25 Simply pushing a traditional approach to trade rules, that only limits the data source country’s freedom to regulate or prevent data outflows, fails to address the underlying problem in privacy regulation that leads to the need for data localization requirements in the first place. In fact, such commitments to cross‐border data flows would merely lead to the data source country relying on the trade agreements exceptions for privacy measures to justify ongoing data restrictions. Such recourse to a trade agreements’ exceptions provisions is implicit in the EU Commission proposal for balancing commitments to data flows with its privacy regime.

Under the circumstances, the most fruitful approach is to design trade rules, as in the recent Comprehensive and Progressive Agreement for Trans‐Pacific Partnership (CPTPP), that reflect the bargain central to successful international regulatory cooperation, as in the EU‐US Privacy Shield. Data destination countries would promise to protect the privacy of foreign citizens in return for source countries committing not to restrict the flow of data. While this goal may not be immediately attainable for a large group of countries, certain intermediate steps are likely to be feasible for different sets of countries.

Table 1 provides an overview of the different approaches to cross‐border data flows of each privacy arrangement outlined in the paper. As can be seen, each of the privacy mechanisms relies on some convergence towards common privacy principles (whether in the EU or amongst a set of countries). As discussed, the CPTPP extends the scope of domestic privacy law to personal data collected from people located overseas. In this respect, the CPTPP resembles the Privacy Shield, which also extends US privacy protection to cover EU citizens. The table also shows that when it comes to enforcement of privacy principles, there are two broad approaches. In the first, entities collecting data and transferring it overseas remain liable and enforcement therefore happens in the data source country. In the second, cross‐border transfers of personal data are subject to an adequacy finding or an international agreement which creates also an option of enforcement in the data destination country.

**Table 1: Regulation of international transfers of personal information under different privacy regimes**

||**EU Data**<br>**Directive/GDPR**|**Privacy Shield**|**CPTPP**|**APEC CBPR**|**OECD Privacy**<br>**Principles**|
|---|---|---|---|---|---|
|**Privacy**<br>**principles**|Determined by<br>the EU.|Determined by<br>the EU, but<br>recognition that<br>US promise of<br>privacy<br>protection for EU<br>citizens is<br>equivalent to EU.|To be determined by<br>each party, taking into<br>account “principles<br>and guidelines of<br>relevant international<br>bodies.”|Common APEC<br>privacy principles<br>based on OECD –<br>privacy floor<br>which domestic<br>privacy regimes<br>can go beyond.|Common OECD<br>privacy<br>principles.|
|**Scope**|Applies to all<br>companies<br>collecting EU<br>citizen data no<br>matter where|Applies to US<br>companies<br>participating in<br>Privacy Shield<br>and collecting|Requires each Party to<br>“endeavor to adopt<br>non‐discriminatory<br>practices in<br>protecting users of<br>electronic commerce|Applies to APEC<br>CBPR compliant<sup>i</sup><br>organizations.<br>collecting<br>personal|Applies to data<br>controllers ‐<br>entities who<br>decide about<br>the content<br>and use of|