Data Protection without Data Protectionism

Front matter

EYIEL Monographs Studies in European and International Economic Law 28

Tobias Naef l Data Protection without Data Protectionism

The Right to Protection of Personal Data and Data Transfers in EU Law and International Trade Law

Contents

L UntregieG00 : 605-34 £064550664644444 564008454 8 bed A LE POM teehee ek Oe eh Eee kde Eyk 12 Queto 4 64.45 S40 56S Sehr hinti S OES DERE ES 1 SUNOS, Caen A E E T E aer eee ed bee eee eee: ead LA Weed 155-5 dtd Chee de KEE SESADETH EN SEEE SERRE ES Rete so 5. Fhe AG SS Fae Se OE a POS REG

Part I European Union Data Protection Law

215 SMA o03< asd 2 64S 40 COKE eos MERE OE ES REECE SA 2.1 Foutidational Valuess,004i.0.0¢%s40o4 eo een ee eau os Ao SOO oe 20. a keen chet egagektdaadeen ed 2.3 The Extraterritorial Dimension of the Right to Data Protection... . Bad Miuno icaias ke or Ais RE a Ree eee eA 234 Essential BQuVvaleiee: esr c0cccaes ev eeeeperee news 239. OMS che oe Feranu eke eS ED eRe REE LAL RE DS

2.4 The Extraterritorial Dimension of the Right to Data Protection and Foreign SUreUlnee 44 o64 bbe Ko hie meter eee ened a OE el lel p=

Legal Mechanisms for Data Transfers e pee tice on iC n with he Der i ential Equivalence of Protection from

Policy Object ves of the Rules on Data

Contents

202 204 204 205

207 214 219 220 221 222

Contents

Part II International Trade Law 4.1

4.2

4.3

4.4

4.5

5 Restrictions on Data Transfers and Trade Agreements 5.1.2 Development in the Mega-Regional Trade Agreements. . . Sl SWN cs oe 9o hoa BREE OdS RODE ER RR RE

Zl

5.2

Legal Requirements for Data Flow Clauses in EU Trade

Tane e 6.5 6 EE EE E SEEE

5.2.1 Respecting the Primacy of Fundamental Rights Over

5.2.2 Accommodating the Legal Mechanisms for Data

5.2.3 Including Cooperation for the Protection

Dobe. WNA cae se eG Ke tornar Ra eR ETAT 398 5.3.1 Data Flow Obligation with a Data Protection Exception... 399 5.3.4 Data Flow Obligation with Data Protection Obligations. . . 404 Sor SUNNY oo oF LDR dae he PRESS REECE EG 405

Part III Epilogue

6 Concluding Remarks: Data Protection Without Data PRMCOIINSIG ees bed eeetan ae riante ied e EES 423 ae e o 6 acs. boob ode a hehe Ohoe ote ae aha eel d 428

List of Abbreviations

AA

AB

AG ARIO ASD BCR BDSG BEUC BILETA BND BVerfGE CARIFORUM CBC CCIN CETA CFR, Charter CIA CNIL CoE

Cp.

CPCprov CPTPP

CRID CRS CTIVD DisCo DPA DPC DPD

Association Agreement

Appellate Body

Advocate General

Draft Articles on the Responsibility of International Organizations Australian Signals Directorate

Binding Corporate Rules

Bundesdatenschutzgesetz

British and Irish Law Education Technology Association Bundesnachrichtendienst

Bundesverfassungsgericht

Caribbean Forum

Canadian Broadcasting Corporation

Commission de Contrôle des Informations Nominatives EU-Canada Comprehensive Economic and Trade Agreement Charter of Fundamental Rights of the European Union

Central Intelligence Agency

Commission Nationale de 1’Informatique et des Libertés Council of Europe

Compare

Provisional Central Product Classification

Comprehensive and Progressive Agreement for the Trans-Pacific Partnership

Research Centre on IT and Law

Congressional Research Service

Dutch Review Committee for Intelligence and Security Services Disruptive Competition Project

Data Protection Authority

Data Protection Commissioner

Data Protection Directive xiii

GUE/NGL HM HRC Le. laaS IAPP Ibid.

ICC ICCPR ICJ ICO ICTSD

List of Abbreviations

Data Retention Directive

Datenschutzkonferenz der Datenschutzbeauftragten des Bundes und der Lander

Dispute Settlement Understanding

European Communities

European Charter of Human Rights

European Centre for International Political Economy European Court of Justice

European Court of Human Rights

Editor/s

European Data Protection Board

European Data Protection Supervisor

European Economic Area

European Economic and Social Committee General Court of the European Union

Executive Order

Economic Partnership Agreement

European Services Forum

et alteris, and others

European Treaty Series

European Union

Frequently Asked Questions

Foreign Intelligence Surveillance Act

footnote

European Union Agency for Fundamental Rights Federal Trade Commission

General Agreement on Trade in Services

General Agreement on Tariffs and Trade Government Communications Headquarters General Data Protection Regulation

Genetically Modified Organism

Group of Negotiations on Services

European United Left/Nordic Green Left

Her Majesty’s

Human Rights Committee

id est, in other words

Infrastructure as a Service

International Association of Privacy Professionals ibidem, in the same place

International Chamber of Commerce International Covenant on Civil and Political Rights International Court of Justice

Information Commissioner’s Office

International Centre for Trade and Sustainable Development

List of Abbreviations XV

IDB Inter-American Development Bank

IHC Irish High Court

HF Institute of International Finance

ILC International Law Commission

IMCO European Parliament Committee on the Internal Market and Consumer Protection

IMF International Monetary Fund

IO International Organizations

IoT Internet of Things

IP Internet Protocol

ISP Internet Service Provider

IT Information Technology

ITA Information Technology Agreement

ITIF The Information Technology & Innovation Foundation

ITU International Telecommunication Union

IvIR Institute for Information Law

JEEPA EU-Japan Economic Partnership Agreement

KORUS US-Korea Free Trade Agreement

LIBE European Parliament Committee on Civil Liberties, Justice and Home Affairs

MFN Most-favored nation

NAFTA North American Free Trade Agreement

noyb none of your business

NSA National Security Agency

NYT The New York Times

OCT Overseas Countries and Territories

OECD Organization for Economic Cooperation and Development

OED Oxford English Dictionary

OJ Official Journal of the European Union

OMR Outermost Regions

PaaS Platform as a Service

para. Paragraph

paras Paragraphs

PCLOB Privacy and Civil Liberties Oversight Board

PHE Peterson Institute for International Economics

PNR Passenger Name Records

PPD Presidential Policy Directive

RDV Recht der Datenverarbeitung

RGF Really Good Friends

RGPD Règlement Général sur la Protection des Données

SaaS Software as a Service

SARK Swedish Ministry of Defense Committee on the Vulnerability of

Computer Systems

UN

List of Abbreviations

Society for Worldwide Interbank Financial Telecommunications Transmission Control Protocol

Treaty on European Union

Treaty on the Functioning of the European Union Trade in Services Agreement

Trade Negotiations Committee

Transatlantic Trade and Investment Partnership Trans-Pacific Partnership

United Kingdom

United Nations

United Nations Conference on Trade and Development United Nations General Assembly

United Nations Treaty Series

United States

United States International Trade Commission

United States-Mexico-Canada Agreement

United States Trade Representative

Vienna Convention on the Law of Treaties

Service Sectoral Classification List

Working Party

World Trade Organization

Chapter 1 A Introduction Sheek for 1.1 Framing

Data protection is an area where fundamental rights collide with trade policy. Personal data has become an essential asset for the digital economy.' Consequently, the free flow of personal data across borders has been described as a “new battleground” for states trying to protect their vital economic and non-economic interests—especially now that trade negotiations are shifting to digital trade.”

The conflict over data protection and trade first crystallized in the transatlantic relations between Europe and the United States (US). From the outset, the US has been concerned with trade barriers erected by rules regulating the cross-border flow of personal data in European countries. As early as 1978, the Director of the White House Office of Telecommunications Policy, John Eger, wrote that “there is the danger, of course, that these new laws will be used not only to protect just privacy but also to protect domestic economic interests.”* As efforts to harmonize data protection within the European Communities (EC) progressed, the US rhetoric about its motives has been ratcheted up.* Ira Magaziner, who was responsible for electronic commerce issues in the administration of US President Bill Clinton, stated in 1998 that “we in the U.S. don’t recognize an extraterritorial attempt to shut down

! See UNCTAD (2019), pp. 29-30, for a description of the monetization of personal data including cross-border data flows.

? Burri (2017b), p. 408. The Financial Times referred to “EU trade data flows” as the new GMOs, referring to a long-lasting and high-profile trade dispute between the US and the EC over the European moratorium on the approval of genetically modified biotech products. See Beatie (2017). Eger (1979), p. 1066.

© The Author(s) 2023 1 T. Naef, Data Protection without Data Protectionism, EYTEL Monographs - Studies the electronic flow of data between countries. According to the principles of international trade, I think that’s a violation of WTO rules.”

Spiros Simitis—one of the pioneers of European regulatory policy in the field of data protection and the first titled “data protection officer’—famously countered these allegations in an interview with the New York Times in 1999 by referring to another high-profile trade dispute between the US and the EC over the European banana import regime: “Americans still have the illusion that they can change the [data protection] directive, but they can’t ... This is not bananas we are talking about ... This is about what we consider a fundamental claim to privacy, and therefore there is a limit to compromise.”° Nevertheless, US political attacks on EU data protection has not subsided, even after Edward Snowden revealed in 2013 the extent of US mass surveillance.’ In the runup to the adoption of the General Data Protection Regulation (GDPR)*® in 2016, US President Barack Obama said in an interview with Re/code that EU “roadblocks” for cross-border flows of personal data to the US are not always entirely sincere because European countries intend to displace US companies with European companies.” In essence, the US narrative has always been that EU data protection rules are a form of data protectionism. "°

In spite—or maybe because—of this, the EU began to express disapproval of impediments to the free flow of data across borders.'' EU Commissioner for Trade Cecilia Malstrém noted in 2016 that “in the digital age, restrictions on cross-border data flows inhibit trade of all kinds, and may amount to ‘digital protectionism’.”'” However, the EU’s opposition to digital or data protectionism is on a wholly

>See Shaffer (2000), p. 56; Farrell (2002), p. 116; Swire and Litan (1998), p. 189, who refer to comments of Ira Magaziner at a conference of the Brookings Institution and the Cato Institute on 6 February 1998 as reported by Declan McCullagh for the Netly News.

©The remark is cited in Edmund (1999) [emphasis added].

7The journalists Glenn Greenwald, Ewen MacAskill, Barton Gellman and Laura Poitras broke the story on 7 June 2013. See Greenwald and MacAskill (2013); Gellman and Poitras (2013). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L 119/1.

° Kara Swisher Interviews President Barack Obama on Cyber Security, Privacy and His Relationship With Silicon Valley. Swisher (2015).

10 Aaronson (2019), pp. 557-562; Schwartz and Pfeifer (2017), p. 118; Farrell and Newman (2016); Aaronson (2015), p. 674; USITC (2013), pp. 5-1, 5-2. However, there are other voices as well in the US. Former Commissioner of the FTC Julie Brill stated that “in some quarters in the United States, there has been suspicion that discussions about privacy in Europe were veiled attempts at protectionism. I believe the Schrems decision should put those suspicions to rest. The decision crystallizes what has been clear—or should have been clear—for a long time about privacy in Europe: it is a fundamental right that Europeans and their Court take very seriously.” Brill (2015), p. 4.

"Tn a communication on digital trade from 2015, the European Commission contended that “European companies still face significant barriers around the world, such as non-transparent rules, government interference, unjustified data localization and data storage requirements.” European Commission (2015), p. 7.

1.1 Framing 3 different trajectory than its regard for the fundamental right to data protection. The European Commission has been careful to exclude its data protection regime from a protectionism narrative. In a communication from 2017 on exchanging and protecting personal data in a globalized world, the Commission highlighted that “European companies operating in some third countries are increasingly faced with protectionist restrictions that cannot be justified with legitimate privacy considerations.”'* Nonetheless, this reference to “legitimate considerations” highlights that even from a European perspective, privacy and data protection are sometimes used as a disguise for protectionist policies." In the end, while many states recognize, at least on paper, that data protection and privacy are important values, they diverge quite jarringly on what the correct level or design of such protection should be.'° There is a deep disagreement about when data protection should be considered data protectionism. This research explores EU-style data protection, its application to cross-border flows of personal data, and its consequences.

The key to legally explaining the conflict over data protection and trade in the EU is the right to data protection enshrined in Article 8 Charter of Fundamental Rights (Charter, CFR).'® This research provides a new account of the right to data protection with regard to cross-border flows of personal data. Crucially, the right to data protection has an extraterritorial dimension that is independent from the legal data transfer mechanisms provided by secondary Union law. I suggest that there is an unwritten constituent part of the right to data protection in Article 8 CFR, which mandates continuous protection of all personal data transferred from the EU to third countries. This extraterritorial dimension of the right to data protection also requires a new investigation of the restrictions placed on the free flow of personal data by the EU.

Even if restrictions on the free flow of personal data are deeply rooted in the protection of fundamental rights, they can still constitute barriers to international trade as regulated by the World Trade Organization (WTO). So far, data protection has not been subject to dispute settlement proceedings at the WTO. Consequently, this research also provides a precise legal assessment of the EU’s fundamental rights-based regulation of data transfers and its resulting restrictions on cross-border flows of personal data in a hypothetical challenge at the WTO. I argue that the scope for regulating data protection in accordance with WTO law is wider than expected from the previous jurisprudence of the WTO’s adjudicative bodies on other public policy objectives." Nevertheless, I also show that even a delicately crafted and rule-

16 Charter of Fundamental Rights of the European Union [2012] OJ C 326/391.

'7So far, only one of all the cases that reached the adjudicative stage of WTO dispute settlement satisfied all the standards of the general exceptions. See WTO Panel Report, EC — Asbestos, para. 8.240; cp. Public Citizen (2015), pp. 5—6.

based system of data transfers must be carefully managed in order to comply with the rules of the WTO.

Given its importance for digital trade, the free flow of personal data across borders is the subject of multiple, current negotiations in international trade law.'® While multilateral trade negotiations at the WTO move slow and compromise is increasingly more difficult, bilateral and regional trade agreements have become an important forum in which topics such as cross-border flows of personal data can be addressed. Indeed, bilateral and regional trade agreements have compensated in several ways the lack of progress at the WTO." The challenge for the EU is to safeguard its fundamental rights-based regulation of data transfers in these negotiations. This research also explores and offers the legal requirements for a data flow clause in EU trade agreements. I ultimately suggest four possible designs for such a data flow clause in EU trade agreements. All in all, the intention of this research is to show—using the example of EU law—where the line between data protection and data protectionism in international trade law currently is, and how it can, or should be redrawn.

1.2 Questions

The right to data protection in Article 8 CFR has been in force since 2009. Many aspects of this innovative fundamental right have yet to be extensively explored.” One of the topics that has received little attention to date is the relationship between the right to data protection in Article 8 CFR and cross-border flows of personal data. The existing research is often limited to short explanations of how the legal mechanisms for the transfer of personal data in the GDPR, or its predecessor Directive 95/46/EC,”' should be interpreted in light of Article 8 CFR.” Commentaries on the Charter do not usually address the implications of the right to data protection for the cross-border free flow personal data.” Consequently, the first question this research

'8Qn 25 January 2019, 76 members of the WTO started negotiations on electronic commerce. See WTO (2019). The parties to these negotiations include countries that have different domestic policy priorities and approaches to data protection. Sen (2018), pp. 339-341.

20 González Fuster (2014), p. 205.

?1 Directive 95/46/EC of the European Parliament and Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L 281/31.

1.2 Questions 5 seeks to answer is: Does the right to data protection in Article 8 CFR protect individuals in the EU in cases in which their personal data is transferred to third countries for processing?

The second research question focuses on the effect of the protection afforded by the right to data protection in Article 8 CFR for cross-border flows of personal data. Chapter V GDPR includes multiple different legal mechanisms for enabling the transfer of personal data to third countries. These include: adequacy decisions from the European Commission according to Article 45 GDPR, instruments providing appropriate safeguards in Article 46 GDPR, and the derogations in Article 49 GDPR. The use of these mechanisms must fully incorporate the protection afforded by Article 8 CFR, which can lead to restrictions on the free flow of personal data from the EU to third countries. The research question is thus what kind of restrictions are imposed on cross-border flows of personal data because of Article 8 CFR and the legal mechanisms for data transfers in Chapter V GDPR?

The conflict over data protection and trade is not new. Both data protection law and WTO law have been around for more than 20 years. The coexistence of these two legal disciplines has been subject so some scholarly debate.** However, little attention has been paid to the intricacies of EU-style data protection. It mostly circled around the now defunct Safe Harbor Agreement between the EU and the Us.” Corresponding to the rising prominence of data protection law, the issue has been taken up more frequently in recent years.” Nevertheless even here, the importance of the fundamental right to data protection in Article 8 CFR has not been sufficiently analyzed in the EU regulation of data transfers as the subject of the analysis under WTO law. The third research question thus relates to the coexistence of EU data protection law and WTO law on trade in services: Is the fundamental rights-based regulation of data transfers in the EU compatible with the obligations of WTO members in the General Agreement on Trade in Services (GATS)??”

The fourth and final research question addresses the coexistence of EU data protection law and data flow clauses in bilateral and regional trade agreements. The inclusion of provisions regulating the cross-border flow of personal data in trade agreements has not yet been studied systematically. The issue is usually mentioned briefly as part of explanations of the challenges for the regulation of digital trade in bilateral and regional trade agreements, but the discussion is minimal.” Some

27 General Agreement on Trade in Services of 15 April 1994, Marrakesh Agreement Establishing the World Trade Organization, Annex 1B, 1869 UNTS 183.

examples include: studies that briefly discuss the difficulties of including data protection in trade agreements; studies addressing regulatory cooperation for the protection of personal data in trade agreements; °° and studies that focus on the different positions during the negotiations of the so-called “mega-regional trade agreements” such as the Transatlantic Trade and Investment Partnership (TTIP), the Trade in Services Agreement (TiSA) or the Trans-Pacific Partnership (TPP).*! Yet, there has been no analysis of the legal requirements for data flow clauses included in EU trade agreements and there have been no alternative suggestions for the design of such clauses. In addition, the EU horizontal model data flow clauses, which the European Commission endorsed in 2018, have not been the subject of much scientific debate either.** The final research question is thus how the fundamental rights-based regulation of data transfers in the EU can be accommodated in the bilateral and regional trade agreements of the EU?

1.3 Structure

In terms of the structure, this book consists of two main parts. The first part is dedicated to EU data protection law while the second part covers international trade law. The two parts are both further divided into two main chapters each (plus a preliminary chapter in the form of this introduction and a final chapter in the form of an epilogue). The four main chapters each address one of the four research questions raised above.

Chapter Two discusses the global reach of the right to data protection in Article 8 CFR. It outlines the substance of the right to data protection and introduces the extraterritorial dimension of this fundamental right as an unwritten constituent part of Article 8 CFR. The chapter then focuses on foreign internet surveillance, which is the most important field of application for the extraterritorial dimension of the right to data protection. Chapter Three explores the restrictions imposed on cross-border flows of personal data by the EU. It describes the legal mechanisms for the transfer of personal data in the GDPR and sets out how the extraterritorial dimension of the right to data protection must be applied to the three legal mechanisms set out in the GDPR. Chapter Four assesses the compatibility of the EU’s fundamental rights-based regulation of data transfers with WTO law. The chapter explains why international trade in services requires cross-border flows of data, and—against this background—shows where the regulation of data transfers in the

1.4 Method 7

EU constitutes a trade barrier, and whether such barriers can be justified according to the GATS. Finally, Chapter Five investigates how data flow clauses can be integrated in EU bilateral and regional trade agreements. The chapter offers four suggestions for the design of data flow clauses that entail a commitment to the cross-border flow of personal data while respecting the EU’s fundamental rights. The chapter also criticizes the horizontal data flow clauses that were adopted by the European Commission in 2018 as a model for future trade agreements of the EU. Chapter Six concludes the book with an epilogue.

1.4 Method

The book applies the doctrinal legal research method.** This method can be defined as “research which provides a systematic exposition of the rules governing a particular legal category, analyses the relationship between rules, explains areas of difficulty and, perhaps, predicts future developments.”** In practice, the analysis of the case law of the competent courts and adjudicative bodies is of the utmost importance. In the field of EU law, the relevant case law primarily comes from the European Court of Justice (ECJ). The opinions of the Advocates General (AG), which are produced before the ECJ makes its decision and serve as an orientation for the Court, are also crucial.’ AG opinions often provide further analysis of the legal issues at stake and provide valuable insights for doctrinal legal research.’ Where necessary, the case law of the European Court of Human Rights (ECtHR) is also taken into account. The ECtHR deals with data protection—in the absence of a specific right to data protection enshrined in the European Convention of Human Rights (ECHR)*’—under the right to private life in Article 8 ECHR.*® The case law on Article 8 ECHR of the ECtHR is relevant for EU law because the Charter contains an identical right to private life in Article 7 CFR. According to Article 52(3) CFR, as long as the Charter contains rights that correspond to rights guaranteed by the ECHR, then the meaning and scope of those rights should be the same as those laid down by the ECHR.’ In the field of international trade law, the relevant case

33 For an overview of the doctrinal legal research method see Bhat (2020), pp. 143-168; Hutchinson and Duncan (2012), pp. 110-119; Smits (2017), pp. 207-228.

4Hutchinson and Duncan (2012), p. 101.

35 See for the role of AG opinions Albors-Llorens (2020), pp. 284-285; Schütze (2018), p. 206; Craig and de Búrca (2017), p. 61; Solanke (2015), pp. 113-116; Dashwood et al. (2011), p. 62.

37 Convention for the Protection of Human Rights and Fundamental Freedoms of 4 November 1953, ETS 5, 213 UNTS 221.

a See, e.g., ECtHR, Amann v. Switzerland, para. 56; ECtHR, S. and Marper v. the United Kingdom, para. 103; Lynskey (2014), pp. 581-587; Kokott and Sobotta (2013), p. 223.

law comes from WTO panels and the Appellate Body (AB). It must be noted, however, that the reports of WTO panels and the AB are only legally binding on the parties involved in the litigation and do not constitute binding precedents for other disputes, even if the same question of WTO law arises in the future.*° In short, there is no rule of stare decisis in WTO dispute settlement that can bind the adjudicative bodies in subsequent cases.*' Nevertheless, the AB has underlined that the fact that AB reports are only legally binding on the parties to a dispute “does not mean that subsequent panels are free to disregard the legal interpretations and the ratio decidendi contained in previous Appellate Body reports.” The reports of WTO panels and the AB therefore provide relevant guidance to address the research question concerning WTO law.

Where the meaning of rules must be determined in this book, the appropriate instruments for interpreting the law are applied. In the interpretation of EU law, the four classical methods of interpretation can be used: historical interpretation, literal interpretation, systematic interpretation, and teleological interpretation.** The ECJ emphasizes that “in interpreting a provision of EU law, it is necessary not only to refer to its wording but also to consider its context and the objectives of the legislation of which it forms part, and in particular the origin of that legislation.” There is no formal hierarchy among the methods of interpretation in EU law, but it is evident from the case law of the ECJ and extrajudicial writings of AGs and judges of the ECJ that the Court often gives high importance to teleological considerations." The importance of teleological interpretation for EU law is reflected in this book.

The interpretation of terms in international law follows the customary rules of interpretation in Article 31 and Article 32 Vienna Convention on the Law of Treaties (VCLT).** In the realm of WTO law, Article 3.2 Dispute Settlement Understanding (DSU) refers to these customary rules of interpretation." Article 31(1) VCLT provides the general rule of interpretation and requires that a treaty must be interpreted in good faith in accordance with the ordinary, contextual meaning of the terms of the

“WTO AB Report, US — Stainless Steel (Mexico), para. 158.

437 enaerts and Gutiérrez-Fons (2014), p. 6; Schiitze (2018), p. 211; Itzcovich (2009), pp. 539-540. In addition, Albertina Albors Llorens describes the comparative method of interpretation in the EU. See Albors Llorens (1999), p. 375, 380.

“ECJ, La Quadrature du Net, para. 105.

45 See former ECJ judge Pescatore (1972), p. 325; former AG Fennelly (1996), p. 664; ECJ judge Lenaerts and Gutiérrez-Fons (2014), p. 36; see also Schiitze (2018), p. 212; Albors Llorens (1999), p. 382.

46 Vienna Convention on the Law of Treaties of 23 May 1969, 1155 UNTS 331.

47 Understanding on the Rules and Procedures Governing the Settlement of Disputes of 15 April 1994, Marrakesh Agreement Establishing the World Trade Organization, Annex 2, 1869 UNTS 401. See Van den Bossche and Zdouc (2017), pp. 190-198; Matsushita et al. (2015), pp. 63-87.

1.4 Method 9 treaty and in the light of the treaty’s object and purpose.** Article 32 VCLT states that recourse to supplementary means of interpretation, including the preparatory work of the treaty and the circumstances of its conclusion, may be used when the interpretation according to Article 31 VCLT leaves the meaning ambiguous or obscure, or leads to a result which is manifestly absurd or unreasonable.*” While the purpose, or teleology of the law, is of paramount importance for the interpretation of EU law, a sovereignty-oriented reading with a focus on the literal interpretation is essential in international law.°° That does not mean, however, that the interpretation of WTO law does not offer any flexibility for new developments. The AB specifically held that

WTO tules are not so rigid or so inflexible as not to leave room for reasoned judgments in

confronting the endless and ever-changing ebb and flow of real facts in real cases in the real

world. They will serve the multilateral trading system best if they are interpreted with that in + 51

mind.

This book critically examines the essential features of the legal rules in question and the corresponding case law to provide alternative interpretations of those rules where appropriate, and then to combine and synthesize the relevant elements to establish an arguably correct and complete statement of the law.*? In addition, three methodological specifics deserve mention:

First, the right to data protection in Article 8 CFR is examined in the context of the historical development of legal data protection in Europe. Here, the project benefits significantly from the research by Gloria Gonzalez Fuster, whose work has described the emergence of personal data protection as a fundamental right of the EU in great detail.” Given this historical context, the need for an interpretation of this fundamental right in the light of technological developments becomes apparent. This need can also be found in the Preamble of the Charter. An interpretation in the light of technological developments is of central importance for the construction of the extraterritorial dimension of the right to data protection. In the age of the internet, when personal data flows across territorial borders on an unprecedented scale, this need is even more important. Furthermore, this book identifies the underpinning values of data protection and shows that they are equally applicable to the protection of personal data in a transnational context.

5! WTO AB Report, Japan — Alcoholic Beverages II, paras 122-123. 52Cp. Hutchinson (2018), p. 13.