On September 30, the United States, Mexico and Canada reached agreement on the United States-Mexico-Canada Agreement (USMCA) to replace the North American Free Trade Agreement (NAFTA). The agreement also significantly updates NAFTA with new rules, including rules regarding data privacy. The Administration intends to use the USMCA as a template for future potential trade agreements with Japan, the United Kingdom, the European Union (EU), and others. Therefore, the new rules in the USMCA potentially will impact not just doing business in Canada and Mexico, but potentially also in other significant markets.
The USMCA data privacy rules are included in the digital trade chapter. This is an important update to NAFTA, which does not contain any rules on data privacy or digital trade in general. This also means that the data privacy rules should be viewed along with the overall objectives of the USMCA’s digital trade chapter to reduce cross-border data flow barriers and limit domestic data storage requirements. Thus, while the USMCA’s data privacy rules are not a trade-off per se for liberalizing cross-border data flows, they certainly help address concerns about the impact on individuals of allowing such data flows.
The USMCA requires the United States, Canada, and Mexico to maintain a legal framework to protect personal data but leaves the content and enforceability of such laws up to each country. Specifically, the agreement creates only two hard commitments: 1) to adopt or maintain a legal framework that protects the personal information of the users of digital trade; and 2) to publish information on the personal information protections the country provides to users of digital trade, including how individuals can pursue remedies and businesses can comply with any legal requirements.
While the remaining data privacy rules are not obligatory importantly, they encourage the United States, Canada, and Mexico to have their respective privacy regimes reflect a common set of principles and be compatible. These principles include limitation on collection and use of data; security safeguards; transparency; individual participation; and accountability. Moreover, each country is urged to consider principles and guidelines of relevant international bodies, such as the Asia-Pacific Economic Cooperation (APEC) Privacy Framework and the Organisation for Economic Co-operation and Development (OECD). Recommendation of the Council concerning Guidelines governing the Protection of Privacy and Transborder Flows of Personal Data. Finally, the United States, Canada, and Mexico jointly recognize in the agreement that compliance with data privacy protections and any restrictions on cross-border flows of personal information should be necessary and proportionate to the risks presented and should not discriminate against parties from the other USMCA countries.
Regardless of the above, the USMCA specifically recognizes that there are different legal approaches to protecting personal information, including comprehensive privacy, personal information, or personal data protection laws; sector-specific laws covering privacy; or laws that provide for the enforcement of voluntary private sector undertakings. However, the United States, Canada, and Mexico agreed to promote compatibility and exchange information on their respective mechanisms. The USMCA specifically identifies the APEC Cross-Border Privacy Rules system as a valid mechanism to facilitate cross-border information transfers while protecting personal information.
The USMCA’s data privacy rules appear to be supported by most stakeholders and commenters. While some may wish that the rules were stricter, they recognize that the USMCA’s rules go farther than those in the Trans-Pacific Partnership agreement in requiring data protection and promoting compatibility. There is particular support for the USMCA allowing different approaches to data privacy while also promoting the APEC Cross-Border Privacy Rules.
The next steps are for the three countries to sign the USMCA, likely by the end of November, and then for Congress to pass legislation to approve and implement the agreement. Congressional consideration of the USMCA probably will not occur until next year. The combination of Congress’ full schedule after the midterm elections and various procedural and reporting requirements that apply to USMCA legislation prevent it from being voted on this year.