Cross-Border Data

London Calling: Post-Brexit Prospects for a U.S.-U.K. Digital Trade Deal

By Kenneth Propp
Monday, December 10, 2018, 3:47 PM

As opposition grows in the British Parliament to the nearly 600-page agreement negotiated by Prime Minister Theresa May’s government to withdraw the United Kingdom from the European Union, it’s increasingly clear that the current text will not be the final word. But even if the British government is ignominiously sent back to the negotiating table with Brussels, it would be a mistake to dismiss the behemoth withdrawal agreement, and the accompanying 26-page political declaration on the future U.K.-EU relationship, as headed for the trash heap.

Barring a complete u-turn on Brexit, it’s a safe bet that much of the content of these detailed documents ultimately will end up governing the U.K.’s future economic relationship with the European continent. This is true of the U.K.’s relations beyond Europe as well: the political declaration contains important clues to the nature of the network of free trade agreements that the United Kingdom will pursue with key partners worldwide.

Digital trade is an increasingly important subject in free trade agreements (FTAs) across the globe, and a U.S.-U.K. FTA doubtless would emphasize it, given the important role it plays in current Anglo-American trade relations. But even on a subject where both countries would have reason to be ambitious, there are discouraging signs in the roadmap for the future U.K.-EU relationship suggesting that these ambitions may not be satisfied. 

This certainly was the perspective from which President Trump viewed the agreed texts when they were released on November 25. He was quick to express his disappointment, commenting that, “Right now, as the deal stands, they might not be able to trade with the U.S.” The British Prime Minister promptly disagreed: “I’m very happy to tell President Trump and others that we will have an independent trade policy, we will be able to do trade deals.”

The truth of the matter lies somewhere in between. Pursuant to the Brexit agreement, the U.K. will regain its autonomy to negotiate free trade agreements,, including the one it eagerly seeks with the United States. However, its emerging future relationship with the EU, and the continuing influence of portions of EU law, will inevitably circumscribe its international negotiating position in important ways. 

For example, in order to facilitate trade in goods across the English Channel, the U.K. and EU “envisage comprehensive arrangements that will create a free trade area, combining deep regulatory and customs cooperation, underpinned by provisions ensuring a level playing field for open and fair competition,” according to the political declaration. These arrangements presumably will amount to less-than-full participation on the U.K.’s part in the EU’s Single Market, which has abolished many regulatory obstacles to trade in goods within the bloc—but the degree of the U.K.’s separation from detailed Single Market rules ultimately may prove to be more optical than substantive. It’s no wonder that Trump does not see bright prospects for a deal to achieve his goal of London lowering tariffs and removing EU-imposed regulations on goods trade, like those governing agriculture.

But when it comes to services—an area that has drawn less attention from the Trump White House—the outlook for the United States and United Kingdom seems more promising. The U.K. and EU have agreed to aim for “comprehensive” arrangements on services as well as goods trade. Indeed, in areas like financial services, it will be critically important for the U.K. to ensure that London-based banks are able to continue doing business across Europe. Still, the EU’s Single Market program has achieved much less regulatory uniformity across the union for services trade than it has for goods, so the U.K. correspondingly will be freer to address services in future FTAs with countries like the United States. 

This matters for both the U.S. and U.K., as the volume of Anglo-American services trade exceeds that of bilateral goods trade. The United Kingdom already is the United States’ largest trading partner with respect to services, absorbing $65.7 billion in U.S. services exports, while exporting $51.7 billion in services across the Atlantic, according to the latest figures available. The United States takes a 25 percent share of U.K. services exports, and supplies 19 percent of the United Kingdom’s services imports. Seventy percent of British shoppers use U.S.-based e-commerce sites. This is an aspect of U.S.-U.K. trade relations that both sides will likely want to reinforce in an FTA.

U.S. and U.K. trade officials, backed by strong political endorsement from their leaders, have met several times in recent months to explore the possible contours of a free trade agreement. Pursuant to legislation governing trade agreements, the U.S. Trade Representative’s Office (USTR) already has notified Congress of its intention to proceed with the United Kingdom. During early 2019, USTR expects to develop detailed negotiating objectives. Britain is undertaking a similar domestic process. If the timetable for the U.K.’s departure from the EU holds, both sides could be ready to formally commence trade negotiations by the spring.

Rules on digital trade are becoming a prominent feature of new trade agreements. For example, the recently-signed U.S-Mexico-Canada Agreement (USMCA), aimed at replacing the North American Free Trade Agreement (NAFTA), is the first bilateral U.S. trade agreement to include an entire chapter devoted to digital trade. A U.S.-U.K. FTA thus seems a natural next vehicle for U.S. negotiators to pursue digital trade provisions similar to those in the USMCA.

The United Kingdom has been an enthusiastic proponent of digital trade provisions incorporated into recent EU free trade agreements, notably the EU’s new Economic Partnership Agreement with Japan. The EU-Japan agreement prohibits the parties from taxing cross-border electronic data transmissions or demanding forced transfer of source code as a condition of doing business.  It also contains assurances that business may be conducted using electronic contracts, signatures, and authentication.  The USMCA has comparable provisions, so the United States should easily find common ground with the U.K. in these areas.

However, challenging Anglo-American discussions lie ahead on a crucial dimension of digital trade rules: the extent to which a government may restrict corporate data transfers to the other country’s territory, including by requiring personal data in the hands of companies to remain within its borders. The USMCA achieved strong liberalizing language on this subject. It prevents the three governments from restricting the cross-border electronic transfer of information unless there are legitimate public policy reasons for doing so; restrictions must be narrowly tailored, and in any case may not lead to arbitrary or unjustified discrimination or to disguised restrictions on trade. The USMCA digital trade chapter also precludes each government from requiring businesses to use or locate computing facilities in its territory. Binding dispute settlement is available to enforce these rules.

The U.K. may well be amenable to these propositions, but nevertheless may not be in a position to agree to incorporate them into an FTA with the United States. Past U.S. experience in negotiating with the European Union shows why: In the Obama administration’s lengthy and unsuccessful negotiation with the EU on the Transatlantic Trade and Investment Partnership (TTIP), the United States also pursued data transfer and localization provisions like those now found in the USMCA. The EU refused even to discuss the subject, since the bloc was deadlocked in internal discussions involving the commission and the member states. This impasse persisted throughout the TTIP negotiations and foiled Japan’s effort to include similar digital trade language in its trade agreement with the EU. Japan ultimately achieved only a commitment from the EU to revisit the subject three years after the agreement entered into force.

Early in 2018, the EU finally came up with an agreed position on data transfers for use in other FTA negotiations. The EU’s approach, like that of the United States, seeks to prohibit restrictions on cross-border data flows by such means as requiring either the use of local computing facilities or local storage of data. It allows much broader exceptions, however, including those based on any privacy measure that a government deems appropriate.  Moreover, foreign companies whose cross-border data flows are restricted due to a government’s self-declared privacy measure would lack recourse to binding dispute settlement to challenge it—even if the effect is blatantly discriminatory.  The European Commission is reportedly now advancing this position in several bilateral FTA negotiations it is conducting in Asia.

The EU’s new approach on data flows reflects institutional discomfort in subjecting its robust privacy laws to international trade law disciplines. The union’s privacy laws have broad extraterritorial effects, protecting EU citizens’ data not only when processed within the territory of member states but also when that data travels internationally. But by keeping the union’s privacy regime largely outside the scope of trade agreements—including the international dimensions of that regime—the EU has opened a large loophole for its prospective foreign partners to engage in protectionist practices to the detriment of EU companies.

As an EU member, Britain fought hard, if unsuccessfully, against the European Commission’s compromise between trade and privacy interests in its approach to data transfers. So one might expect it quickly to jettison this position in developing its own trade agreements—especially with the United States, where digital services will loom large. However, the EU would not be well-pleased to see a near neighbor establish international data transfer provisions that companies dependent on such transfers, such as those engaged in medical research, might well find more attractive than those contained in EU trade agreements. Such companies might well find the U.K a more hospitable location in which to base data-intensive operations than an EU member state.

The union may engage to keep the United Kingdom in line with its practice on data transfer rules. In the political declaration, the U.K. was obliged to agree that its future relations with the EU on digital matters would follow the limited template utilized by the EU in its other trade negotiations—i.e., facilitating cross-border data flows and addressing “unjustified” data localization requirements, without affecting privacy rules. If the EU is insisting on this approach with the United Kingdom, is it likely to be agnostic when the United Kingdom turns to its own trade policy?

The European Union’s privacy law provides a potential weapon against a U.K. trade policy along those lines. Under its terms, a company may export personal data located within the union to a non-EU jurisdiction only if comparable guarantees of privacy protection exist there. Companies have several legal mechanisms for data transfer at their disposal, but by far the most efficient and least costly is a blanket finding by the European Commission that the foreign country’s data protection laws afford an “adequate” level of protection. Only a handful of countries enjoy this status—and, under the U.S.-EU Privacy Shield Framework, the United States is among them.

The United Kingdom has obtained an EU commitment to consider its bid for adequacy by the end of 2020, so that British companies would be able to seamlessly continue data transfers to and from union territory after EU privacy law ceases to apply in the U.K. The U.K. highlighted the importance it attaches to this achievement by placing it at the very beginning of the political declaration on the future relationship.

When deciding if a foreign country is “adequate,” the European Commission takes a wide-ranging look at its legal order, including its rules for the onward transfer of personal data to another third state and even its national security laws. Might the commission therefore object to a U.K. intention to incorporate into a U.S.-U.K. FTA provisions restricting the U.K.’s ability to impose localization requirements protecting the privacy of data originating in the EU as well as the U.K.?  Since the commission’s adequacy decisions are made by the Directorate-General for Justice and Consumers, which demanded and secured a wide privacy exemption in EU free trade agreements, the temptation to similarly discipline the U.K. might be irresistible.

The United Kingdom already is grappling with the reality that it may need to change aspects of its far-reaching surveillance laws to achieve adequacy even after it leaves the EU and formally escapes the jurisdiction of the European Court of Justice (ECJ). In recent years, the ECJ has handed down a series of landmark rulings expanding privacy rights within the EU, and the commission is obliged to take these interpretations of EU law into account when deciding on the adequacy of a foreign government’s privacy laws.

British law enforcement and intelligence agencies, for example, currently have much greater scope to engage in bulk collection of personal data than their continental counterparts do. But in the 2016 Tele2 case, the ECJ decided that a British law enabling law enforcement to obtain wide swathes of data from communications providers ran afoul of EU-level constitutional privacy protections. In 2019, the court is expected to rule in another U.K. case, Privacy International, addressing whether comparable bulk surveillance powers enjoyed by British intelligence also are inconsistent with EU fundamental rights.

British parliamentarians and citizens now are in the process of digesting the hard truth that leaving the European Union does not mean entirely—or even largely—escaping the reach of union law and policy. The U.K.’s need for a smooth and close future economic relationship with countries across the Channel makes continuity with significant portions of EU law and policy unavoidable, as the political declaration amply demonstrates.

Brave British declarations of trade policy “independence” thus will prove to be less than meets the eye, as U.S. trade negotiators may be among the first to discover. Even in the promising area of services trade, Britain will be negotiating with an eye to Brussels as well as to its own interests. There is certainly room for agreement with the United States on important new protections for digital trade. But here too the long arm of EU trade and privacy law will be felt, and the United States may have to settle for less than was achieved with its North American neighbors. As the United Kingdom sets sail for foreign ports of trade, it will remain firmly anchored to the old continent.