the next step the study uses this categorization for the first time into a gravity model to study the relationship between data models and trade in digital services. In particular, the paper looks at whether sharing the same data model between country-pairs is positively or negatively correlated with trade in digital services among these countries.

# **3. Three Data Models**

While regulations of personal data diverge widely between countries, it is nonetheless possible to identify three main approaches with some distinctive characteristics: one model based on open transfers and processing of data, a second model with conditional transfers and processing, and a third one that is based on limited transfers and processing. These three data models have become a reference for many other countries when defining their rules on both the cross-border transfer and the domestic processing of personal data.<sup>3</sup>

# **3.1 Taxonomy**

Table 1 summarizes the main features of the three data models, broken down by the two components of cross-border transfers and domestic processing of data. Each data model has several defining features that described and summarized as follows.

The open model for data transfers and processing is characterized by the absence of restrictions on cross-border data flows. Neither does the open model have a comprehensive framework for personal data protection that applies to domestic data processing.<sup>4</sup> With regards to cross-border data transfers, countries following this model usually rely on a baseline set of privacy principles and leave to companies the flexibility to self-regulate on a voluntary basis. Under this model, firms usually remain accountable for how personal data is treated, also when it is transferred to a recipient in a third country. However, several countries following this model simply lack any accountability on how personal data is treated after crossing the borders. For domestic processing, the open model is defined by the lack of a comprehensive framework on personal data and, therefore, data subjects have only limited rights when it comes to how their personal data is handled. Under this model, it is not uncommon that certain sensitive categories of data, such as in finance and health, have sectoral rules on data processing. In general, countries that fit under this model consider data protection as a consumer right. This model also covers all those countries that simply have not yet regulated personal data at all.

3 Note that there is no globally accepted definition of personal data. For example, according to the US Office of Management and Budget guidance to federal agencies (OMB, 2016), personal data refers to “information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual”. The EU General Data Protection Regulation (GDPR) instead defines personal data more widely as “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (Art. 4). This uncertainty poses additional challenges to the analysis of the impact of data models on trade.

4 For example, Gao (2018) refers to the US Telecommunication Act of 1996, 47 U.S.C.¶230(b)(2) which states that it is “the policy of the US (...) to preserve (...) free market (...) unfettered by Federal or State regulation”.

5