3

# **I. INTRODUCTION**

The ability to move data freely across borders underpins a growing range of economic activity and international trade. McKinsey estimated that cross border data flows were 45 times larger in 2014 than in 2015, and around 12 percent of international trade in goods is over global e‐commerce platforms such as Alibaba and Amazon (Manyika et al., 2016). The US International Trade Commission estimates that in 2014, global digital trade, including of data‐processing and other data‐based services, led to a more than 3.4 percent increase in US GDP, by increasing productivity and lowering the costs of trade (ITC 2014). Overall, data flows are estimated to have increased world GDP by about 10 percent over the past decade (McKinsey 2016). These estimates are plausible because data flows have facilitated the diffusion of knowledge and technology, and enabled the fragmentation of production of goods and services across countries, resulting in gains from an ever finer international division of labor. Data flows are also the basis for potentially transformative developments, ranging from additive manufacturing, which could change trade in goods into trade in design, to cloud computing, which is already changing trade in IT products into trade in computer services. Furthermore, big data analytics, which rely on data gathered from across jurisdictions, are revolutionizing industries from banking and insurance to health and retail, and supporting the development of artificial intelligence.

However, international data flows are also raising concerns. The provision online of search, communication, health, education, retail and financial services relies on, or could lead to, the collection of personal data. The global nature of the internet means that such data can be quickly and easily transferred to third parties in other jurisdictions. This transfer can undermine domestic privacy goals when the personal data of citizens flows to jurisdictions which do not offer them comparable levels of privacy protection. This concern can prompt domestic regulators to limit the free flow of data across borders. For example, in October 2015, the Court of Justice of the European Union declared invalid an arrangement that facilitated data flows between Europe and the United States (which was subsequently renegotiated). The ruling came after privacy advocate Max Schrems brought a case against Facebook in Ireland, its European headquarters, saying his privacy had been violated by the US National Security Agency’s mass‐surveillance programs, first revealed by whistle‐blower Edward Snowden.

Privacy protection is not a new issue. In the 19<sup>th</sup> century Samuel Warren and Louis Brandeis, concerned about the potential for media to intrude on personal lives wrote about a “right to be left alone” (Warren and Brandeis 1890). Protecting privacy became increasingly important post WWII, as governments’ increasing use of personal data combined with new computing power to process the data. The developments led to various government reviews of privacy protection. In 1980, the OECD produced _Guidelines on the Protection of Privacy and Trans‐Border Flows of Personal Data –_ reflecting an OECD consensus on how member countries should handle and protect personal data.

More recently, in response to the dramatic growth of international data flows, the EU has implemented the world’s most legally comprehensive data protection regime. The 1995 Data Privacy Directive (the Data Directive) will be replaced by the more ambitious General Data Protection Regulation (GPDR) on 28 May 2018. Since EU efforts to achieve its privacy goals can be circumvented when data are sent to other jurisdictions with lower levels of privacy protection, the EU Directive and Regulation make it illegal to