International Regulation of Personal Information Protection in the Context of Cross-Border Data Flows

In the era of digital economy, the relationship between personal information protection and cross-border data flows is complementary and mutually constraining. There are two approaches to international regulation of personal information protection in the international community: geographic location-based and organization-based, but both are inadequate. The existing regional trade agreements such as CPTPP, USMCA, and RCEP provide for the protection of personal information by establishing a chapter on electronic commerce, but regional trade agreements can only play a short-term supplementary role, and ultimately the WTO is the multilateral platform for the protection of personal information regulation. GATS Article XIV(c)(ii) is regarded as a relevant provision on personal information protection, but it is not sufficient to meet the challenges faced by personal information protection in the context of cross-border data flows and needs to be improved. In the interim, the WTO should make full use of the necessity test in conjunction with the provisions of the GATS on transparency and recognition agreements. In the long term, a more comprehensive annex on personal information protection should be developed within the GATS.