Jusletter IT

The landscape of digital trade regulation has changed profoundly in the last decade due to the increased value associated with trading goods and services online, as well as distinct new phenomena that stem from the evolution of the data-driven economy. Switzerland has not been a proactive actor in this landscape and, for a highly industrialized and innovative economy, lags behind in regulatory entrepreneurship and geopolitical positioning in this new but ever more important domain of international economic law. The article seeks to shed light on this mismatch. It first traces the evolution of global digital trade rulemaking by exploring the regulatory models endorsed by free trade agreements (FTAs) that have become particularly distinctive and far-reaching after the 2018 Comprehensive and Progressive Trans-Pacific Partnership Agreement (CPTPP). The article seeks thereby to also outline the positioning of the major actors in the field with a focus on the United States (US), the European Union (EU) and China but also by looking at other proactive players, such as Singapore and the United Kingdom (UK). The article turns then to Switzerland and examines its extant network of FTAs and the provisions pertinent to the regulation of the data-driven economy, which, as will be shown, are only few, albeit on the rise. The article concludes with some recommendations on the paths forward for Swiss external trade policies that must be in many aspects updated to suit the demands of a global data-dependent economy and to adequately reflect Swiss economic and societal interests and values.

Despite the frequently shared understanding in the analyses of international law that states struggle to agree on common matters,¹ it is also true that the past two decades have witnessed a proliferation of rules and regulatory fora – of a soft and hard,² of a formal and informal nature.³ With regard to trade, the lack of progress within the multilateral context of the World Trade Organization (WTO) has driven and continues to drive countries to seek other venues that better reflect their interests and allow for speedier solutions. Global trade law and policy reflect this regime shift⁴ and can be distinguished by the great and growing number of preferential treaties, agreed upon bilaterally, regionally or between country groups.⁵ Importantly, in many of these agreements «electronic commerce» or «digital trade»⁶ issues have formed an essential part of the reasoning behind seeking the agreement, as well as of the content of the agreement itself.

This evolution has been spurred by the progressively advancing digitization of economies and societies as a whole, as well as by the interlinked but more recently acknowledged importance of data.⁷ In the context of trade policies, this has translated into efforts that ensure that data flows across borders, as data is embedded in a growing number of services and goods and there is a critical interdependence between cross-border data flows and digital growth and innovation – for instance, in the development of artificial intelligence (AI) or the Internet of Things (IoT).⁸ The second reason behind the intensified digital trade rulemaking can be linked to the new set of regulatory questions that the use of data and its borderless nature⁹ have opened – in particular those around data sovereignty and the protection of privacy, national security and other domestic values and interests.¹⁰ Critical in this context, as the article reveals below, is that the emerging digital trade law seeks to address regulatory issues that go beyond classical WTO topics – such as reduction of tariffs or services liberalization, and ultimately calibrates the domestic regimes.

As noted earlier, and despite the fact that the WTO law is in many ways relevant for online trade,¹¹ the contemporary regulatory for digital trade has been shaped by FTAs. Of the 432 FTAs signed between January 2000 and November 2023, 214 contain provisions relevant for e-commerce/digital trade, and 122 have dedicated e-commerce/digital trade chapters,¹² with the significant jump in these commitments occurring in the past few years. Although the pertinent rules are still heterogeneous and differ as to issues covered, the level of commitments and their binding nature, it is overall evident that the trend towards more and more detailed provisions on digital trade has intensified significantly over the years.¹³ The new generation of Digital Economy Agreements (DEAs), which this article discusses below, is also indicative of the unfolding legal innovation and illustrates well the broader spectrum of regulatory matters that have become important in the data-driven economy and that countries seek to collectively address.

Geopolitically, the surge in digital trade rulemaking can be well explained by the proactive role played by the US,¹⁴ ever since the launch of its «Digital Agenda»¹⁵ in 2001.¹⁶ A great number of other countries have followed suit and adopted the US template¹⁷ but some have also become proactive in their own right, with Singapore turning into the leading legal entrepreneur in the field in recent years. The EU, although to be reckoned with as a major actor in international economic law and policy, has interestingly been a latecomer into the digital trade rulemaking domain, as the article reveals below, but has now a clear and definitive stance. Developing countries have been also been somewhat slower in addressing digital trade issues. Yet, recent initiatives, such as the Regional Comprehensive Economic Partnership (RCEP), the Digital Trade Protocol of the Agreement Establishing the African Continental Free Trade Area (AfCFTA), as well as the forthcoming ASEAN negotiations towards a Digital Economy Framework Agreement (DEFA), illustrate well that there is a process of catching-up and that digital trade policies play an increasingly important role in regional integration.

In the following sections, the article looks at the new rules created in recent agreements through a detailed analysis of the most advanced electronic commerce/digital trade chapters¹⁸ thus far – those of the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), the United States-Mexico-Canada Agreement (USMCA), and the dedicated DEAs. We complement this analysis with an enquiry into the EU treaties and the EU’s repositioning on data flows in particular, and into the RCEP as the first agreement with digital trade provisions to include China. The purpose is two-prong – on the one hand, to highlight the depth of commitments and legal innovation in these treaties and to give a sense of the positions of the major stakeholders, on the other.

The CPTPP was agreed upon in 2017 between eleven countries in the Pacific Rim¹⁹ and entered into force on 30 December 2018. This «mega-regional» was originally conceived as the Transpacific Partnership Agreement (TPP) with the participation of the US, which, however, withdrew from the treaty negotiations with the start of the Trump administration. Nonetheless, the CPTPP e-commerce chapter is a verbatim reiteration of its TPP draft and in this sense reflects the US efforts under its updated «Digital 2 Dozen» agenda²⁰ to secure far-reaching obligations on digital trade.²¹ Importantly for this article’s discussion, the CPTPP electronic commerce chapter created at the time the most comprehensive template in the FTA landscape and deserves a closer look, as many of the subsequent agreements are compared with it, as to whether they go «CPTPP-plus» or «CPTPP-minus».²²

In the first part and not unusually for US-led and other FTAs, the CPTPP electronic commerce chapter clarifies that it applies «to measures adopted or maintained by a Party that affect trade by electronic means»²³ but excludes from this broad scope (1) government procurement and (2) information held or processed by or on behalf of a Party, or measures related to such information, including measures related to its collection.²⁴ For greater certainty, measures affecting the supply of a service delivered or performed electronically are subject to the obligations contained in the relevant provisions on investment and services;²⁵ some additional exceptions are also specified.²⁶ The following provisions address, again as customarily, some of the leftovers of the 1998 WTO Work Programme on Electronic Commerce²⁷ and provide for the facilitation of online commerce. In this sense, Article 14.3 CPTPP bans the imposition of customs duties on electronic transmissions, including content transmitted electronically, and Article 14.4 endorses the non-discriminatory treatment of digital products,²⁸ which are defined broadly pursuant to Article 14.1.²⁹ Article 14.5 CPTPP is meant to shape the domestic electronic transactions framework by including binding obligations for the parties to follow the principles of the UNCITRAL Model Law on Electronic Commerce 1996 or the UN Convention on the Use of Electronic Communications in International Contracts. Parties must endeavour to (1) avoid any unnecessary regulatory burden on electronic transactions; and (2) facilitate input by interested persons in the development of its legal framework for electronic transactions.³⁰ The provisions on paperless trading and on electronic authentication and electronic signatures complement this by securing equivalence of electronic and physical forms. With regard to paperless trading, it is clarified that parties shall endeavour to make trade administration documents available to the public in electronic form and accept trade administration documents submitted electronically as the legal equivalent of the paper version.³¹ The norm on electronic signatures is more binding and provides that parties shall not deny the legal validity of a signature solely on the basis that the signature is in electronic form,³² nor shall they adopt or maintain measures that prohibit parties to an electronic transaction from mutually determining the appropriate authentication methods for that transaction; or prevent such parties from having the opportunity to establish before judicial or administrative authorities that their transaction complies with legal requirements with respect to authentication.³³

The remainder of the provisions found in the CPTPP electronic commerce chapter can be said to belong to a more innovative category of rulemaking that tackles the emergent issues of the data-driven economy. Most importantly, the CPTPP explicitly seeks to curb data protectionism. First, it does so through an explicit ban on the use of data localization measures that seek to keep data within states’ territories, which have in recent years proliferated for a variety of reasons.³⁴ Specifically, Article 14.13(2) CPTPP prohibits the parties from requiring a «covered person to use or locate computing facilities in that Party’s territory as a condition for conducting business in that territory». Second, the CPTPP frames a hard rule on free data flows in the sense that: «[e]ach Party shall allow the cross-border transfer of information by electronic means, including personal information, when this activity is for the conduct of the business of a covered person».³⁵ The rule has a broad scope and most data transferred over the Internet is likely to be covered.

Measures restricting data flows or implementing localization requirements are permitted only if they do not amount to «arbitrary or unjustifiable discrimination or a disguised restriction on trade» and do not «impose restrictions on transfers of information greater than are required to achieve the objective».³⁶ These non-discriminatory conditions are similar to the strict test formulated by Article XIV GATS and Article XX GATT 1994 – a test that is supposed to balance trade and non-trade interests by «excusing» certain violations, but that is also extremely hard to pass, as the WTO jurisprudence has thus far revealed.³⁷ The CPTPP test differs from the WTO norms in two significant elements: (1) while there is a list of public policy objectives in the GATT 1994 and the GATS, the CPTPP provides no such enumeration and simply refers to a «legitimate public policy objective»;³⁸ (2) in the chapeau-like reiteration of «arbitrary or unjustifiable discrimination», there is no GATT or GATS-like qualification of «between countries where like conditions prevail». The scope of the exception is thus not entirely clear³⁹ – it can be linked to legal uncertainty, as well as to potentially unworkable safeguards for domestic constituencies, as pointed out by the New Zealand’s Waitangi Tribunal with regard to the data governance rights of the Māori.⁴⁰ Lastly, it should be noted that the ban on localization measures is softened on financial services and institutions.⁴¹ An annex to the Financial Services chapter has a separate data transfer requirement, whereby certain restrictions on data flows may apply for the protection of privacy or confidentiality of individual records, or for prudential reasons.⁴² Government procurement is also excluded.⁴³

The CPTPP addresses other issues as well that were erstwhile novel – one of them is source code. Pursuant to Article 14.17, a CPTPP Member may not require the transfer of, or access to, source code of software owned by a person of another Party as a condition for the import, distribution, sale or use of such software, or of products containing such software, in its territory. The prohibition applies only to mass-market software or products containing such software.⁴⁴ This means that tailor-made products are excluded, as well as software used for critical infrastructure and those in commercially negotiated contracts.⁴⁵ The aim of this provision is to protect software companies and address their concerns about loss of intellectual property (IP) or cracks in the security of their proprietary code; it may also be interpreted as a reaction to China’s demands for access to source code from software producers selling in its market.⁴⁶

These provisions illustrate an important development in the FTA rulemaking in that, they do not merely seek the reduction of trade barriers but effectively shape the regulatory space domestically. Particularly critical in this context are also the rules in the area of data protection. Article 14.8(2) requires every CPTPP party to «adopt or maintain a legal framework that provides for the protection of the personal information of the users of electronic commerce». Yet, there are no standards or benchmarks for the legal framework specified, except for a general requirement that CPTPP parties «take into account principles or guidelines of relevant international bodies».⁴⁷ A footnote provides some clarification in saying that: «… a Party may comply with the obligation in this paragraph by adopting or maintaining measures such as a comprehensive privacy, personal information or personal data protection laws, sector-specific laws covering privacy, or laws that provide for the enforcement of voluntary undertakings by enterprises relating to privacy».⁴⁸ Parties are also invited to promote compatibility between their data protection regimes, by essentially treating lower standards as equivalent.⁴⁹ The goal of these norms can be interpreted as a prioritization of trade over privacy rights. This has been pushed by the US during the TPP negotiations, as the US subscribes to a relatively weak and patchy protection of privacy.⁵⁰ Timewise, this push also came at the phase, when the US was wary that it could lose the privilege of transatlantic data transfer, as a consequence of the judgment of the Court of Justice of the European Union (CJEU) that struck down the EU-US Safe Harbour Agreement.⁵¹

Next to these important data protection provisions, the CPTPP also includes norms on consumer protection⁵² and spam control,⁵³ as well as rules on cybersecurity. Article 14.16 is, however, non-binding and identifies a limited scope of activities for cooperation in the area of cybersecurity, in situations of «malicious intrusions» or «dissemination of malicious code», and capacity-building of governmental bodies dealing with cybersecurity incidents. Net neutrality is another important digital economy topic that has been given specific attention in the CPTPP, although the so created rules are of a non-binding nature.⁵⁴

The 2023 accession of the UK to the CPTPP and pending applications by a number of countries, such as China, Taiwan, Ecuador and Costa Rica,⁵⁵ expand the commercial reach and geopolitical dimension of this agreement. Next to these possibilities for an enlarged CPTPP membership, it should also be pointed out that the CPTPP model has diffused in a substantial number of other agreements, such as the 2016 Chile-Uruguay FTA, the 2016 updated Singapore-Australia FTA (SAFTA), the 2017 Argentina-Chile FTA, the 2018 Singapore-Sri Lanka FTA, the 2018 Australia-Peru FTA, the 2019 Brazil-Chile FTA, the 2019 Australia-Indonesia FTA, the 2018 USMCA, the 2019 Japan-US Digital Trade Agreement, as well as in a number of DEAs. In the following, the article discusses first at the USMCA and then looks at selected DEAs.

After the withdrawal of the US from the TPP, there was some uncertainty as to the direction the country will follow in its trade deals in general and on matters of digital trade in particular. The renegotiated NAFTA, which is now referred to as the «United States-Mexico-Canada Agreement» (USMCA), provides a useful confirmation of the US approach. The USMCA has a comprehensive electronic commerce chapter, which is now also properly titled «Digital Trade». It follows all critical lines of the CPTPP and creates an even more ambitious template. With regard to replicating the CPTPP model, the USMCA follows the same broad scope of application,⁵⁶ bans customs duties on electronic transmissions⁵⁷ and binds the parties for non-discriminatory treatment of digital products.⁵⁸ Furthermore, it provides for a domestic regulatory framework that facilitates online trade by enabling electronic contracts,⁵⁹ electronic authentication and signatures,⁶⁰ and paperless trading.⁶¹

The USMCA adheres to the CPTPP model also with regard to data issues and ensures the free flow of data through a clear ban on data localization⁶² and a hard rule on free information flows.⁶³ Article 19.11 specifies further that parties can adopt or maintain a measure inconsistent with the free flow of data provision, if this is necessary to achieve a legitimate public policy objective, provided that there is no arbitrary or unjustifiable discrimination nor a disguised restriction on trade; and the restrictions on transfers of information are not greater than necessary to achieve the objective.⁶⁴

Beyond these similarities, the USMCA introduces some novelties. The first is that the USMCA departs from the standard US approach and signals abiding to some data protection principles and guidelines of relevant international bodies. After recognizing «the economic and social benefits of protecting the personal information of users of digital trade and the contribution that this makes to enhancing consumer confidence in digital trade»⁶⁵, Article 19.8 USMCA requires from the parties to «adopt or maintain a legal framework that provides for the protection of the personal information of the users of digital trade. In the development of its legal framework for the protection of personal information, each Party should take into account principles and guidelines of relevant international bodies, such as the APEC Privacy Framework and the OECD Recommendation of the Council concerning Guidelines governing the Protection of Privacy and Transborder Flows of Personal Data (2013)».⁶⁶ The parties also recognize key principles of data protection, which include: limitation on collection; choice; data quality; purpose specification; use limitation; security safeguards; transparency; individual participation; and accountability,⁶⁷ and aim to provide remedies for any violations.⁶⁸ This is interesting because it may go beyond what the US has in its national laws on data protection (at least so far⁶⁹) and also because it reflects some of the principles the EU has advocated for in the domain of privacy protection, not only within the boundaries of the Union but also under the Council of Europe. One can of course wonder whether this is a development caused by the so-called «Brussels effect», whereby the EU «exports» its own domestic standards and they become global,⁷⁰ or whether we are seeing a shift in US privacy protection regimes as well.⁷¹

Beyond data protection, three further innovations of the USMCA may be mentioned. The first refers to the inclusion of «algorithms», the meaning of which is «a defined sequence of steps, taken to solve a problem or obtain a result»⁷² and has become part of the ban on requirements for the transfer or access to source code in Article 19.16.⁷³ The second novum refers to the recognition of «interactive computer services» as particularly vital to the growth of digital trade. Parties pledge in this sense not to «adopt or maintain measures that treat a supplier or user of an interactive computer service as an information content provider in determining liability for harms related to information stored, processed, transmitted, distributed, or made available by the service, except to the extent the supplier or user has, in whole or in part, created, or developed the information».⁷⁴ This provision is important, as it seeks to clarify the liability of intermediaries and delineate it from the liability of host providers with regard to IP rights’ infringement. It also secures the application of Section 230 of the US Communications Decency Act,⁷⁵ which insulates platforms from liability⁷⁶ but has been recently under attack in many jurisdictions (including in the US⁷⁷) in the face of fake news and other negative developments related to platforms’ power.⁷⁸

The third and rather liberal commitment of the USMCA parties is with regard to open government data. This is truly innovative and very relevant in the domain of domestic regimes for data governance. In Article 19.18, the parties recognize that facilitating public access to and use of government information fosters economic and social development, competitiveness, and innovation. «To the extent that a Party chooses to make government information, including data, available to the public, it shall endeavour to ensure that the information is in a machine-readable and open format and can be searched, retrieved, used, reused, and redistributed».⁷⁹ There is in addition an endeavour to cooperate, so as to «expand access to and use of government information, including data, that the Party has made public, with a view to enhancing and generating business opportunities, especially for small and medium-sized enterprises».⁸⁰ Finally, it can be mentioned that the cooperation provision of the USMCA goes beyond the CPTPP⁸¹ and envisages an institutional setting to enable this cooperation, «or any other matter pertaining to the operation of this chapter».⁸²

The US approach towards digital trade issues has been confirmed by the US-Japan Digital Trade Agreement (DTA), signed on 7 October 2019, alongside the US-Japan Trade Agreement.⁸³ The US-Japan DTA replicates almost all provisions of the USMCA and the CPTPP,⁸⁴ including the rules on open government data,⁸⁵ source code⁸⁶ and interactive computer services⁸⁷ but notably covering also financial and insurance services as part of the scope of the agreement. In the current WTO negotiations on electronic commerce under the 2019 Joint Initiative,⁸⁸ the US had initially endorsed an ambitious template, which was essentially a compilation of the USMCA and the DTA.⁸⁹ As to the future US position on digital trade, there appears at this point of time to be some uncertainty. First, it is unclear whether the US would join and/or try to renegotiate the CPTPP, as there is some uncertainty moving towards the end of the Biden administration, the US appears to engage in broader and less binding cooperation initiatives,⁹⁰ such as the Indo-Pacific Economic Framework for Prosperity (IPEF).⁹¹ Second and more importantly for the WTO context, the US has recently announced that it will disengage in the negotiations on the topics of data flows, data localization and source code, as it needs «policy space» for a digital trade rethink.⁹²

The increased preoccupation of policymakers with digital trade issues can be perhaps best exemplified by the emergent generation of the so-called «Digital Economy Agreements» (DEAs). This is a relatively new phenomenon in the trade rulemaking landscape and so far, only six such treaties have been adopted – the aforementioned US-Japan DTA; the 2019 ASEAN Agreement on Electronic Commerce (within the context of ASEAN); the 2020 Singapore-Australia Digital Economy Agreement (ASDEA); the 2020 Digital Economy Partnership Agreement (DEPA) between Chile, New Zealand, Singapore; the 2021 Korea-Singapore DEA and the 2022 UK-Singapore DEA. What is key to mention at the outset is that these agreements can be adopted as stand-alone initiatives, such as the DEPA, or as part of existing or new trade agreements, such as the ones between Singapore and Australia, and the UK and Singapore. The DEAs may also differ in scope and the extent to which they include new items on the regulation of the data-driven economy. So, while for instance the US-Japan DTA still very much resembles a conventional, albeit extended, digital trade chapter, the ASDEA, the DEPA, the UK-Singapore DEA go beyond this and engage in entirely new areas of regulatory cooperation, including a mixed set of hard and soft law provisions. This section looks more closely at the DEPA as a representative of this latter category and as a model of innovative digital trade rulemaking.

The 2020 DEPA between Chile, New Zealand, and Singapore,⁹³ all parties also to the CPTPP, is, as earlier noted, not conceptualized as a purely trade agreement but one that is meant to address the broader issues of the digital economy. In this sense, its scope is wide, open and flexible and covers several emergent issues, such as those in the areas of artificial intelligence (AI) and digital inclusion. The agreement is also not a closed deal but one that is open to other countries⁹⁴ and the DEPA is meant to complement the WTO negotiations on electronic commerce and build upon the digital economy work underway within APEC, the OECD and other international forums. To enable flexibility and cover a wide range of issues, the DEPA follows a modular approach that provides countries with more options to pick-and-choose and is very different from the «all-or-nothing» approach of conventional trade treaties.⁹⁵ After Module 1, specifying general definitions and initial provisions, Module 2 focuses on «Business and Trade Facilitation»; Module 3 covers «Treatment of Digital Products and Related Issues»; Module 4 «Data Issues»; Module 5 «Wider Trust Environment»; Module 6 «Business and Consumer Trust»; Module 7 «Digital Identities»; Module 8 «Emerging Trends and Technologies»; Module 9 «Innovation and the Digital Economy»; Module 10 «Small and Medium Enterprises Cooperation»; and Module 11 «Digital Inclusion». The rest of the modules deal with the operationalization and implementation of the DEPA and cover common institutions (Module 12); exceptions (Module 13); transparency (Module 14); dispute settlement (Module 15); and some final provisions on amendments, entry into force, accession and withdrawal (Module 16).

The type of rules varies across the different modules. On the one hand, all rules of the CPTPP are replicated, some of the USMCA rules, such as the one on open government data⁹⁶ (but not source code), and some of the US-Japan DTA provisions, such as the one on ICT goods using cryptography,⁹⁷ have been included too. On the other hand, there are many other rules – so far unknown to trade agreements – that try to facilitate the functioning of the digital economy and enhance cooperation on key issues. So, for instance, Module 2 on business and trade facilitation includes next to the standard CPTPP-like norms,⁹⁸ additional efforts «to establish or maintain a seamless, trusted, high-availability and secure interconnection of each Party’s single window to facilitate the exchange of data relating to trade administration documents, which may include: (a) sanitary and phytosanitary certificates and (b) import and export data».⁹⁹ Parties have also touched upon other important issues around digital trade facilitation, such as electronic invoicing (Article 2.5); express shipments and clearance times (Article 2.6); logistics (Article 2.4) and electronic payments (Article 2.7). Module 8 on emerging trends and technologies is also particularly interesting to mention, as it highlights a range of key topics that demand attention by policymakers, such as in the areas of fintech and AI. In the latter domain, the parties agree to promote the adoption of ethical and governance frameworks that support the trusted, safe, and responsible use of AI technologies, and in adopting these AI Governance Frameworks parties would seek to follow internationally-recognized principles or guidelines, including explainability, transparency, fairness, and human-centred values.¹⁰⁰ The DEPA parties also recognize the interfaces between the digital economy and government procurement and broader competition policy and agree to actively cooperate on these issues.¹⁰¹ Along this line of covering broader policy matters in order to create an enabling environment that is also not solely focused on and driven by economic interests, DEPA deals with the importance of a rich and accessible public domain¹⁰² and digital inclusion, which can cover enhancing cultural and people-to-people links, including between Indigenous Peoples, as well as improving access for women, rural populations, and low socio-economic groups.¹⁰³

Overall, the DEPA is a unique project¹⁰⁴ that covers well the broad range of issues that the digital economy impinges upon and offers a good basis for harmonization and interoperability of domestic frameworks and international cooperation that adequately takes into account the complex challenges of contemporary data governance that has essential trade but also non-trade elements. Its appeal as a form of enhanced, but also flexible, cooperation on issues of the data-driven economy has been confirmed by Canada’s¹⁰⁵ and South Korea’s¹⁰⁶ interest to join it, as well as by the follow-up similar DEAs, such as the ones between the UK and Singapore and between Australia and Singapore. Geopolitically, the DEAs show that there is a shift in the landscape of digital trade rulemaking from traditional digital trade legal demanders, such as notably the US, to new actors. The DEAs are predominantly being developed by dynamic countries seeking to capitalize on the economic potential of the digital economy, and Singapore in particular (as party to all but one DEA) has become the leader in this effort with the UK following suit and imitating this proactive stance.¹⁰⁷

The EU has been a relatively late mover on digital trade issues, despite having a wide-ranging domestic framework for the regulation of the data economy, and for a long time had not developed a distinct strategy. Although EU’s FTAs did include provisions on electronic commerce, such as the 2002 agreement with Chile, the language tended to be cautious, with commitments not exceeding GATS levels, and limited to soft cooperation pledges in the services chapter¹⁰⁸ and in the fields of information technology, information society and telecommunications.¹⁰⁹ In more recent agreements, such as the EU-South Korea FTA (signed in 2009), the language is more concrete and binding, imitating some of the US template provisions – for instance, by confirming the applicability of the WTO Agreements to measures affecting electronic commerce and subscribing to a permanent duty-free moratorium on electronic transmissions. Cooperation is also increasingly framed in more concrete terms and includes mutual recognition of electronic signatures certificates, coordination on Internet service providers’ liability, consumer protection, and paperless trading.¹¹⁰ The EU, as particularly insistent on data protection policies, has also sought commitment from its FTA partners to seek compatibility with the international standards of data protection.¹¹¹

The 2016 EU agreement with Canada – the Comprehensive Economic and Trade Agreement (CETA) – goes a step further. The CETA provisions concern commitments ensuring (a) clarity, transparency and predictability in their domestic regulatory frameworks; (b) interoperability, innovation and competition in facilitating electronic commerce; as well as (c) facilitating the use of electronic commerce by small and medium sized enterprises.¹¹² The EU has succeeded in deepening the privacy commitments and the CETA has a specific norm on trust and confidence in electronic commerce, which obliges the parties to adopt or maintain laws, regulations or administrative measures for the protection of personal information of users engaged in electronic commerce in consideration of international data protection standards.¹¹³ Yet, there are no deep commitments on digital trade; nor there are any rules on data and data flows.¹¹⁴

It is only very recently that the EU took up a more modern, CPTPP-comparable, approach towards the regulation of digital trade. Some indications for this turn were given by the 2018 EU-Japan Economic Partnership Agreement (EPA)¹¹⁵ and the modernization of the trade part of the EU-Mexico Global Agreement, where for the first time data flows were mentioned but still cautiously, as the Parties only committed to «reassess» within three years of the entry into force of the agreement, the need for actually including provisions on the free flow of data. The new EU approach towards the issue of cross-border data is now fully endorsed in the EU’s currently negotiated deals with Australia and Tunisia, and the 2022 agreement with New Zealand and the 2023 agreement with Chile. These FTAs’ digital trade chapters include norms on data and data localization bans. This repositioning and newer commitments are, however, also linked with high levels of data protection.¹¹⁶

The EU wishes to permit data flows only if coupled with the high standards of its General Data Protection Regulation (GDPR)¹¹⁷ and endorses a distinct model of privacy as a fundamental right. While the EU and its partners seek to permit the flow of data, these commitments are conditioned: first, by a dedicated article on data protection, which clearly states that: «Each Party recognises that the protection of personal data and privacy is a fundamental right and that high standards in this regard contribute to trust in the digital economy and to the development of trade»,¹¹⁸ followed by a paragraph on data sovereignty: «Each Party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through the adoption and application of rules for the cross-border transfer of personal data. Nothing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards».¹¹⁹ The EU also wishes to retain the right to see how the implementation of the provisions on data flows impact the conditions of privacy protection, so there is a review possibility within three years of the entry into force of the agreement, and parties remain free to propose to review the list of restrictions at any time.¹²⁰ In addition, there is a broad carve-out, in the sense that: «The Parties reaffirm the right to regulate within their territories to achieve legitimate policy objectives, such as the protection of public health, social services, public education, safety, the environment including climate change, public morals, social or consumer protection, privacy and data protection, or the promotion and protection of cultural diversity».¹²¹ The EU thus reserves ample regulatory leeway for its current and future data protection (and other) measures. The exception is also fundamentally different than the objective necessity test under the CPTPP and the USMCA, or that under WTO law, because it is subjective and safeguards the EU’s right to regulate.¹²²

The new EU approach was first confirmed by the post-Brexit Trade and Cooperation Agreement (TCA) with the United Kingdom,¹²³ which replicates all the above provisions, except for the explicit mentioning of data protection as a fundamental right – which can be however presumed, since the UK incorporates the European Convention on Human Rights (ECHR) through the Human Rights Act of 1998 into its domestic law.¹²⁴ Yet, as the UK seems to be moving away from the EU FTA model as well as from the GDPR standards domestically, this presumption may be somewhat questioned and may create problems for data flows going across the Channel.

Beyond the topic of data flows and its interface with data protection, it should be noted that the rest of the EU digital trade template includes the issues covered by the CPTPP/USMCA model, such as software source code,¹²⁵ facilitation of electronic commerce,¹²⁶ online consumer protection,¹²⁷ spam¹²⁸ and open government data;¹²⁹ not including however a provision on non-discrimination of digital products and excluding audiovisual services from the scope of the application of the digital trade chapter.¹³⁰ This TCA template is also the one that the EU has endorsed under the WTO electronic commerce negotiations.¹³¹ The EU is also engaging in other, not strictly trade-related, channels to further its digital sovereignty (including important technological aspects) and ensure the protection of its citizens’ rights. In the latter sense, this occurs through the negotiation and adoption of adequacy decisions with countries that must secure an equivalent level of personal data protection (Switzerland being notably one of these countries).¹³² The former channel is through the newly endorsed digital partnership agreements, such as those with Japan and Singapore,¹³³ that address issues around semiconductors, digital trust, standards, digital trade facilitation, digital skills for workers, and the digital transformation of businesses and public services.

An interesting development against the backdrop of the diverging, at least on data flows, EU and US positions has been the Regional Comprehensive Economic Partnership (RCEP) signed on 15 November 2020 between the ASEAN Members,¹³⁴ China, Japan, South Korea, Australia and New Zealand and in force since 1 January 2022.¹³⁵ Chapter 12 of the RCEP includes the relevant electronic commerce rules. In a similar fashion to the CPTPP, it clarifies its application «to measures adopted or maintained by a Party that affect trade by electronic means» but excludes from this broad scope (1) government procurement and (2) information held or processed by or on behalf of a Party, or measures related to such information, including measures related to its collection. In addition, key provisions on the location of computing facilities and the cross-border transfer of information by electronic means apply in conformity with obligations established in the chapters on trade in services (Chapter 8) and on investment (Chapter 10). The RCEP electronic commerce chapter rules are grouped into four areas: (1) trade facilitation; (2) creation of a conducive environment for electronic commerce; (3) promotion of cross-border electronic commerce; and (4) others.

With regard to trade facilitation, RCEP includes provisions on paperless trading,¹³⁶ on electronic authentication and electronic signatures.¹³⁷ On paperless trading, the RCEP Members avoid entering into binding commitments. They, instead, commit to «works toward», «endeavor», or «cooperate».¹³⁸ The norms on accepting the validity of electronic signatures are more binding but, in contrast to the CPTPP and USMCA, permit for domestic laws and regulations to provide otherwise and prevail in case of inconsistency. Regarding commitments to create a conductive environment for electronic commerce, the inclusion of provisions on online personal information protection¹³⁹ and cybersecurity¹⁴⁰ is remarkable. On the former, RCEP Members establish that they shall adopt or maintain a legal framework, which ensures the protection of personal information. Unsurprisingly, RCEP is not prescriptive as to how parties may comply with this obligation. As for the latter aspect on cybersecurity, the parties do not establish a binding provision but recognize the importance of building capabilities and using existing collaboration mechanisms to cooperate. The RCEP Members also commit to adopt or maintain laws or regulations regarding online consumer protection,¹⁴¹ unsolicited commercial electronic messages,¹⁴² and a framework governing electronic transactions that takes into account international instruments,¹⁴³ as well as commit to transparency.¹⁴⁴

The next grouping of RCEP provisions is critical, as it deals with cross-border data flows. In essence and actually similarly to the EU, the RCEP provides only for conditional data flows, while preserving room for domestic policies, which well may be of data protectionist nature. So, while the RCEP electronic commerce chapter includes a ban on localization measures,¹⁴⁵ as well as a commitment to free data flows,¹⁴⁶ there are clarifications that give RCEP Members a lot of policy space and essentially undermine the impact of the made commitments. In this line, there is an exception possible for legitimate public policies and a footnote to Article 12.14.3(a), which says that: «For the purposes of this subparagraph, the Parties affirm that the necessity behind the implementation of such legitimate public policy shall be decided by the implementing Party». This essentially goes against any exceptions assessment, as we know it under WTO law, and triggers a self-judging mechanism. In addition, subparagraph (b) of Article 12.14.3 says that the provision does not prevent a party from taking «any measure that it considers necessary for the protection of its essential security interests. Such measures shall not be disputed by other Parties».¹⁴⁷ Article 12.15 RCEP on cross-border transfer of information follows the same language and thus secures plenty of policy space, for countries like China or Vietnam, to control data flows without further justification.

Other provisions contained in the RCEP electronic commerce chapter include the establishment of a dialogue on electronic commerce¹⁴⁸ and a provision on dispute settlement,¹⁴⁹ which is separate from the general RCEP’s dispute settlement.¹⁵⁰ Noteworthy are also some things that are different or missing from the RCEP: in comparison to the CPTPP model, RCEP conditions the custom duties moratorium on the prevailing WTO practice; does not include non-discriminatory treatment of digital products, source code, principles on access to and use of the Internet for electronic commerce and Internet interconnection charge sharing. It is finally interesting to observe that the RCEP does not necessarily reflect China’s position in the WTO negotiations, where China has been more cautious and somewhat fuzzy,¹⁵¹ and not engaging in commitments on data flows. It is also interesting to contemplate how China’s wish to join the CPTPP and DEPA would impact the WTO negotiations as well as largely the landscape of digital trade rulemaking – perhaps tilting it towards national security and other carve-outs that diminish the value of the made commitments and prejudice legal certainty. Some authors think, on the other hand, that the RCEP is a good model that reflects domestic policy preferences, while opening up for digital trade. It has been argued that this pragmatic and incremental approach should not be viewed as inferior but rather as one that addresses well the existing variations in digital development levels across countries, «eventually leading to meaningful consensus-building and long-term engagement in complex areas of digital regulation».¹⁵²

In addition to the European Free Trade Association (EFTA) Convention and the Free Trade Agreement with the EU of 1973, Switzerland has an extensive network of preferential agreements comprising 34 FTAs with 45 partners.¹⁵³ Most of its agreements have been concluded together with its EFTA partners (Norway, Iceland and Liechtenstein). But Switzerland has also completed bilateral agreements in its own right – so far with the Faroe Islands, Japan, China and the UK. With regard to these deals, it can be broadly maintained that Switzerland has followed the EU model in most essential aspects, also because the rest of the EFTA members except for Switzerland are part of the European Economic Area (EEA) and thus bound by the EU acquis.¹⁵⁴ Yet, there are some clear differences too. The most striking one is that, in contrast to the EU, Switzerland has not formulated and implemented a distinct strategy with regard to digital trade in its current FTAs. Most of the existing agreements have no discrete electronic commerce chapters. Of all its FTAs that it has concluded since 2000 up to date, only two agreements have an electronic commerce chapter, while eleven out of the 34 Swiss FTAs have electronic commerce provisions.¹⁵⁵

In Switzerland’s EFTA deals, there are some relevant provisions but these are predominantly of soft law nature. In this sense, the FTA with the Member States of the Co-operation Council for the Arab States of the Gulf (GCC),¹⁵⁶ which entered into force in 2014, includes an annex to Article 9.3 «Electronic Commerce» that merely includes 3 provisions with regard to recognizing (a) the economic growth and opportunities that electronic commerce in goods and services provides, in particular for businesses and consumers, as well as the potential for enhancing international trade; (b) the importance of avoiding barriers to the use and development of electronic commerce in goods and services; and (c) the need to create an environment of trust and confidence for users of electronic commerce;¹⁵⁷ combined with provisions on exchange of information¹⁵⁸ and certain organizational channels, so as to enable to exchange of information.¹⁵⁹ In the same way, the FTA with Colombia includes a generic provision recognizing the importance of electronic commerce¹⁶⁰ with a reference to an annex of low normative value.¹⁶¹ The same is true about the 2011 EFTA FTA with Peru, which essentially contains identical norms.¹⁶² The 2014 agreement with the Central American states¹⁶³ duplicates these provisions¹⁶⁴ but includes a pledge whereby parties confirm their current practice under the WTO moratorium of not imposing customs duties on electronic transmissions¹⁶⁵ – again a provision with no real legal effect. The EFTA FTA with Turkey modernized in 2018 includes for the first time more substantive and detailed provisions in an annex to the agreement. It covers in particular a temporary customs duties moratorium¹⁶⁶; electronic signatures and certification¹⁶⁷; online consumer protection¹⁶⁸; norms on personal data protection and spam¹⁶⁹; paperless trading and e-commerce cooperation.¹⁷⁰ It should be noted that the rest of the EFTA deals, including the 2021 agreement with Indonesia, have no provisions on electronic commerce.¹⁷¹

The 2023 EFTA agreement with Moldova changes this cautious practice however and has a fully-fledged e-commerce chapter, which is the first implementation of the template agreed among the EFTA members. Chapter 5 reflects the structure and the substance of the EU model and covers: Definitions;¹⁷² Scope¹⁷³; General Provisions¹⁷⁴; Right to regulate¹⁷⁵; Custom duties¹⁷⁶; Electronic authentication, trust services and contracts by electronic means¹⁷⁷; Paperless trade administration¹⁷⁸; Open internet access¹⁷⁹; Online consumer trust¹⁸⁰; Unsolicited commercial electronic messages¹⁸¹; Cross-border data flows¹⁸²; Electronic payments and invoicing¹⁸³; Protection of personal data and privacy¹⁸⁴; Transfer of and access to source code¹⁸⁵; and Cooperation.¹⁸⁶ Articles 5.15 and 5.16 include general and security exceptions respectively and provide for a mutatis mutandis application of the corresponding WTO exceptions.¹⁸⁷ In contrast to the EU model, it is noteworthy that the right to regulate is more succinctly formulated in that: «The Parties reaffirm the right to regulate in the area of electronic commerce in conformity with this Chapter to achieve legitimate policy objectives».¹⁸⁸

The position of Switzerland in its own bilateral agreements is also important. The agreement with Japan (in force since 2009¹⁸⁹) contains a detailed chapter on electronic commerce.¹⁹⁰ It is framed along the EU model – however, with a few discrete specificities that appear even a bit exotic when compared to existing treaty language across FTAs. The common features relate to the scope of the agreement,¹⁹¹ provisions on electronic signatures,¹⁹² paperless trade administration,¹⁹³ consumer protection online,¹⁹⁴ as well as a temporary customs duties moratorium.¹⁹⁵ The non-discrimination obligation included, which is atypical for an EU deal, may have a broader scope, as it is linked to a liberal definition of «digital products» as products such as computer programmes, texts, plans, designs, video, images and sound recordings or any combinations thereof, that are digitally encoded and transmitted electronically;¹⁹⁶ there is also a specific non-discrimination provision for services, which is however not framed as an extension of the most-favoured nation (MFN) and/or the national treatment (NT) obligation but merely ensures technological neutrality in that services supplied by electronic services are not discriminated against vis-à-vis services provided by other means. Finally, the electronic commerce chapter includes a comprehensive cooperation pledge that encompasses (a) data privacy; (b) fight against unsolicited commercial messages; (c) consumer confidence in electronic commerce; (d) cyber-security; (e) IP; (f) electronic government; and (g) public morals, in particular ethics for young generations.¹⁹⁷ It also makes reference to the need to include multistakeholder approaches in the governance of digital trade, as well as cooperation on efforts to develop the international framework for electronic commerce.¹⁹⁸ This is an innovative feature of the Swiss FTA with Japan, which relates to broader issues of Internet governance. Overall, the digital trade commitments under the Switzerland-Japan FTA, although to be deemed of low normative effect, show Switzerland’s first real engagement with electronic commerce rules, without touching upon the more critical issues of the advanced data-driven economy. Their inclusion can be attributed to Japan’s proactive stance¹⁹⁹ rather than Switzerland’s. The more recent agreement with China, which entered into force in 2014, lacks entirely an electronic commerce chapter.²⁰⁰ The same is true for the post-Brexit agreement with the UK, which was at that point of time a mere continuity trade agreement that sought to replicate as far as possible the trade arrangements between Switzerland and the EU.²⁰¹

One might argue that, although Switzerland’s FTAs have few digital trade provisions in dedicated chapters (except for the EFTA-Moldova FTA), the rest of the treaties’ language, especially in the services and the IP chapters, includes digital trade-relevant provisions. This is however not strictly the case. In terms of services commitments, Switzerland has above all sought to secure that its regulatory space in some digital trade domains – notably audio-visual services – is well preserved. It not only lists all excluded sub-sectors in a detailed manner that mirrors the current situation in Switzerland but secures some wiggle-room for the adoption of measures in the future too. These are defined on the one hand as a discrete category of «new services» but also as an additional qualification in a number of sectors. So, for instance, Switzerland has reserved the right to maintain, modify or adopt any measures restricting market access and national treatment with respect to broadcasting services.²⁰² There is also a new generic category introduced – that of «Internet-based services» – for which Switzerland reserves its right to introduce measures with respect to the protection of youth or to the prevention of addiction or compulsive behaviour and other mental health hazards.²⁰³ Even in the IP chapters, while there is a reference to the WIPO Internet Treaties, no obligations with regard to the application of technological protection matters and/or the liability of internet service providers (ISPs) are spelled out. This is true also for recent FTAs, such as those with Hong Kong, with Bosnia and Herzegovina and Indonesia (in force since 2012, 2015 and 2021 respectively). One explanation for this may be that these deals are the result of the joint negotiations with the EFTA partners and must reflect their common stance. Still, it is a pity that Switzerland has not updated its IP chapters in a way that reflects the implications of the digital environment. This also is not congruent with developments in the US and EU agreements²⁰⁴ and the Swiss domestic framework introduced with the 2020 Swiss Copyright Act. On the other hand, it can be argued that despite the lack of new «digitized» rulemaking, Switzerland has a fairly open digital economy²⁰⁵ and corresponding far-reaching commitments under the WTO’s General Agreement on Trade in Services (GATS) for key digital trade sectors, such as telecommunication, computer and related and financial services, which at times go farther than those of digital champions like the US or Singapore.

The above enquiry into the developments in FTAs reveals the critical importance of digital trade as a negotiation topic and the substantial efforts made, in particular in recent years, to address it and create an adequate rule-framework. The achievements made in some FTAs and the dedicated DEAs are quite impressive, and there is a strand of legal innovation that seeks to tackle the multitude of issues raised in the context of a global data-dependent economy. The regulatory environment is however still fluid. Despite convergence on certain issues of digital trade facilitation, there are many points of divergence among the major stakeholders, in particular with regard to permitting cross-border data flows and the interface between economic and non-economic issues, as the latter effectively determine the digital sovereignty of states and their ability to protect the interests of their citizenry. Although this article did not discuss the plurilateral negotiations under the WTO Joint Initiative on Electronic Commerce (eJI) in detail, it should be underscored that the rules and the stakeholders’ positioning are very much reflected in the WTO context as well, and in this way FTAs can be well perceived as active regulatory laboratories.²⁰⁶ A second trend that can be observed has to do with the forming of geopolitical blocks with overlaps that may lead to potential contestations, as well as uncertainties as to the impact of the agreements on the ground. In this context, we see for instance that New Zealand is a member of the CPTPP, the RCEP, the DEPA and also has an agreement with the EU; similarly, the UK has a fairly binding deal with the EU (including an adequacy decision with regard to the essentially equivalent level of personal data protection), while also entering into liberal and ambitious digital trade commitments under DEAs and the CPTPP.

As this article showed, Switzerland has not been a part of these developments and has not proactively engaged in rulemaking in the area of digital trade, apart from the 2023 EFTA-Moldova FTA. This contrast is true with regard to the EU but also with regard to actors of comparative international standing, networks and regulatory capacity, such as notably Singapore and the UK. Despite the fact that Switzerland may have a natural preference for the multilateral path (it is part of eJI together with 89 other WTO Members but has not submitted a separate communication for the eJI negotiations) and is bound by trade negotiations along its EFTA partners, this delay in engagement on issues of digital trade appears somewhat odd. It does not reflect the economic priorities of Switzerland and fails to secure its digital sovereignty.²⁰⁷ This is likely to change, as the Federal Council has clearly acknowledged the importance of digital trade and underscored the need to create an appropriate rule-framework for Switzerland.²⁰⁸ More concretely, this is about to change as the EFTA has now a model chapter on electronic commerce that can be well implemented, as the FTA with Moldova shows, which effectively follows the EU template (in particular including data flows provisions but coupled with personal data protection rules and a right to regulate), and as the basic agreement with the UK is about to be renegotiated to address digital trade as well.²⁰⁹ Singapore is also a partner with whom deeper data economy commitments in the form of DEA, can be entered into,²¹⁰ and existing agreements with suitable partners can be updated to address digital trade issues.²¹¹

This article seeks to stress that there is some urgency attached to formulating a clear stance for Switzerland in this regard and making sure that these initiatives in the pipeline become reality. Sceptics may still wonder: why the rush? As a more general response, one can say that this may be critical for the Swiss economy: first, because Swiss enterprises are already highly digitized and have been particularly innovative in areas such as fintech. Second, Switzerland could use the opportunities that FTAs present to expand the market for digital trade for these enterprises, including small- and medium-sized ones, which are already in a very advantageous position to reap all the benefits that well-crafted digital trade rules offer to them. This could also expand the market of these companies beyond traditional partners, hence not only contributing to economic growth but also to resilience in an increasingly complex world. Furthermore, there is already some proof that digital trade commitments, especially if they contain more specific rules, have an effect on the development of the digital economy and data-driven innovation.²¹² There is also a need to prevent ongoing digital fragmentation, which has an impact on the global economy but also on the possibilities for businesses in domestic economies to thrive, as digital policy compliance costs are substantial and multiply with heterogeneity.²¹³ Beyond the economy, crafting digital trade rules for Switzerland has implications for its societal interests and the protection of the citizenry – in particular with regard to privacy protection but also with regard to newer areas, such as platform and AI regulation. In this sense, the digital trade provisions become critical for Switzerland’s digital sovereignty.²¹⁴ Geopolitically too, a more proactive and potentially innovative positioning of Switzerland could send the right signals and strengthen Switzerland’s role as a global player with compelling regulatory capacity and forward-oriented agenda.

Faced with the current situation, one can also view Switzerland’s slow adaption as an opportunity. As the issues that fall in the domain of data governance include not only digital trade but also multiple domestic and regional regulatory frameworks of different nature, Switzerland can strive to achieve coherence across these domains. This includes for instance on the international scene the updated adequacy decision with the EU, the new transatlantic privacy framework but also domestic developments, such as the new Data Protection Act, initiatives to regulate platforms, fintech and AI. Digitization calls for regulators to look across sectors and have an integrated approach – the executive branch, as well as Swiss politicians and industry lobbies, must become aware of these critical interdependencies. Switzerland can attain this interoperability, having entered the debates at a point where both the technology and the policy discussions have become more mature. But it should do this within a reasonable period of time, as the agenda could have been already set by the US, Japan, Singapore and the EU, considering what is important for them, and Switzerland might shift into the position of a mere rule-taker without the key advantages of tailoring its own regulatory framework.

Mira Burri, Professor of International Economic and Internet Law, University of Lucerne. The support of the European Research Council under Consolidator Grant 101003216 is gratefully acknowledged.