DATA LOCALISATION AND INTERNATIONAL ECONOMIC LAW:RECONCILING DIGITAL SOVEREIGNTY WITH TRADE AND INVESTMENT DISCIPLINES
DOI:
https://doi.org/10.46763/Schlagwörter:
Data Localisation, Digital Sovereignty, International Economic Law, Digital Trade, Investment LawAbstract
This article examines whether state measures requiring data
localisation, restricted transfer and increased regulatory control of
platform generated data can be reconciled with international
economic law (IEL). The central question is whether data
localisation measures, justified on cybersecurity and sovereignty
grounds, can satisfy the disciplines of market access, national
treatment, and General Agreement on Trade in Services (GATS)
Article XIV necessity test, and investment protection standards.
While data localisation and cybersecurity policies reflect states’
pursuit of digital sovereignty, they may simultaneously restrict cross
border digital services, increase compliance costs for foreign
platforms and affect digital investors. Using a doctrinal and
comparative approach, the article analyses GATS Articles XVI,
XVII and XIV, selected digital trade provisions in the United StatesMexico-Canada Agreement (USMCA) and Comprehensive and
Progressive Agreement for Trans-Pacific Partnership (CPTPP), and
investment law principles relating to fair and equitable treatment,
indirect expropriation and police powers. China’s Cybersecurity Law is used as the main example. The article argues that IEL permits
legitimate regulation of platform data, but only where such
regulation is transparent, non-discriminatory, proportionate and not
a disguised restriction on trade or investment.
Downloads
Literaturhinweise
Aaronson, S. A. (2018). Data is different: Why the world needs a new approach
to governing cross-border data flows (CIGI Paper No. 197). Centre for
International Governance Innovation.
Arasasingham, A., & Goodman, M. P. (2023, April 13). Operationalizing data
free flow with trust (DFFT). Center for Strategic and International
Studies. https://www.csis.org/analysis/operationalizing-data-free-flowtrust-dfft
Baker, W., Goudie, M., Hutton, A., Hylender, C. D., Niemantsverdriet, J., Novak,
C., Ostertag, D., Porter, C., Rosen, M., Sartin, B., & Tippett, P. (2011).
2011 data breach investigations report. Verizon RISK Team.
Bauer, M., Lee-Makiyama, H., van der Marel, E., & Verschelde, B. (2014). The
costs of data localisation: Friendly fire on economic recovery (ECIPE
Occasional Paper No. 3/2014). European Centre for International
Political Economy. https://ecipe.org/publications/the-costs-of-datalocalisation/
Burri, M. (2017). The governance of data and data flows in trade agreements: The
pitfalls of legal adaptation. UC Davis Law Review, 51(1), 65–132.
Cargill, Incorporated v. United Mexican States, ICSID Case No. ARB(AF)/05/2,
Award (September 18, 2009).
Chander, A. (2020). Is data localization a solution for Schrems II? Journal of
International Economic Law, 23(3), 771-784.
https://doi.org/10.1093/jiel/jgaa024
Chander, A., & Lê, U. P. (2015). Data nationalism. Emory Law Journal, 64(3),
677–739.
Cohen, B., Hall, B., & Wood, C. (2017). Data localization laws and their impact
on privacy, data security and the global economy. Antitrust, 32(1), 107–
114.
Comprehensive and Progressive Agreement for Trans-Pacific Partnership.
Cory, N., & Dascoli, L. (2021). How barriers to cross-border data flows are
spreading globally, what they cost, and how to address them. Information
Technology and Innovation Foundation.
Cybersecurity Law of the People’s Republic of China. (2017).
Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian
Schrems, Case C-311/18, ECLI:EU:C:2020:559 (2020).
Data Security Law of the People’s Republic of China. (2021).
Digital Personal Data Protection Act, No. 22 of 2023, India Code (2023).
Directive (EU) 2022/2555 of the European Parliament and of the Council of 14
December 2022 on measures for a high common level of cybersecurity
across the Union, 2022 O.J. (L 333) 80.
Dolzer, R., & Schreuer, C. (2012). Principles of international investment law
(2nd ed.). Oxford University Press.
Espinoza, F., Maryska, M., Doucek, P., & Kovářová, M. (2023). DORA and NIS2
and their impact on database security. In IDIMT 2023: New challenges
for ICT and management-31st Interdisciplinary Information
Management Talks (pp. 81–87). https://doi.org/10.35011/IDIMT-2023-
81
Federal Law No. 242-FZ of 21 July 2014 amending Federal Law No. 152-FZ on
Personal Data (Russia). (2014).
General Agreement on Trade in Services, April 15, 1994, 1869 U.N.T.S. 183.
Kadena, E., & Gupi, M. (2021). Human factors in cybersecurity: Risks and
impacts. Security Science Journal, 2(2), 51–64.
https://doi.org/10.37458/ssj.2.2.3
Lei Geral de Proteção de Dados Pessoais [General Data Protection Law], Law
No. 13,709/2018 (Brazil). (2018).
Meltzer, J. P. (2013). The internet, cross-border data flows and international
trade (Issues in Technology Innovation No. 22). Brookings Institution.
https://doi.org/10.2139/ssrn.2292477
Meta Platforms, Inc. (n.d.). Privacy policy. Retrieved July 16, 2026, from
https://www.facebook.com/privacy/policy/
Mitchell, A. D., & Hepburn, J. (2017). Don’t fence me in: Reforming trade and
investment law to better facilitate cross-border data transfer. Yale Journal
of Law & Technology, 19, 182–237.
Office of the United States Trade Representative. (n.d.). USMCA Chapter 19:
Digital trade. Retrieved July 16, 2026, from
https://ustr.gov/sites/default/files/files/agreements/FTA/USMCA/Text/1
9-Digital-Trade.pdf
Personal Information Protection Law of the People’s Republic of China. (2021).
Philip Morris Brands Sàrl, Philip Morris Products S.A. and Abal Hermanos S.A.
v. Oriental Republic of Uruguay, ICSID Case No. ARB/10/7, Award
(July 8, 2016).
Pope & Talbot Inc. v. Government of Canada, UNCITRAL, Award on the Merits,
Phase 2 (June 26, 2000).
Qi, A., Shao, G., & Zheng, W. (2018). Assessing China’s cybersecurity law.
Computer Law & Security Review, 34(6), 1342-1354.
https://doi.org/10.1016/j.clsr.2018.08.007
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27
April 2016 (General Data Protection Regulation), 2016 O.J. (L 119) 1.
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14
December 2022 on digital operational resilience for the financial sector,
2022 O.J. (L 333) 1.
Reserve Bank of India. (2018, April 6). Storage of payment system data (Circular
No. DPSS.CO.OD No. 2785/06.08.005/2017-18).
https://www.rbi.org.in/scripts/NotificationUser.aspx?Id=11244
Sargsyan, T. (2016). Data localization and the role of infrastructure for
surveillance, privacy, and security. International Journal of
Communication, 10, 2214-2237.
Taylor, L. (2017). What is data justice? The case for connecting digital rights and
freedoms globally. Big Data & Society, 4(2), 1-14.
https://doi.org/10.1177/2053951717736335
Taylor, R. D. (2020). “Data localization”: The internet in the balance.
Telecommunications Policy, 44(8), Article 102003.
https://doi.org/10.1016/j.telpol.2020.102003
Técnicas Medioambientales Tecmed, S.A. v. United Mexican States, ICSID Case
No. ARB(AF)/00/2, Award (May 29, 2003).
TikTok. (n.d.). Privacy policy. Retrieved July 16, 2026, from
https://www.tiktok.com/legal/page/row/privacy-policy/en
United Nations Conference on Trade and Development. (2011). Scope and
definition: UNCTAD series on issues in international investment
agreements II. United Nations.
United Nations Conference on Trade and Development. (2012). Expropriation:
UNCTAD series on issues in international investment agreements II.
United Nations.
United Nations Conference on Trade and Development. (2021). Digital economy
report 2021: Cross-border data flows and development-For whom the
data flow. United Nations. https://unctad.org/system/files/officialdocument/der2021_en.pdf
United States–Mexico–Canada Agreement. (2018).
https://ustr.gov/sites/default/files/files/agreements/FTA/USMCA/Text/19-
Digital-Trade.pdf
World Trade Organization. (n.d.). Schedules of specific commitments and lists of
Article II exemptions. Retrieved July 16, 2026, from
https://www.wto.org/english/tratop_e/serv_e/serv_commitments_e.htm
World Trade Organization. (1991, July 10). Services sectoral classification list
(MTN.GNS/W/120).
World Trade Organization. (1998, September 30). Work programme on
electronic commerce (WT/L/274).
World Trade Organization. (2002, February 14). China-Schedule of specific
commitments (GATS/SC/135).
World Trade Organization Appellate Body. (2005). United States-Measures
affecting the cross-border supply of gambling and betting services
(WT/DS285/AB/R).
World Trade Organization Appellate Body. (2016). Argentina-Measures relating
to trade in goods and services (WT/DS453/AB/R).
X Corp. (n.d.). Privacy policy. Retrieved July 16, 2026, from
