On July 17, the United States Trade Representative (USTR) issued a Summary of Objectives for the renegotiation of the North American Free Trade Agreement among Canada, the United States and Mexico (NAFTA). There are a number of objectives that could affect Canada’s freedom to enact or maintain data localization measures. Data localization measures are rules that require data to remain in Canada.
In particular, the USTR wants to ensure the NAFTA countries:
- refrain from imposing measures in the financial services sector that would restrict cross-border data flow or require the use or installation of servers and computing equipment in Canada
- establish rules with respect to the digital trade in goods and services that would not restrict cross-border data flow or require the use or installation of servers and computing equipment in Canada
The USTR wishes to maintain broad exceptions for government procurement in order to deal with issues of national security. This could permit data localization laws, if there was a a real security need to maintain data in Canada.
Currently, Canada has several laws that either require data localization or that could be interpreted as effectively requiring data localization. Moreover, many public institutions embed data localization requirements into their procurement policies. These data localization measures are usually justified on one or more of the following bases:
- data localization is necessary in order for regulators to exercise their regulatory functions without being dependent on the aid of U.S. authorities
- data localization provides Canada with the ability to provide Canadians with greater privacy protections than they would enjoy in the United States
- Canadians do not have the same procedural rights when U.S. law enforcement or governmental authorities seek access to their data
- Canada needs to the freedom to carve a different path on privacy than the U.S. in order to preserve its position with Europe as an “adequate” jurisdiction in which transfer data of European residents
Most of these arguments tend to crumble under scrutiny, particularly when we consider how much data is shared with the United States and the number of mutual legal enforcement agreements exist between the two countries.
A possible exception is the argument related to procedural rights. However, even here, the measures requiring localization tend to be confined to situations in which the entity seeking to transfer the data has the economic resources to address the issue through contractual or other means (such as public bodies in British Columbia). When it comes to individual consumers choosing to purchase goods and services from the U.S. they are largely on their own. Therefore, one wonders (as the USTR evidently does) whether these data localization policies are more about protecting industries and jobs than privacy and data protection.