Canada: Cross-border transfers and data localisation after the USMCA
The provisions of the United States-Mexico-Canada Agreement ('USMCA') cover the novel subject of the exchange of personal information between its signatories, arguably introducing a new element of uncertainty for the status of Canada's adequacy decision from the European Commission. Max Jarvie, Senior Associate at BLG LLP, discusses this issue with reference to both the wording of the USMCA and the extent to which it may or may not bear upon regional data localisation and data transfer requirements.
The USMCA1 will shortly come into force in all three member states of Canada, the United States, and Mexico2, replacing the North American Free Trade Agreement ('NAFTA'). When the text of the USMCA was first formally agreed by all three parties in November 20183, many commentators weighed in on Chapter 19, entitled 'Digital Trade.' Chapter 19 directly addresses topics that NAFTA did not, expressly extending the philosophy of free trade to the context of digital products and the flow of information, including personal information.
Chapter 19's potential effects on personal information have rightly raised concerns among privacy professionals, who have zeroed in on particular provisions concerning cross-border information flows and data localisation as limiting Canada's future legislative and policy options at a time when information flows are becoming increasingly important to economic and social policy4 and national security5. Moreover, since the first round of criticism emerged in 2018, Canada's federal government has published its Digital Charter, which includes (among other things) a commitment to reform Canada's federal privacy law6. To the extent that the new USMCA constrains the provisions that could go into such a law, and given Canada's desire to maintain its adequacy decision under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR')7, the USMCA is indeed coming into force at a delicate time.
While the concerns raised are legitimate, there is reason to think that the parties to the USMCA have negotiated for themselves sufficient flexibility to set policy and make law in the circumstances where that flexibility would be most desirable, such as the domain of personal information. As a result, it seems unlikely that entering into the USMCA will seriously affect Canada's chances of obtaining an adequacy decision under the GDPR.
In reaching these conclusions, this article considers the logic of the USMCA's drafting, both within and beyond Chapter 19, and its effects on Canada's power to restrict cross-border information flows and impose data localisation requirements.
Cross-border transfer of information by electronic means
USMCA Article 19.11 denies member states the power to prohibit or restrict the cross-border transfer by electronic means of information, including personal information, if this activity is for the 'conduct of the business8.' As noted by other commentators, this provision is to some extent a copy/paste of Article 14.11 of the Electronic Commerce Chapter of the Comprehensive and Progressive Agreement for Trans-Pacific Partnership ('CPTPP')9, with some ammendments10.
Despite the prohibition, the USMCA Article includes (as does the CPTPP) a qualifier to the effect that nothing prevents members states from adopting or maintaining measures inconsistent with the prohibition, provided that the measure meets the four branches of a test. Namely, the measure must:
- address a legitimate public policy objective;
- not be applied in a manner that constitutes unjustifiable or arbitrary discrimination;
- not constitute a disguised restriction on trade; and
- the restrictions imposed by the measure must not be greater than necessary to achieve the objective11.
The phrase 'legitimate public policy objective' is very broad, and the qualifier is further broadened by permitting the adoption or maintenance of 'measures' rather than just law; arguably, it encompasses government directives and policies. As such, as prohibitions go, there seems to be a great deal of latitude permitted to the member states to craft policy that conflicts with the obligations of Article 19.11. It is also worth mentioning that the default obligation not to prohibit or restrict seems more or less in keeping with the whole purpose of a free trade agreement.
Location of computing facilities
In contrast to Article 19.11, there is a pronounced difference between the USMCA provisions governing data localisation, set forth in Article 19.12, and the corresponding provisions of the CPTPP. Although it is important to note that the scope of USMCA Article 19.12 is relatively constrained - no member state can require a company to use or locate computing facilities in a member state territory as a condition for conducting business in that territory12, which does not necessarily prevent making data localisation a requirement in the context of, for example, a particular contract - all moderating language is absent from the USMCA version of this provision. There is no question that this raises red flags, as others have observed13.
For example, the absence from USMCA Article 19.12 of language affirming that member states may have their own regulatory requirements, something that was included in the corresponding section of the CPTPP14, is concerning given the vast gulf between the US and Canadian regulatory framework when it comes to privacy and data protection. Potentially more alarming is that whereas the CPTPP data localisation provision includes the same four-branch test for exceptions as it provides for data transfers, such an exception is entirely absent in the USMCA.
Fortunately, there is reason to think that the tools provided by Chapter 19 itself, Chapter 32, and other aspects of the USMCA provide a certain level of protection for Canadian data localisation controls in various contexts. With respect to the latter point in particular, the overall logic of the USMCA's drafting seems to provide surprisingly broad scope for provincial governments to undertake any measures they see fit. Below, these considerations are discussed in turn.
First, it should be noted that Article 19.2(3) says Chapter 19 does not apply to government procurement or information held or processed by or on behalf of government, or measures related to that information, including measures related to its collection15. As such, government directives on data localisation that touch on personal information held by government itself, such as the federal government's existing Direction for Electronic Data Residency for cloud computing ('the Direction'), will be unaffected16.
Second, on the strength of Article 19.11, Canada could restrict or prohibit data transfers that involve sending personal information to the US. Concern over covert US government surveillance of Canadians17, or the lack of robust personal information protection laws in most US states, could serve as a foundation for the 'legitimate public policy objective' needed under that article. A sufficient restriction or outright prohibition on the electronic transfer of personal information would, for all practical purposes, prevent personal information from being stored in the US.
Naturally, that might be regarded as an attempt to do indirectly what Article 19.12 prohibits doing directly, and contested by the US on that ground18.
For this reason, Canada could turn to the USMCA's Chapter 32, Exceptions and General Provisions. Article 32.1(2) provides that, for the purposes of USMCA Chapter 19, paragraphs (a)-(c) of Article XIV of the General Agreement on Trade Services ('GATS')19 is incorporated into the USMCA, mutatis mutandis. So adapted, GATS Article XIV provides, among other things, that members may adopt or enforce measures necessary to secure compliance with laws or regulations, provided those laws or regulations are not themselves inconsistent with the provisions of the USMCA. Among the laws or regulations specifically called out as falling within this exception are those relating to 'the protection of the privacy of individuals in relation to the processing and dissemination of personal data and the protection of confidentiality of individual records and accounts.'
In this connection, it is interesting to note that Michael Geist, a leading Canadian scholar and commentator on matters relating to law and technology, pointed out in a 2018 comment on the USMCA that 'Canadian negotiators presumably interpret the GATS provision as providing an opening for privacy protection, thereby allowing BC and Nova Scotia to retain their provincial data localization laws20.'
Shortly after Geist's comment was published, the BC Freedom of Information and Privacy Association ('FIPA'), having raised concerns about the effect of the USMCA on data localisation controls in BC law, published a statement from the federal government that appears to corroborate Geist's hypothesis. The statement read: '[w]e've completed a legal analysis and determined that [BC]'s legislative protections for data localization within Canada for public bodies under the Freedom of Information and Protection of Privacy Act are not impacted. BC worked closely with Ottawa during negotiations to ensure these data localization protections were maintained in the new agreement21.'
Yet despite what Geist says, the GATS exception language restricts its relaxation to those laws that are 'not inconsistent' with the provisions of the agreement that they affect. Given that Article 19.12 includes an unqualified prohibition on data localisation, on the surface this suggests that the GATS exceptions cannot provide any legitimate means for supporting data localisation.
Is Geist's supposition therefore incorrect? If so, why would the federal government have made such a statement to FIPA?
It is possible to imagine convoluted interpretations of Articles 19.11 and 19.12 of the USMCA and GATS that would support Geist's conclusion. For example, let us imagine a law that prohibits the transfer of personal information outside Canada, one that satisfies a legitimate public policy objective. Such a law would have the corollary effect of prohibiting storage of that information in the US. It would be reasonable to raise an argument to the effect that this general law against transfers outside Canada is a disguised or constructive violation of Article 19.12. The incorporation of the GATS language could however preclude that argument, depending on whether we consider constructive violations as 'inconsistencies.' 'Inconsistency' is a notion strongly associated with formal logic; things are said to be inconsistent when they are contrary to each other to the extent that one implies the negation of the other. 'Construction' is a legal notion like deeming, denoting a legal fiction for treating a situation as if it had satisfied certain criteria, when those criteria have not been formally satisfied. If the drafters of the USMCA wanted the phrase 'not inconsistent' to have a broader sense, they would have said so. As such, the incorporation of Article XIV GATS may provide a method for defeating the otherwise unmoderated language of 19.12 when a legitimate policy objective requires it.
There is another possibility, however, that is more straightforward and has interesting further ramifications of its own.
Extent of obligations
The USMCA's predecessor, NAFTA, contains a provision concerning the extent of a member state's obligations that its successor does not. Article 105 of NAFTA reads '[t]he Parties shall ensure that all necessary measures are taken in order to give effect to the provisions of this Agreement, including their observance, except as otherwise provided in this Agreement, by state and provincial governments22.'
This language did not carry over into Chapter 1 of the USMCA, but this cannot be put down to an evolution of international law norms since the 1980s. Strikingly similar language, for example, is present in Article 1.8 of the Comprehensive Economic and Trade Agreement ('CETA'), concluded in 201423. Moreover, similar language does appear in the USMCA - but only having effect on Chapter 1424, not as a general obligation. No language having equivalent effect appears in Chapter 19.
Some analysts treat USMCA Section 1.4, which obliges each member state to ensure that persons having delegated regulatory, administrative, or other governmental authority act in accordance with the member state's obligations25, as being equivalent to NAFTA Article 10526. That makes little sense, however, particularly in the context of Canadian federalism's constitutional division of powers between the provincial and federal governments. Powers held by the provinces are not 'delegated' by the federal government. That Canadian government negotiators are generally aware of this is obvious from the text of CETA, which includes not only the general obligation to ensure that all levels of government give effect to the provisions of the treaty at Article 1.8, but also includes a 'persons exercising delegated governmental authority' provision at Article 1.10 that echoes the text of USMCA Article 1.427.
It appears, therefore, that under the USMCA, the Canadian federal government has no express obligation to require that the provinces give effect to the agreement.
Nor are the provinces automatically bound to do so in any case, in virtue of Canada's constitutional arrangements. On the contrary, where an international treaty affects powers constitutionally allocated to the provinces, it can only have effect in Canadian provincial law if a province implements that treaty into provincial domestic law28. The Canadian constitution has no equivalent of the 'Supremacy Clause' of the United States Constitution that could be leveraged in the context of an international treaty to compel provinces to fulfil such a treaty's obligations through the enactment of federal laws29.
These issues were already foreseen with NAFTA30, and commentators have noted that no provincial government has ever implemented NAFTA into its own law31. There is no indication that the provinces plan to do so with respect to the USMCA, either. The federal government's implementing legislation is the only instrument that brings the USMCA into Canadian domestic law in any way.
As such, not only does the USMCA fail to include language obliging the Canadian federal government to ensure observance of Chapter 19 by regional and local governments, even on a best-efforts basis32; even if there was such language, there is nothing in Canadian law that would empower the federal government to compel observance for any area that falls within provincial jurisdiction. With respect to the subject matter of Chapter 19, although it has been generally accepted that the federal government has the ability to regulate cross-border information flows through its trade and commerce power, data localisation may well fall within the provincial powers to legislate on matters affecting property and civil rights and matters of a merely local or private nature33, as may the power to control what information flows beyond provincial borders.
Indeed, in relation to the above, some provincial laws that govern personal information already have provisions governing extra-provincial information flows. Section 13.1 of the Alberta Personal Information Protection Act, SA 2003 c P-6.5, for example, stipulates notice requirements when sending personal information outside of Alberta in the context of outsourcing, while Section 17 of the Quebec Act Respecting the Protection of Personal Information in the Private Sector, CQLR c. P-39.1 requires that organisations that transfer personal information outside of Quebec ensure that the information will not be used for purposes not relevant to the object of the file or communicated to third persons without the consent of the persons concerned.
These niceties cannot have escaped the attention of Canadian negotiators. While Geist may be correct, it is also possible that the 'legal analysis' communicated to FIPA included these inter-jurisdictional considerations and the lack of any general 'extent of obligations' provision in the USMCA. Should push come to shove, it may be that provinces can simply refuse to abide by the requirements of the USMCA, and the federal government has no obligation to compel observance.
If that is so, it could have interesting ramifications for the review of Canada's EU adequacy decision as well. While it is very likely that Canadian privacy laws will need to be reformed in order to obtain any long term adequacy decision relative to the GDPR, if the analysis above is correct, any concerns over constraints imposed by the USMCA on Canada's power to legislate in a way that will support an adequacy decision will be significantly undercut.
There may be limited circumstances in which the European Commission may find residual concerns arising from Canada's adoption of the USMCA, but the ability of provinces to undertake measures as they see fit notwithstanding the federal government's obligations could provide reassurance that the provinces can furnish the necessary protections for personal information. The provincial powers may be far more important, in fact, in the context of the EU's legal analysis; from the EU's point of view, the great majority of personal information transfers of EU data subjects that it is concerned about would likely come under provincial jurisdiction rather than federal.
When we also take into consideration the various tools available to the federal government itself in USMCA Chapters 19 and 32 as discussed above, it does not seem likely that if Canada fails to obtain a renewed adequacy decision, the provisions of USMCA Chapter 19 will be the cause.
Harmonising obligations under international law is a difficult business and often involves some form of zero-sum analysis. As such, it is no surprise that many commentators seize on prohibitions or restrictions in one instrument as creating a danger of trade-offs elsewhere; rare indeed is the cake that can be had, and eaten too. Here, however, a combination of exclusions, a lack of general obligations, and particular constitutional arrangements may have yielded in Canada's case a recipe for just such a cake. Time will tell.
Max Jarvie Senior Associate
BLG LLP, Montréal
1. United States-Mexico-Canada Agreement, concluded in Buenos Aires on 30 November 2018, as amended by the Protocol of Amendment to the Agreement between Canada, the United States of America, and the United Mexican States, concluded in Mexico City on 10 December 2019 [USMCA].
2. Current proposed date of entry into force is 1 July 2020: see e.g. 'New USMCA trade pact to go into effect on July 1,' Financial Post, 27 April 2020, online: https://business.financialpost.com/news/economy/update-1-new-north-american-trade-pact-to-take-effect-july-1-ustr
3. See supra footnote 1.
4. Scassa, Teresa, 'The USMCA locks Canada in on digital trade-and at a worrying time' Maclean's Magazine, 3 October 2018.
5. Keitner, Chimene & Clark, Harry 'Cybersecurity and Trade Agreements: The State of
the Art' 10 Harvard Bus L Rev Online 1 (2020). Federal government agencies have recognised the potential effect of international trade agreements on their activities in the past. For example, the federal government guidance document last updated in 2010 entitled 'Taking Privacy into Account Before Making Contracting Decisions' notes that international trade agreements may sometimes apply to a given procurement, with the practical effect that in some circumstances government institutions would not be able to require that information be retained in Canada. See: Taking Privacy into Account Before Making Contracting Decisions, Section 2.2.
6. See: https://www.ic.gc.ca/eic/site/062.nsf/eng/h_00107.html
7. It has been remarked that the USMCA creates frictions with the requirements of the GDPR that could result in the loss of an adequacy decision: see Greenleaf, Graham, 'Asia-Pacific Free Trade Deals Clash with GDPR and Convention 108' 156 Privacy Laws & Business International Report 22-24, 30 November 2018. Available at SSRN: https://ssrn.com/abstract=3352288 or http://dx.doi.org/10.2139/ssrn.3352288. Canada's adequacy decision, like that of several other countries, is under review as part of a more general review of the GDPR two years after coming into force. The review was due 25 May 2020 but its publication has apparently been delayed.
8. USMCA, Article 19.11.
9. See Comprehensive and Progressive Agreement for Trans-Pacific Partnership, Article 14.11, online: 'Consolidated TPP Text - Chapter 14 - Electronic Commerce' https://www.international.gc.ca/trade-commerce/trade-agreements-accords-commerciaux/agr-acc/tpp-ptp/text-texte/14.aspx?lang=eng&_ga=2.28537336.55938689.1590951819-1446749693.1590951819
10. In at least one case, those transformations have been criticised. See Scassa, Teresa 'The USMCA locks Canada in on digital trade-and at a worrying time' 3 October 2018, Maclean's Magazine ('The TPP provides that parties 'shall allow the transfer of information by electronic means, including personal information' for business purposes. The USMCA changes this to say that 'No party shall prohibit or restrict' such transfers.')
11. Supra footnote 10.
12. USMCA, Article 19.12.
13. See: http://www.michaelgeist.ca/2018/10/how-canada-surrendered-policy-flexibility-for-data-localizationrules-in-the-usmca/
14. Ibid, Article 14.13(1).
15. USMCA, Article19.2(3).
16. The Direction requires that all sensitive electronic data under government control, that has been categorised as Protected B, Protected C, or Classified, be stored in a Government of Canada approved computing facility located within the geographic boundaries of Canada or within the premises of a Government of Canada department located abroad, such as a diplomatic or consular mission. Protected A, B, and C data definitions all contemplate personal information. See the Government of Canada publications Direction for Electronic Data Residency and Policy on Management of Information Technology; see also Levels of Security https://www.tpsgc-pwgsc.gc.ca/esc-src/protection-safeguarding/niveaux-levels-eng.html
17. It should be mentioned that this otherwise valid concern may have less weight in the case of Canada, in virtue of its membership in the Five Eyes through the United Kingdom - United States of America Agreement, under which it cooperates in sharing signals intelligence with the United States among others.
18. Depending on how this hypothetical prohibition on transfers is constructed, there could be counterarguments to that position. For instance, if it were a prohibition on transfers to the US only, it could not be regarded as a constructive attempt to require the use of Canadian computing facilities for storage or processing. US companies doing business in Canada could instead use a computing facility in Ireland that is subject to the GDPR.
19. Set out in Annex 1B to the Marrakesh Agreement Establishing the World Trade Organization, concluded at Marrakesh on 15 April 1994.
20. See: http://www.michaelgeist.ca/2018/10/how-canada-surrendered-policy-flexibility-for-data-localizationrules-in-the-usmca/
21. See: https://fipa.bc.ca/the-usmca-and-fippa/
22. NAFTA Article 105.
23. CETA, Article 1.8 ('Each Party shall ensure that all necessary measures are taken in order to give effect to the provisions of this Agreement, including their observance at all levels of government.')
24. USMCA Chapter 14, on Investment, provides at Article 14.2(2) that '[a] Party's obligations under this Chapter shall apply to measures adopted or maintained by the central, regional, or local governments or authorities of that Party.'
25. USMCA, Article 1.4.
26. See e.g. 'NAFTA-USMCA-TPP Comparison Chart' 2018, published by Lexsage Professional Corporation, online: https://www.lexsage.com/documents/USMCA%20-%20NAFTA%20-%20TPP%20Comparison%20Chart%20-%20Chapter%201.pdf. The chart refers to Article 1.3 rather than 1.4, as it predates the later Protocol of Amendment to the Agreement between Canada, the United States of America and the United Mexican States, concluded at Mexico City on 10 December 2019 that brought a new 1.3 to the USMCA.
27. CETA Article. 1.10.
28. If a treaty concerns a domestic power constitutionally allocated to provincial jurisdiction, in respect of that power, the Federal Parliament may not legislate: this was, in a nutshell, the outcome of a judgment by the Privy Council, A. G. Canada v. A. G. Ontario (1937) A.C. 326,  1 D.L.R. 673 (P.C.). In that case, the Canadian government had approved several international labour conventions. Parliament had passed legislation to implement each of them into Canadian domestic law. The provinces challenged these laws on the grounds that the legislation intruded into their constitutionally-founded exclusive jurisdiction. The Privy Council decided that Parliament could not pass such legislation, even in order to implement Canada's international obligations under the several conventions, because the provinces have exclusive jurisdiction over labour.
29. U.S. Constitution Article VI, cl. 2.; Maryland v. Louisiana, 451 U. S. 725, 746 (1981).
30. Scott, S.A. 'NAFTA, the Canadian Constitution, and the Implementation of International Trade Agreements' in Beyond NAFTA: an Economic, Political and Sociological Perspective, A.R. Riggs and T. Velk, eds., 1993, pp. 239-42. The implementation issues associated with NAFTA were foreseen by the Federal government even before coming into force; see Dupras, Daniel, NAFTA: Implementation and the Participation of the Provinces (1993) online: http://dsp-psd.pwgsc.gc.ca/Collection-R/LoPBdP/BP/bp324-e.htm
31. Herman, Lawrence, C.D. Howe Institute, 'Trend Spotting: NAFTA Disputes After Fifteen Years' Backgrounder, July 2010, available at http://papers.ssrn.com/sol3/papers.cfim?abstractid=1706256.
32. USMCA does not incorporate GATS article I(3), which provides such best-efforts language.
33. Sections 92(13) and 92(16) of the Constitution Act of 1867.