Washington, D.C.: World Bank, 1994); Mavroidis, Petros, Highway XVI Re-visited: the road from non-discrimination to market access in the GATS,

6 (1) World Trade Review (2007). 45 Cossy, Mireille, Determining “likeness” under the GATS: Squaring the circle?, (Staff Working Paper, ERSD2006-08), available at: https://www.econstor.eu/bitstream/10419/72055/1/518501590.pdf (accessed 22/04/2020); in response, Pauwelyn, Joost, ‘The unbearable lightness of likeness : a comment’ in Panizzon, Pohl and Sauvé (eds.) GATS and the Regulation of International Trade in Services, (Cambridge University Press, 2008). 46 Panel Report, US – Gambling, paras. 6.263 to 6.265. 47 Appellate Body Report, United States - Measures Affecting the Cross-Border Supply of Gambling and Betting Services, WT/DS285/AB/R, adopted 20 April 2005, para. 214 (“Appellate Body Report, US – Gambling”) and: Appellate Body Report,

Page 12: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

12 | 28

Article XVI:2 of the GATS is the ‘operationalizing’ part of the provision. It requires that “in sectors

where market-access commitments are undertaken, the measures which a Member shall not

maintain or adopt (…) unless otherwise specified in its Schedule, are defined as: (a) limitations on

the number of service suppliers whether in the form of numerical quotas, (…) (c) limitations on the

total number of service operations or on the total quantity of service output expressed in terms of

designated numerical units in the form of quotas (…)”. Thus – and it is important to remember – that

even though the entries in WTO Members’ GATS Schedule of Commitments are commonly

expressed in terms of ‘maximum quantitative restrictions’, they are to be considered as minimum

market access guarantees.48

At the outset, the chapeau of Article XVI:2 requires an examination of the commitments undertaken

by a Member, and for this purpose, the Central Product Classification (“CPC”), the structure and

functioning of GATS Schedule of Commitments on Services and the specific Schedule of the Russian

Federation, require consideration.

The CPC constitutes a complete classification covering all goods and services. It serves as an

international standard for assembling and tabulating all kinds of data concerning, inter alia, trade in

services.49 The reason why the CPC used for classification of services under the GATS (as well as

the underlying relationship between the CPC and the GATS) was explained by the Appellate Body

in US – Gambling. The Appellate Body referred to the classification list prepared by the GATT

Secretariat, in document W/50, which explained that the CPC “allows a higher degree of

disaggregation and precision to be attained should it become necessary, at a later stage.” Thus, the

CPC’s level of disaggregation was one of the very reasons it was selected as a basis for a sectoral

classification list. As the CPC is a decimal system, a reference to an aggregate category must be

understood as a reference to all of the constituent parts of that category”.50

According to the CPC version 2.1.51 CPC Section 84 covers the following decimals (sub-sections):

Section 8415: Data transmission services; and

Section 84394: Web search portal content. Includes: content provided on web search portals,

i.e. extensive databases of Internet addresses and content in an easily searchable format.

Canada - Measures Affecting the Importation of Milk and the Exportation of Dairy Products, WT/DS103/AB/R; WT/DS113/AB/R, adopted 27 October 1999, para. 134. 48 Mattoo, Aaditya, ‘National Treatment in the GATS: Cornerstone or Pandora’s Box’, 31 Journal of World Trade, 1997,

pages 1, 107 and 110. 49 United Nations, Department of Economic and Social Affairs, Statistics Division, Central Product Classification (CPC), ST/ESA/STAT/SER.M/77, Version 2.1. 50 Appellate Body Report, US - Gambling, para. 200. For further reading on classification, see: Zhang, Ruosi, Covered or Not: That is the Question - Services Classification and Its Implications for Specific Commitments under the GATS, WTO Working Paper ERSD-2015-11 (2015); Weber, Rolf and Baisch Rainer, Tensions between Developing and Traditional GATS Classifications in IT Markets, 43 Hong Kong Law Journal (2013). 51 Doc. cit. supra 40.

Page 13: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

13 | 28

The Panel in China – Electronic Payments, relying on conclusion of the Appellate Body in US –

Gambling, found that the “definition of “sector of a service” contained in the GATS confirms that a

“sector” may include “any service activity that falls within the scope of the definition of that sector”,

whether or not these activities are explicitly enumerated in the definition of that sector or subsector.52

Furthermore, the concept of “technological neutrality”, which is largely acknowledged amongst WTO

Members,53 implies that where a full market access commitment has been made for Mode 1, a

prohibition on one, several or all means of delivery included in this Mode 1 would be a limitation on

market access for such mode.54 In this vein, the Appellate Body in China – Publications and

Audiovisual Products confirmed that the terms used in China’s GATS Schedule of Commitments

were intentionally broad so as to allow adaption over time.55 Thus, internet services where personal

data is processed can fall within the scope of CPC Section 84.

As is clear from the above, GATS Schedule of Commitments are documents in which WTO Members

identify the service sectors to which they undertake to apply the market access obligations of the

GATS and any exceptions from those obligations they wish to maintain. This has previously been

called a “hybrid approach” to listing commitments, which combines elements of both positive and

negative listing.56 When making a commitment, the WTO Member binds the specified level of market

access (first column) and national treatment (second column) and undertakes not to impose any new

measures that would restrict entry into the market or the operation of the service. Where there are

no limitations on market access or national treatment a sector and mode of supply, the entry reads

NONE. In some situations, a mode of supply may not be technically possible or feasible. In such

cases the entry reads UNBOUND.

The GATS Schedule Commitments of the Russian Federation,57 in its relevant section, reads as

follows:

52 Panel Report, China - Certain Measures Affecting Electronic Payment Services, WT/DS413/R, adopted 31 August 2012, para. 7.179. See also: Ines Willemyns, ‘The GATS (In)Consistency of Barriers to Digital Services Trade’ Working Paper 207 Leuven Centre for Global Governance Studies (2018), footnotes 106. 53 Work Programme on Electronic Commerce – Progress Report to the General Council, adopted by the Council for Trade in Services on 19 July 1999, S/L/74, 27 July 1999. para. 4: "it was also the general view that the GATS is technologically neutral in the sense that it does not contain any provisions that distinguish between the different technological means through which a services may be supplied." The United States seems to agree as is evident from the following comments made by it in a submission contained in WT/GC/16, p. 3: "there should be no question that where market access and national treatment commitments exist, they encompass the delivery of the service through electronic means, in keeping with the principle of technological neutrality". See also: Wunsch Vincent, ‘The Interne, Cross-Border Trae in Services, and

the GATS: Lessons from US – Gambling’ 5 World Trade Review (2006) pages 319, 332. 54 Panel Report, US – Gambling, para. 6.285. 55 Appellate Body Report, China - Measures Affecting Trading Rights and Distribution Services for Certain Publications and Audiovisual Entertainment Products, WT/DS363/AB/R, adopted 19 January 2010, paras. 295 and 296. 56 Delimatsis, Panagiotis, ‘Don’t Gamble with GATS – The Interaction Between Articles VI, XVI, XVII, and XVIII of the GATS in Light of the US – Gambling Case’, 40 Journal of World Trade, 2006, pages 1059 and 1062. 57 World Trade Organization, GATS/SC/149, 5 November 2012, Russian Federation, Schedule of Specific Commitments.

Page 14: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

14 | 28

Clearly, the Russian Federation took up the commitment to grant full market access for services

falling in CPC Section 84 (and thus, consequently, sub-sections 8415 and 84394, supplied through

Mode 1). The Russian Federation is therefore precluded from adopting any limitations on the market

access for services falling under Section 84, whether in the form of numerical quotas, or limitations

on the total number of service operations expressed in terms of designated numerical units in the

form of quotas, amongst others.

At this point it is relevant to explore a question of utmost importance for the present work: it is a

question at the heart of the US – Gambling dispute, and it is as follows: are total prohibitions on the

cross-border supply of services, in respect of which full market access commitments have been

undertaken, covered by the terms “numerical quotas” or “limitations on the total number of services

operations”? In effect, can a “zero quota” be covered by the rules contained in Article XVI:2(a) of the

GATS? We find, on this issue, in the affirmative; our reasoning is as follows.

As may be recalled, the Appellate Body in US – Gambling clarified the meaning of the terms

contained in Article XVI:2(a) of the GATS, thereby defining its scope.58 Following an analysis of the

ordinary meaning of the terms “quota” and “numerical”, the Appellate Body concluded that “a

“numerical quota” within Article XVI:2(a) appears to mean a quantitative limit on the number of service

suppliers”. The fact that the word “numerical” encompasses things which “have the characteristics of

a number” suggests that limitations “in the form of a numerical quota” would encompass limitations

which, even if not in themselves a number, have the characteristics of a number. Because zero is

quantitative in nature, it can, in our view, be deemed to have the “characteristics of” a number. That

is, to be “numerical”.59

Furthermore, the Appellate Body attached significance to the quantitative nature of the limitations,

rather than their numerical form. According to the Appellate Body, Article XVI:2(a) of the GATS covers

measures which have the characteristics of a number even if not expressed in numerical terms. It

concluded, then, that given the numerical nature of zero, total prohibitions on the cross-border supply

of a service are covered by the term “numerical quotas”.60 This is especially sensible as some

scholars have pointed out that, given first that the Panel in US – Gambling drove a wedge between

58 Ortino, Federico, Treaty Interpretation and the WTO Appellate Body Report in US-Gambling: A Critique, 1 (9) Journal of International Economic Law (2006); Kilby, Mitchell, The Mouse That Roared: Implications of the WTO Ruling in US–Gambling, 44 (1/2) Texas International Law Journal (2008). 59 Appellate Body Report, US – Gambling, para. 227. 60 Ibid.

Page 15: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

15 | 28

Articles XVI and VI of the GATS,61 and given that the latter concerns qualitative restrictions, the

former must capture even those measures that are – as we will see later – ‘in effect’ quantitative.62

The reasoning also finds support in the 1993, now 2001, Scheduling Guidelines which use the

example of a nationality requirement equivalent to a zero quota.63 Leroux argues that “[o]n its face,

a citizenship requirement has, in a trade context, no other purpose than to be an arbitrary trade

measure limiting the number of foreign service suppliers to zero. In other words, such a measure has

the same effect and rationale (or absence thereof) as a quota”.64

The WTO adjudicator has to be commended for preventing an absurd interpretative result.65 The

Appellate Body found the reasoning of the Panel that “the fact that the terminology [of Article XVI:2(a)]

embraces lesser limitations, in the form of quotas greater than zero, cannot warrant the conclusion

that it does not embrace a greater limitation amounting to zero”66 persuasive. A zero quota is,

perhaps, the most trade restrictive measure a WTO Member can adopt. Therefore, if under Article

XVI:2(a) of the GATS a WTO Member is precluded from adopting quotas greater than zero – i.e.

lesser limitations – it is, consequently, also prevented from adopting more trade restrictive measures

– i.e. zero quotas. This understanding of Article XVI:2(a) of the GATS conforms with the principle of

effective treaty interpretation, according to which “interpretation must give meaning and effect to all

the terms of the treaty. An interpreter is not free to adopt a reading that would result in reducing whole

clauses or paragraphs of a treaty to redundancy or inutility”.67

Ultimately, the Appellate Body developed an “effect test”.68 Under such a test, if a measure has the

effect of establishing a numerical quota, its form has no relevance in its assimilation under Article

XVI:2(a). This makes sense since the measures stipulated in the relevant provision are more matters

of ‘effect’ than ‘form’, in any case. This is definitively confirmed by taking stock of the relevant context

of the provision – the definitions of related terms found elsewhere in the GATS.69 For example, Article

XXVIII (h) defines ‘monopoly supplier of service’ as any person (public or private) which is authorized

or established formally or in effect. Article VIII:5, furthermore, provides that the provision shall apply

to a situation where a Member establishes or authorizes a monopoly formally or in effect.70

This understanding of Article XVI:2(a) of the GATS has found resonation in recent disputes as well.

Indeed, in EU – Energy Package the Russian Federation argued that, when deciding whether a WTO

61 Panel Report, US - Gambling, 6.305; this finding was not reassessed by the AB. 62 See Pauwelyn in Doc. cit. supra 13. 63 Scheduling Guidelines, Doc. cit. supra 38, para. 12. 64 Eric H. Leroux, Eleven years of GATS Case Law: What have we learned?, 10 (4) Journal of International Economic Law (2007). 65 Manning, John, The Absurdity Doctrine, 116 (8) Harvard Law Review (2003). 66 Appellate Body Report, US – Gambling, para. 234. 67 Appellate Body Report, United States - Standards for Reformulated and Conventional Gasoline, WT/DS2/AB/R, adopted 20 May 1996, page 23. 68 Appellate Body Report, US – Gambling, para. 230. 69 See Van Den Hende, ‘GATS Article XVI and National Regulatory Sovereignty: What Lessons to draw from US-Gambling’ in (Alexander and Andenas eds.) The World Trade Organization and Trade in Services (2008), particularly page 441. 70 Ortino Doc. cit. supra 56, page 19.

Page 16: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

16 | 28

Member maintains any of the four types of quantitative limitations on the number of suppliers listed

in Article XVI:2(a), consideration should be given to the substance and effect of a challenged

measure, rather than merely its formal construction.71 In this same dispute, the Panel, referring to a

finding by the Appellate Body in China – Electronic Payment Services, concluded that “when

assessing the consistency of a measure with Article XVI:2(a) of the GATS, the focus must be on

whether the measure at issue “constitute[s] a limitation that is numerical and quantitative in nature”

or acts “as a quota would do”, and not on whether it “formally or explicitly institute[s]”72 a limitation on

the number of service suppliers.73

As a short digression it is pertinent to note that DLRs, depending on their specific structuring- may

even be captured by the terms “monopoly”; “exclusive service suppliers”; or “requirements of an

economic needs test”, as found in Article XVI: 2(a). Context for the first two terms can be found in

Article VIII:5 of the GATS.74 A “monopoly” is defined broadly as any entity that is authorized – formally

or in effect – to be the sole supplier of a service in a market.75 Similarly, “exclusive service suppliers”

are “a small number of suppliers” who are authorized to provide a service, which in turn, “substantially

prevents competition among …suppliers”.76 At the core, it would seem that the drafters intended to

disallow restrictions which would reduce the amount of market access and competitiveness in a given

sector, which is exactly what DLRs do. Finally, though defying a particular definition, the concept of

“economic needs test” (“ENT”) has been mentioned in a Note by the Secretariat (Council for Trade

in Services).77A perusal of the kind of scheduled ENTs shows that DLRs can definitely be argued to

fall within the term’s ambit.78 Thus, while further, pinpoint research in this area is required, the authors

are of the opinion that, in addition to ‘zero-quotas’, DLRs can also be captured in Article XVI:2(a).

Turning now to Article XVI:2(c) of the GATS, the Appellate Body in US – Gambling clarified that

“where a specific commitment has been undertaken in respect of a service, a measure prohibiting

one or more means of delivery of that service is: ... a limitation “on the total number of service

operations or on the total quantity of service output ... in the form of quotas” within the meaning of

Article XVI:2(c) because it ... results in a “zero quota” on one or more or all means of delivery

include[d] in mode 1”.79 The Appellate Body was clear in explaining that “it does not follow that sub-

paragraph (c) would not catch a measure equivalent to a zero quota”. Accordingly, zero quotas are

71 Panel Report, European Union and its Member States – Certain Measures Relating to the Energy Sector, WT/DS476/R, adopted 10 August 2018, para. 7.594, (“Panel Report, EU – Energy Package”) citing the Russian Federation's first written

submission, para. 210; and its second written submission, para. 109. 72 Panel Report, EU – Energy Package, para. 7.599. 73 Pogoretskyy, Vitaliy and Talus, Kim, The WTO Panel Report in EU–Energy Package and Its Implications for the EU's Gas Market and Energy Security, World Trade Review (2019). 74 Panel Report, China – Electronic Payments Services, paras. 7.585 to 7.587. 75 Appellate Body Report, US – Gambling, para. 228. 76 Panel Report, China – Electronic Payments Services, paras. 7.585 to 7.587. 77 Note by the Secretariat: Economic Needs Tests, Council for Trade in Services, Special Session, S/CSS/W/118 (30

November 2001). 78 Note by the Secretariat: Economic Needs Tests, Council for Trade in Services, Special Session, S/CSS/W/118/Add.1 (16 April 2010). 79 Appellate Body Report, US – Gambling, para. 241.

Page 17: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

17 | 28

covered by the scope of Article XVI:2(c) of the GATS. The Appellate Body cautioned that a narrow

interpretation of Article XVI:2(c) of the GATS would imply that limitations that contain an express

reference to numbered units could be the only type falling under the scope of this provision, leaving

outside its scope a limitation expressed as a percentage or described using words such as “a

majority”.80 The Appellate Body concluded that it was satisfied with the idea that “a prohibition on the

supply of services in respect of which a full market access commitment has been undertaken is a

quantitative limitation on the supply of such services”.81

Four reasons lead to the conclusion that the Russian DLR violates the GATS market access

obligations. First, Article 2 of Federal Law 242 of 2014 mandates that providers of internet services

which process personal data of Russian citizens must have their servers located in the territory of

the Russian Federation. Second, the Russian Federation did not schedule any limitations of the

supply of internet services where personal data of Russian citizens is processed. Third, although the

DLR contained in Article 2 of Federal Law 242 of 2014 is not expressed in a numerical form, it has

the effect of reducing the amount of cross-border internet services and service suppliers

where personal data of Russian citizens is processed, to zero. Following the implementation of

the measure, suppliers of internet services which process personal data of Russian citizens are

required to have a physical presence in the Russian territory. Fourth, following the example of the

Panel is US – Gambling, which took recourse to the 1994 version of the Scheduling Guidelines,

Article 2 of Federal Law 242 of 2014 sets up a nationality requirement that reduces the number of

cross-border internet services where personal data of Russian citizens is processed to zero.

A logical reading of the text of Article XVI:2(a) and (c) of the GATS leads to the conclusion that

prohibiting limitations in the form of quotas greater than zero but allowing the imposition of a limitation

amounting to zero would reduce to provisions of Article XVI:2(a) and (c) of the GATS to nullity based

on an absurd interpretation.

Thus, it can concluded that Article 2 of Federal Law 242 of 2014 violates the market access

obligations present in Articles XVI:2(a) and XVI:2 (c) of the GATS read together with the Russian

Federation’s GATS Schedule of Commitments.

V. DEFENCE, PART I: THE DLR OF ARTICLE 2 OF FEDERAL LAW 242 OF 2014 AND ARTICLE

XIV OF THE GATS

A measure found to be inconsistent with the substantive provisions of the GATS can be justified

under Article XIV of the GATS if they pursue one of the objectives contained therein, such as, the

80 Appellate Body Report, US – Gambling, para. 250. 81 Ibid.

Page 18: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

18 | 28

protection of public morals, the maintenance of public order or the protection of privacy and

confidentiality while processing personal data.

As explained by the Appellate Body, the GATS seeks to achieve the objective of liberalizing trade in

services, while preserving space for WTO Members to regulate for legitimate regulatory purposes.82

To this end, Articles XIV(a) and XIV(c) allow WTO Members to restrict trade in services in order to

protect “public morals”; to “maintain public order”; or when it is “necessary to secure compliance with

laws or regulations which are not inconsistent with the provisions of this Agreement including those

relating to the protection of the privacy of individuals in relation to the processing and dissemination

of personal data and the protection of confidentiality of individual records and accounts”. This

allowance is tempered with the requirement – discussed below – that these restrictions not be applied

in a discriminatory manner, or in a manner that would constitute a disguised restriction on trade. Here

we contend that the Russian Federation cannot avail itself of any of these provisions.

In terms of legal analysis, the Appellate Body in US – Gambling explained that in order to justify an

otherwise GATS-inconsistent measure, the recourse to Article XIV must be judged on the mantle of

a two-tier test.83 A panel should first determine whether the challenged measure falls under the scope

of one of the paragraphs of Article XIV. In order to do this, the challenged measure must address the

particular interest specified in that paragraph and there must be a ‘sufficient nexus’ between the

measure and the interest protected. The required nexus or “degree of connection” between the

measure and the interest is specified in the language of the paragraphs themselves, through the use

of terms such as “necessary” or “relating to”. Where the challenged measure has been found to fall

within one of the paragraphs of Article XIV, a panel should then consider whether that measure

satisfies the requirements of the chapeau of Article XIV”.84

Pursuant to the order of analysis suggested by the Appellate Body, the requirements each of Article

XIV(a) and Article XIV(c)(ii) of the GATS will be analysed first.

1. Article XIV(a) of the GATS

Article XIV(a) of the GATS allows WTO Members to impose GATS inconsistent measures which are

necessary to protect public morals or to maintain public order. Footnote (5) of Article XIV(a) of the

GATS provides that the public order exception may be invoked only where a “genuine and sufficiently

serious threat” is posed to one of the fundamental interests of society.85 At the outset, the authors

82 D. Mitchell, Andrew and Ayres, Glyn, ‘General and Security Exceptions Under the GATT and the GATS’ in Carr et. al. (eds.) International Trade Law and WTO (Federation Press, 2012). 83 Appellate Body Report, US – Gambling, para. 292. More recently: Panel Report, Argentina - Measures Relating to Trade in Goods and Services, WT/DS453/AB/R, adopted 9 May 2016 para. 7.586. 84 Ibid. 85 GATS, Article XIV, footnote 5.

Page 19: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

19 | 28

submit that there appears to be no genuine and sufficiently serious threat posed against one of the

fundamental interests of Russian society in the sense of footnote (5) of Article XIV(a) of the GATS.

According to the Panel in US – Gambling, in order to determine if a measure complies with Article

XIV(a) of the GATS, two cumulative requirements must be satisfied: the measure must be ‘designed’

to protect public morals or to maintain public order, and that the measure must meet the standards

of the ‘necessity test’ as developed by past WTO decisions.86

The terms “public morals” and “public order” have been defined as sensitive topics in WTO

precedents.87 The Panel in US – Gambling, in a finding not reviewed by the Appellate Body, explained

that “the content of these concepts for Members can vary in time and space, depending upon a range

of factors, including prevailing social, cultural, ethical and religious values. Further, the Appellate

Body has stated on several occasions that WTO Members, in applying similar societal concepts,

have the right to determine the level of protection that they consider appropriate. (…) More

particularly, WTO Members should be given some scope to define and apply for themselves the

concepts of “public morals” and ‘public order’ in their respective territories, according to their own

systems and scales of values”.88

Given the extensive margin of discretion that WTO Members enjoy in defining the scope of the

concepts of “public morals” and “public order”, the authors will not go further in the analysis of this

requirement. Suffice to note that the result of the report of the Panel in Brazil – Taxation is that that

almost anything can now be considered to be a public moral. In fact, the trouble began even earlier

when the Appellate Body in EC – Seals ruled that a WTO Member was not required to “determine

the exact content of a public moral at issue”,89 making the provision ‘self-judging’.90 In any case,

however, due to the cumulative nature of the conditions set out in Article XIV(a) of the GATS, failing

to satisfy the requirements of the necessity test will, result in a lack of compliance with Article XIV(a)

of the GATS either way.

The necessity test of WTO law has been often described as a process of weighing and balancing of

elements.91 The test – which in our view does not differ from the ponderation test set by Robert

86 Panel Report, US – Gambling, para. 6.455. 87 Delimatsis, Panagiotis, Protecting Public Morals in a Digital Age: Revisiting the WTO Rulings on US – Gambling and China – Publications and Audiovisual Products, 14 (2) Journal of International Economic Law (2011); see further: Wu, Mark, Free Trade and the Protection of Public Morals: An Analysis of Newly Emerging Public Morals Doctrine, 33 Yale Journal of International Law (2008); and Marwell, Jeremy, Trade and Morality: The WTO Public Morals Exception after Gambling, 81 NYU Law Review (2006). 88 Panel Report, US – Gambling, para. 6.461. 89 Appellate Body Report, European Communities - Measures Prohibiting the Importation and Marketing of Seal Products, WT/DS400/AB/R; WT/DS401/AB/R, adopted 16 June 2014, para. 5.199. 90 Conconi, Paola and Voon, Tania, EC – Seal Products: The Tension between Public Morals and International Trade Agreements, 15 (2) World Trade Review (2016). 91 Appellate Body Report, Korea - Measures Affecting Imports of Fresh, Chilled and Frozen Beef, WT/DS161/AB/R; WT/DS169/AB/R, adopted 10 January 2001, para 164 and for further details: Salinas Alcaraz, Isabel Cristina, ‘The concept of necessity under the GATT and national regulatory autonomy’, Revista Virtual Via Inveniendi et Iudicandi, 2015. For a recent critical take on the subject, see: Nagy, Csongor István, Clash of Trade and National Public Interest in WTO Law:

Page 20: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

20 | 28

Alexy92 – involves pondering the following elements: a review of the relative importance of the

interests pursued by the challenged measure, the contribution of the measure to the realization of

the ends pursued by it, a (genuine) relationship between the means and ends, between the measure

and the policy objective is essential, the trade restrictiveness of the measure and a comparison

between the measure and possible alternatives reasonably available to the WTO Member imposing

the measure.93 There are, in our view, four reasons why the Russian DLR does meet the conditions

of the necessity test.

First, the stated purpose of Article 2 of Federal Law 152 of 2006 is the protection of the rights and

liberties of a person while processing their personal data, including the right to privacy, personal and

family secrecy. Now, it is widely accepted that since their establishment, State authorities have been

created with the purpose of protecting the fundamental rights of people.94 Modern constitutions, such

as the Constitution of the Russian Federation, have a first chapter comprising of a charter of

Fundamental Rights which must be observed, recognized and protected by the State.95 The right to

the inviolability of private life, personal and family secrets is recognized in the Russian legal system

as a right of men and citizens.96 And it is understandably, to some extent, that the free flow of data

across borders has the effect of undermining data protection and that WTO Members would like to

take DLRs to safeguards fundamental rights. In this sense, as concluded by Mishra, due to the

strategic importance of protecting privacy and cybersecurity, including the enormous risks associated

with failing to provide for these frameworks in a digitalized economy, WTO panels are likely to accord

very high priority to these objectives in a data localization-related trade dispute.97

Second, however, there is abundant technical evidence and scientific literature98 which questions the

ability (i.e. effectiveness) of DLRs in contributing to the protection of the right to privacy, personal and

family secrecy. Hon explains that DLRs do not reduce network vulnerabilities such as cyber-attacks,

The Illusion of ‘Weighing and Balancing’ and the Theory of Reservation, 23 Journal of International Economic Law (2020), finding that while the test reached the status of a “settled decisional mantra”, the AB has not yet truly engaged with the test, see: pages 150 onwards. 92 Alexy, Robert, A Theory of Constitutional Rights, Centro de Estudios Políticos y Constitucionales, Madrid 2002, page 95 (Version in Spanish). 93 Appellate Body Report, US – Gambling, paras. 304 to 307. 94 Hobbes, Thomas, Leviathan, Wordsworth Classics of Literature, Hertfordshire 2014, page 136. 95 Constitution of the Russian Federation, Article 2 provides: “man, his rights and freedoms are the supreme value. The recognition, observance and protection of the rights and freedoms of man and citizen shall be the obligation of the State”. 96 Constitution of the Russian Federation, Article 23. 97 Doc. cit. supra 5. 98 Maurer et al., ‘Technological Sovereignty: Missing the Point?’, in M. Maybaum et al. (eds.), Architectures in Cyberspace, NATO CCD COE Publications, 2015, pages 53, 61–62; Cory, Nigel, ‘Cross-Border Data Flows: Where Are the Barriers and What Do They Cost?’, Information Technology and Innovation Foundation, 2017, pages 3 and 4; Komaitis, Konstantinos, ‘The “Wicked Problem” of Data Localization’, Journal of Cyber Policy, 2017, pages 361 and 362; United States International Trade Commission, ‘Global Digital Trade 1: Market Opportunities and Key Foreign Trade Restrictions’, Publication no. 4716, Investigation no., 2017, pages 332 to 561; Ahmed, Usman and Chander, Anupam, ‘Information Goes Global: Protecting Privacy, Security, and the New Economy in a World of Cross-border Data Flows’, International Centre for Trade and Sustainable Development and World Economic Forum, 2015, pages 6 and 7.

Page 21: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

21 | 28

vulnerability to natural disasters or data fraud.99 Indeed, as Ryan highlights, DLRs actually makes

data less secure as it becomes concentrated in specific servers, and, therefore, an easier target for

cyberattacks and surveillance.100 In this sense, guaranteeing security and privacy of data, while a

laudable objective, is not contingent upon the location of the data but rather on the technical protocols

and mechanisms for the protection of the servers. It seems that DLRs do not contribute to the

protection of the rights and liberties of a person, including the right to privacy, personal and family

secrecy, while processing personal data.

Third, DLRs are widely known to disrupt various activities in the global supply chain and increase

compliance costs for foreign service providers and reduce market access.101 These type of trade

restrictive measures affect the ‘production, distribution, marketing, sale and delivery’ of various

internet and internet-enabled services as provided for by the GATS. DLRs that take the form of zero

quotas for market access are the most trade restrictive alternative that a WTO member can adopt.

As the Appellate Body found in the Brazil – Retreated Tyres dispute, an import ban (that is analogous

to a zero quota) is “as trade-restrictive as can be”.102

Fourth, and very significantly, there exist a wide range of less trade restrictive alternatives that are

reasonably available to WTO Members that wish to achieve data and privacy protection. For

example, providers could be held accountable for the compliance with domestic data protection laws.

This accountability obligation could be extended in the event of a breach of security. WTO Members

have instruments such as privacy trustmarks or self-certification mechanisms like the APEC Cross-

border Privacy System available.103 Even the measures contained in Chapter V of the GDPR

concerning: transfers based on adequacy decisions,104 transfers subject to appropriate

safeguards,105 and requiring the implementation of binding corporate rules106 stand as less trade

restrictive alternatives to DLRs. These are “reasonably available” to WTO Members considering that

it has previously been held that “administrative difficulties” do not automatically make an alternative

reasonably available.107

In brief, we agree with Blume, that DLRs are simply not necessary for the protection of privacy.108

99 Hon et al., ‘Policy, Legal and Regulatory Implications of a Europe-only Cloud’, International Journal of Law and Information Technology, 2016, pages 251 to 262. 100 S. Ryan et al., ‘When the Cloud Goes Local: The Global Problem with Data Localization’, SSRN, 2013, pages 54 to 59. 101 M. Bauer et al., ‘The Costs of Data Localisation: Friendly Fire on Economic Recovery’, ECIPE Occasional Paper 3/2014, 2014, page 10. 102 Appellate Body Report, Brazil — Measures Affecting Imports of Retreaded Tyres, WT/DS332/AB/R, adopted 3

December 2007, para. 150. 103 APEC Cross-Border Privacy Rules System, www.cbprs.org. 104 GDPR, Article 45. 105 GDPR, Article 46. 106 GDPR, Article 47. 107 Panel Report, US – Gasoline, paras 6.26 to 6.28 (not appealed). See further: Appellate Body Report, EC – Asbestos, paras. 170 to 172. 108 Doc. cit. supra 2.

Page 22: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

22 | 28

2. Article XIV XIV(c)(ii) of the GATS

According to Article XIV(c)(ii) of the GATS, WTO Members are allowed to impose GATS inconsistent

measures which are necessary to secure compliance with laws or regulation which are not

inconsistent with the GATS, including those relating to the protection of the privacy of individuals in

relation to the processing of personal data and the protection of confidentiality. The Panel in US –

Gambling determined that, in order to establish compliance with the provision, a three-level analysis

must be performed: the measure must be ‘designed’ to secure compliance with national law, such

national law must not be inconsistent with WTO law and the measure must be necessary to secure

compliance with this national law.109 Our view against any possible invocation of this provision by the

Russian Federation is set out below.

First, Article 2 of Federal Law 242 of 2014 contains an additional requirement for processors of

personal data under Russian law. The Appellate Body in Mexico – Taxes on Soft Drinks explained

that the obligation of securing compliance, rather than being an obligation of result, is an obligation

of means. In other words, while an obligation of result is directed at guaranteeing the attainment of a

specific outcome, an obligation of means consists of the employment of the duty of care in performing

an obligation. In the words of the Appellate Body “a measure can be said to be designed “to secure

compliance” even if the measure cannot be guaranteed to achieve its result with absolute

certainty”.110 To this end, WTO Members tend to believe that domestic laws and regulations can be

enforced with more ease when data resides in local servers.111 Therefore, by imposing a new

obligation for processors of personal data according to which servers containing the data bases must

the located in Russia, the Russian Federation could argue that it is employing all means necessary

to secure compliance with its data protection legislation. However, it is not under an obligation to

achieve this result with absolute certainty. Thus, we accept that Article 2 of Federal Law 242 of 2014

could be considered to be ‘designed’ to secure compliance with the rules contained in Federal Law

152 of 2006 on data protection.

Second, and as a related point, the Appellate Body has a practice of presuming the WTO consistency

of the national measures of a WTO Member until proven otherwise.112 Considering this presumption

of WTO consistency and that Federal Law 152 of 2006 has so far not been declared inconsistent with

WTO law, it can be concluded that the second requirement of the test of Article XIV(c)(ii) of the GATS

is met.

109 Panel Report, US – Gambling, para. 6.536. 110 Appellate Body Report, Mexico - Tax Measures on Soft Drinks and Other Beverages, WT/DS308/AB/R, adopted 24 March 2006, para. 74. 111 Peng, Shin-yi and Liu, Han-wei, ‘The Legality of Data Residency Requirements: How Can the Trans-Pacific Partnership Help?’, Journal of World Trade, 2017, pages 183 and 199. 112 Appellate Body Report, United States - Countervailing Duties on Certain Corrosion-Resistant Carbon Steel Flat Products from Germany, WT/DS213/AB/R, adopted 19 December 2002, para. 157; Appellate Body Report, Dominican Republic - Measures Affecting the Importation and Internal Sale of Cigarettes, WT/DS302/AB/R, adopted 19 May 2005, para. 111; and Appellate Body Report, US – Gambling, para. 138.

Page 23: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

23 | 28

Third, it is the necessity test, as explained in Section V.1 above, that the DLR contained in Article 2

of Federal Law 242 of 2014 fails to meet the requirements of the GATS and, therefore, cannot be

justified under the exception contained in Article XIV(c)(ii) of the GATS.

3. The chapeau of Article XIV of the GATS

The final element of the GATS’ exception clause is the chapeau test, which has been inserted to

prevent an abuse of the exceptions for protectionist purposes.113 It is important to remember that the

Appellate Body in US – Shrimp found that the chapeau ensures that the exceptions are utilized and

implemented in ‘good faith’.114

The chapeau requires comparison of the conditions existing in the two countries at issue. Thus, the

internet regulatory conditions between the WTO Member imposing the DLRs and the WTO Member

where the data is processed must be compared. The Global Cybersecurity Index115 is useful for the

purpose of this analysis. In its third – and latest – edition,116 the Russian Federation was not ranked

within the top ten countries most committed to cybersecurity. Moreover, as Mishra points out, the

Russian government seems to be enacting a considerable amount of domestic laws that allegedly

authorize its institutions to intrude on the privacy of its residents in an unreasonable manner.117 This

is clearly not in good faith as it is inconsistent with its stated objective of protecting privacy of its

citizens.

Furthermore, Article 12.1 of Federal Law 152 of 2006 provides for an automatic transfer of data to

countries that are parties to the Strasbourg Convention for the Protection of Individuals with Regard

to Automatic Processing of Personal Data of 2005 (“Strasbourg Convention”) waiving, therefore, the

DLR contained in Article 2 of Federal Law 242 of 2014 for these countries. None of the parties to the

Strasbourg Convention occupy a higher ranking in the latest version of the Global Cybersecurity

Index than, for example, the United States where Google’s and most of Spotify’s servers are located.

113 Appellate Body Report, US – Gasoline, page. 22; explained further in: Appellate Body Report, US – Shrimp, para. 156. For further reading, see: Bartels, Lorand, The Chapeau of the General Exceptions in the WTO GATT and GATS Agreements: A Reconstruction, 109 (1) American Journal of International Law (2015). 114 Appellate Body Report, United States - Import Prohibition of Certain Shrimp and Shrimp Products, WT/DS58/AB/R, adopted 6 November 1998, para. 158. 115 Global Cybersecurity Index, available at: https://www.itu.int/en/ITU-D/Cybersecurity/Pages/global-cybersecurity-index.aspx. 116 Third Edition of the Global Cybersecurity Index, available at: https://news.itu.int/cgi-2019-released/ 117 Domestic companies such as domestic online communication providers and internet platforms can track user details and activity (Federal Law no. 149 on Information, Information Technologies and Protection of Information, 2006 (Russia), Art. 10.1.3, 10.2.9. Further, the System of Operational Investigatory Measures authorises various government agencies to collect communications data and metadata, including from social media platforms, even prior to receiving a warrant. See N. Marachel, ‘Networked Authoritarianism and the Geopolitics of Information: Understanding Russian Internet Policy’ 5 (1) Media & Communication (2017), 29, 33. Further, it has also been reported that the Ministry of Communications requires that all digital products to install equipment to facilitate a dragnet Deep Packet Inspection surveillance system. See A. Soloatov and I. Borogoan, ‘The Kremlin’s New Internet Surveillance Plan Goes Live Today’, The Wired (11 January 2012), www.wired. com/2012/11/russia-surveillance/;. Finally, the Federal Security Service can set standards for encryption of personal data, enabling state surveillance.

Page 24: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

24 | 28

According to the findings and conclusions of the Global Cybersecurity Index – an international and

independent ranking institution – the internet regulatory conditions in the Russian Federation seem

not to guarantee privacy and cyber-security better than other countries listed in the top ten countries

most committed to cybersecurity. This means that the DLR contained in Article 2 of Federal Law 242

of 2014 constitutes an ‘unjustifiable discrimination’.118 Moreover, the fact that this DLR is not imposed

against countries that do not guarantee privacy and cyber-security as properly as the US, renders

that the discrimination is, not only unjustifiable but also, arbitrary.119 The Appellate Body has

explained that to make such a determination, the adjudicator must look at the “cause or rationale of

[such] discrimination”.120 Such illogical application of measures to different (individual or sets) of

countries has already been ruled as inconsistent with the chapeau in Argentina – Financial

Services.121

The DLR contained in Article 2 of Federal Law 242 of 2014 cannot be justified under Article XIV(a)

and Article XIV(c)(ii) of the GATS as it fails to meet the requirements of the WTO necessity test and

of the chapeau of Article XIV of the GATS.

VI. DEFENCE, PART II: THE DLR OF ARTICLE 2 OF FEDERAL LAW 242 OF 2014 AND ARTICLE

XIVBIS OF THE GATS

The DLR contained in Article 2 of Federal Law 242 of 2014 cannot be justified, either, under Article

XIVbis of the GATS.

Article XIVbis of the GATS allows derogation from trade rules for the “protection of its essential

security interests taken in time of war or other emergency in international relations”122 or to “prevent

any Member from taking any action in pursuance of its obligations under the United Nations Charter

for the maintenance of international peace and security”.123

The epoch-setting ruling by the Panel in Russia – Traffic in Transit was the first WTO ruling on the

meaning of the terms of the provision.124 Given that WTO panels and the Appellate Body have relied

on the interpretation of GATT provisions to clarify the meaning of GATS law,125the interpretation of

118 Panel Report, Argentina – Financial Services, para. 7.761. 119 Appellate Body Report, US – Shrimp, para. 150. 120 Panel Report, EU – Energy Package, para. 7.1244. 121 Doc. cit. supra 115. 122 GATS, Article XIV bis(b)(iii). 123 GATS, Article XIV bis(c). 124 Weiß, Wolfgang, ‘Interpreting Essential Security Exceptions in WTO Law in View of Economic Security Interests’ in Weiß and Furculita (Eds.) Global Politics and EU Trade Policy (Springer, 2020); Prazeres, Tatiana Lacerda, Trade and National Security: Rising Risks for the WTO, 19 (1) World Trade Review (2020); Voon, Tania, The Security Exception in WTO Law: Entering a New Era, 113 AJIL Unbound (2019). 125 Appellate Body Report, US – Gambling, para. 305.

Page 25: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

25 | 28

Article XXI(b)(iii) of the GATT by the Panel in Russia – Traffic in Transit will inform the meaning of

Article XIVbis(b)(iii) of the GATS.

At the outset, the Panel found that it had jurisdiction to review a justification under Article XXI(b)(iii)

of the GATT [Article XIVbis(b)(iii) of the GATS].126 Further, it interpreted the phrase “essential security

interests” in the chapeau of Article XXI(b) of the GATT [Article XIVbis(b) of the GATS] as referring to

“those interests relating to the quintessential functions of the state, namely, the protection of its

territory and its population from external threats, and the maintenance of law and public order

internally”.127 Although WTO Members enjoy discretion for designating concerns as essential security

interests, such discretion is limited by its obligation to interpret and apply Article XXI(b)(iii) of the

GATT [Article XIVbis(b)(iii) of the GATS] in bona fide.128 Consequently, the Security Exceptions of

the GATT and [of the GATS] may not be used to circumvent WTO Members’ obligations under GATT

[GATS]. Such would be the case if a WTO Member re-labels trade interests which it had previously

agreed to protect and promote, within the multilateral trading system, as essential security

interests.129 For that reason, the Panel added that a WTO Member invoking Article XXI(b) of the

GATT [Article XIVbis of the GATS] must “articulate the essential security interests said to arise from

the emergency in international relations sufficiently enough to demonstrate their veracity”.130 In that

regard, the concept of sufficiency will depend on the nature of the emergency in international relations

at issue.131

According to the Panel, the phrase “taken in time of war or other emergency in international relations”

implies that the action taken must be during the war or other emergency in international relations –

which is an objective fact subject to objective determination.132 The Panel interpreted a “war” to refer

to (international or non-international) armed conflicts and to be one example of a type of “emergency

in international relations”.133 Pursuant to the Panel, the phrase “emergency in international relations”

must be understood as eliciting both defence and military interests and maintenance of law and public

order interests.134 The Panel signalled that policy, political or economic differences between WTO

Members, even if considered urgent or serious in a political sentence, do not constitute an emergency

in international relations..135 Rather, such concept refers “generally to a situation of armed conflict, or

of latent armed conflict, or of heightened tension or crisis, or of general instability engulfing or

surrounding a state”.136

126 Panel Report, Russia - Measures Concerning Traffic in Transit, WT/DS512/R, adopted 26 April 2019, para. 7.104 (“Panel Report, Russia – Traffic in Transit”). 127 Panel Report, Russia – Traffic in Transit, para. 7.130. 128 Panel Report, Russia – Traffic in Transit, para. 7.132. 129 Panel Report, Russia – Traffic in Transit, para. 7.133. 130 Panel Report, Russia – Traffic in Transit, para. 7.134. 131 Panel Report, Russia – Traffic in Transit, para. 7.135. 132 Panel Report, Russia – Traffic in Transit, paras. 7.70 and 7.71. 133 Panel Report, Russia – Traffic in Transit, para. 7.72. 134 Panel Report, Russia – Traffic in Transit, para. 7.74. 135 Panel Report, Russia – Traffic in Transit, para. 7.75. 136 Panel Report, Russia – Traffic in Transit, para. 7.76.

Page 26: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

26 | 28

Thus, the Russian Federation may attempt to argue that the protection of the rights and liberties of a

person while processing their personal data, including the right to privacy, personal and family

secrecy are part of the quintessential functions of the State, as it is seeking the maintenance of law

and public order internally. However, these measure needs to be taken in time of war or other

emergency in international relations. The Panel was clear in highlighting those political differences

between WTO Members, even if considered serious in a political context, do not constitute an

emergency in international relations. Therefore, policy measures for guaranteeing privacy and cyber-

security such as DLRs are not covered by the concept of “emergency in international relations” and

are consequently, they are not covered by the concept of ‘war’, either. The DLR contained in Article

2 of Federal Law 242 of 2014 thus does not meet the requirements of Article XIVbis (b)(iii) of the

GATS and cannot be justified under this provision.

The Russian Federation could also attempt to argue that Article 2 of Federal Law 242 of 2014 is a

measure taken pursuing its obligations under the United Nations Charter for the maintenance of

security. Neither Article XIVbis(c) of the GATS or Article XXI(c) of the GATT have been interpreted

in WTO precedents. Although the protection of privacy and personal data are considered

fundamental rights in a wide array of jurisdiction, there seems to be no direct link between the

protection of privacy and personal data and the maintenance of international peace and security.

In light of the above, the DLR of Article 2 of Federal Law 242 of 2014 cannot be justified, either, under

Article XIVbis of the GATS as it fails to meet its requirements as explained by previous WTO

decisions.

VII. CONCLUSIONS

This article has taken up a comprehensive assessment of the landscape of legal issues that DLRs

are facing with. The article defines DLRs as measures imposed by countries that require the

processing of personal data to be conducted in their territories. It takes the specific example of Article

2 of Federal Law of 242 of 2014, which imposes the obligation on controllers of personal data to have

their data bases located in the territory of the Russian Federation when conducting all activities

related to processing of personal data of Russian citizens done by means of the internet. We

conclude therefore that this measure is a DLR.

Further, since it affects cross-border supply of trade in internet services, we find that the measure

falls under the scope of application of the GATS.

Internet services where personal data is processed, are covered by CPC Section 84 and sub-sections

8415 and 84394. The GATS Schedule Commitments of the Russian Federation reads that the

Russian Federation undertook the commitment to grant full market access for services falling under

CPC Section 84 supplied through Mode 1 of the GATS. Consequently, the Russian Federation is

precluded from adopting any limitations on market access for services falling under CPC Section 84

Page 27: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

27 | 28

whether in the form of numerical quotas, or limitations on the total number of service operations

expressed in terms of designated numerical units in the form of quotas, amongst others.

With the findings of the Panel and the Appellate Body in US – Gambling in mind, we consider that

although the DLR contained in Article 2 of Federal Law 242 of 2014 is not expressed in a numerical

form, it has the effect of reducing the amount of cross-border internet services and service suppliers

where personal data of Russian citizens is processed to zero. Indeed, following the implementation

of the measure, suppliers of internet services where personal data of Russian citizens is processed

are required to have a physical presence in the Russian territory. Article 2 of Federal Law 242 of

2014 ultimately sets up a nationality requirement that reduces the number of cross-border internet

services where personal data of Russian citizens is processed to zero. Article 2 of Federal Law 242

of 2014 therefore constitutes a numerical (zero) quota and a limitation on the total number of services

operations in the terms of Article XVI:2(a) and Article XVI:2 (c) of the GATS. Thus, the DLR contained

in Article 2 of Federal Law 242 of 2014 violates the market access obligation of the Russian

Federation under the GATS read together with its GATS Schedule of Commitments.

Finally, the DLR contained in Article 2 of Federal Law 242 of 2014 fails to meet the requirements of

the WTO necessity test and of the chapeau of Article XIV of the GATS and, therefore, cannot be

justified under Article XIV(a) and Article XIV(c)(ii) of the GATS. Additionally, the Russian DLR cannot

be justified, either, under Article XIVbis of the GATS as it fails to meet its requirements as explained

by the Panel in Russia – Traffic in Transit.

As a matter of corollary, it has been identified that the DLR of Article 2 of Federal Law 242 of 2014

stands as a GATS inconsistent measure that cannot be justified under any of its provisions containing

exceptions.

***

Page 28: LEGAL PROBLEMS WITH DATA LOCALIZATION EQUIREMENTS … · 2020-07-07 · 2 | 28 LEGAL PROBLEMS WITH DATA LOCALIZATION REQUIREMENTS – THE CASE OF THE RUSSIAN FEDERATION Dedicated

28 | 28

The Leuven Centre for Global Governance Studies is an interdisciplinary research centre of

the Humanities and Social Sciences recognized as a KU Leuven Centre of Excellence and as a

Jean Monnet Centre of Excellence. It hosts researchers from law, economics, political science,

history, philosophy and area studies. The Centre initiates and conducts interdisciplinary research

on topics related to globalization, governance processes and multilateralism, with a particular

focus on the following areas: (i) the European Union and global governance; (ii) human rights,

democracy and rule of law; (iii) trade and sustainable development; (iv) peace and security; (v)

global commons and outer space; (vi) emerging powers; and (vii) global governance and

international law. It hosts the EU-China Focus and the Leuven India Focus.

In addition to its fundamental research activities the Centre carries out independent applied

research and offers innovative policy advice and solutions to policy-makers.

In full recognition of the complex issues involved, the Centre approaches global governance from

a multi-level and multi-actor perspective. The multi-level governance perspective takes the

interactions between the various levels of governance (international, European, national,

subnational, local) into account, with a particular emphasis on the multifaceted interactions

between the United Nations System, the World Trade Organization, the European Union and other

regional organizations/actors in global multilateral governance. The multi-actors perspective

pertains to the roles and interactions of various actors at different governance levels, which

includes public authorities, formal and informal international institutions, business enterprises and

non-governmental organizations.

For more information, please visit the website www.globalgovernancestudies.eu

Leuven Centre for Global Governance Studies

Huis De Dorlodot, Deberiotstraat 34, 3000 Leuven, Belgium

Tel. ++32 16 32 87 25

Fax ++32 16 37 35 47

[email protected]