6 international regulatory cooperation, as in the EU‐US Privacy Shield. Data destination countries would promise to protect the privacy of foreign citizens in return for source countries committing not to restrict the flow of data. While this goal may not be immediately attainable for a large group of countries, we spell out a set of intermediate steps that are likely to be feasible for different sets of countries. We also discuss how the interests of countries that are left out of such arrangements can be protected by existing multilateral rules on recognition agreements.

This paper is structured as follows. Section II analyzes the EU privacy regime with a focus on its impact on cross‐border data flows. Section III discusses the impact of the EU privacy regime on India, a major data processing destination, and what India would need to do to be deemed adequate under the EU Directive and GDPR. In this part, we also discuss the costs of compliance with the EU regime and the impact on services exports. Section IV examines how privacy is dealt with under the rules of four representative international trade agreements, the WTO, the Korea‐US FTA, the recent CPTPP, and the EU’s proposed approach to trade agreements with other countries. Section V provides an overview of attempts to promote regulatory convergence and cooperation on privacy. Here we discuss the OECD, APEC and European Data Protection Convention approaches. We also analyze the Privacy Shield Agreement, which provides an alternative mechanism to allow cross‐border data flows. In Section VI, we propose an approach that builds on the CPTPP and the Privacy Shield and could eventually form the basis of a multilateral initiative. Section VII concludes.

# **II. THE EU APPROACH TO PRIVACY**

The EU Data Protection Directive adopted in 1995 governs personal data protection in the EU. As a ‘Directive’, implementation is left to EU member states, and in practice, member states vary widely in their enforcement of the Data Directive. The European Commission will replace the Data Directive with the GDPR in May 2018 (EU 2018). Under EU law, a Regulation is directly applicable in member states, i.e. it does not require separate implementing legislation. Under the GDPR, member state data protection authorities will be responsible for enforcement and the consistency of enforcement across the EU will be the responsibility of the newly created European Data Protection Board. Moreover, violations of the GDPR can lead to fines of up to 4 percent of total worldwide annual turnover (GDPR Article 83).

This section will focus on the GDPR since it will be the relevant law from May 2018. Where pertinent, this section will identify how the GDPR changes the scope and application of the Directive to give a better sense of the impact of the GDPR on digital trade.

# _What Are Personal Data?_

The Directive defines personal data as “any information relating to an identified or identifiable natural person”, and defines an identifiable person as “one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more specific factors specific to his physical, physiological, mental, economic, cultural or social identity" (Directive Article 2). The GDPR adopts a similar approach. It defines personal data as the Directive does, but widens the definition of an identifiable natural person to “one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identify of that natural person" (GDPR Article 4.1).