16 for private firms in developing countries to emulate U.S. firms like Microsoft and credibly commit to meet the required high standards (see the discussion of the EU‐US Privacy Shield).

A NASSCOM‐DSCI Survey in 2013 suggested that the EU regulation had a significant impact on India’s exports (NASSCOM‐DSCI 2013).<sup>6</sup> The respondents accounted for about 45 percent of industry revenues, and spanned IT (e.g. custom application development) and BPO (e.g. customer care, finance and accounting, human resources) sectors. As many as 90 percent of the respondents said they used standard model contracts to transfer personal data outside the EU. Most said that the process was complex and lengthy; more than half said it took on average more than 3 months. A small number said they used binding corporate rules and indicated that the process took over 6 months. As many as 67 percent of the surveyed services exporters claimed “non‐fructification” of deals because of data protection‐related concerns. Nearly, two‐fifths of respondents estimated a loss in commercial opportunities of more than $10 million and another one‐third of between $1 million and $10 million.

**IV. THE TREATMENT OF PRIVACY UNDER CURRENT AND PROPOSED TRADE RULES**

In this section, we briefly review how privacy is treated under the rules of three representative trade agreements: the WTO, the Korea‐US Free Trade Agreement and the CPTPP.

# **The WTO**

The WTO rules that affect data flows are contained in the General Agreement on Trade in Services (GATS). Four aspects the GATS rules are relevant: the coverage of digital flows under the GATS; the substantive disciplines on openness; the exceptions provisions pertaining to privacy; and the provision relating to recognition agreements.

# _The coverage of digital flows under the GATS_

The Appellate Body has confirmed that specific commitments on services include their electronic delivery (WTO 2012, para 364). This is consistent with the view that specific commitments are “technologically neutral.” Therefore, a commitment to allow the cross‐border delivery of a service can be assumed to mean that delivery through all means – including as digital flows – is allowed. However, this commitment does not extend to requiring unrestricted flows of personal data. For example, a commitment to allow the cross‐border supply of life insurance services does not necessarily oblige a country to allow an insurer located abroad to transfer personal health data out of the country.

There is some uncertainty about the extent to which _new_ digital services are covered by existing GATS commitments. Most WTO members used the UN Central Product Classification (CPC) System or the Services Sectoral Classifications List (MTN/GNS/W/120) (or a combination of both) to schedule their WTO GATS commitments. The CPC was finalized in 1991 when the internet barely existed. The CPC has since been updated but the older CPC classification remains the basis for members’ GATS commitments. The most relevant CPC for digital services are CPC 843 for ‘computer and related services’, and CPC 844 for ‘Data Base Services’ which includes online processing services. Yet, it is open to question whether these classifications cover ‘new’ digital services such as search engines and cloud computing which did not even exist when commitments were scheduled.

6 These data have not been independently verified.