The free flow of data across borders underpins today's globalized economy. But the flow of personal data outside the jurisdiction of national regulators also raises concerns about the protection of privacy. Addressing these legitimate concerns without undermining international integration is a challenge. This paper describes and assesses three types of responses to this challenge: unilateral development of national or regional regulation, such as the European Union's Data Protection Directive and forthcoming General Data Protection Regulation; international negotiation of trade disciplines, most recently in the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP); and international cooperation involving regulators, most significantly in the EU-U.S. Privacy Shield Agreement. The paper argues that unilateral restrictions on data flows are costly and can hurt exports, especially of data-processing and other data-based services; international trade rules that limit only the importers' freedom to regulate cannot address the challenge posed by privacy; and regulatory cooperation that aims at harmonization and mutual recognition is not likely to succeed, given the desirable divergence in national privacy regulation. The way forward is to design trade rules (as the CPTPP seeks to do) that reflect the bargain central to successful international cooperation (as in the EU-US Privacy Shield): regulators in data destination countries would assume legal obligations to protect the privacy of foreign citizens in return for obligations on data source countries not to restrict the flow of data. Existing multilateral rules can help ensure that any such arrangements do not discriminate against and are open to participation by other countries.

中文翻译：

---

国际数据流和隐私：冲突及其解决

跨境数据的自由流动是当今全球化经济的基础。但个人数据在国家监管机构管辖范围之外的流动也引发了对隐私保护的担忧。在不破坏国际一体化的情况下解决这些合理关切是一项挑战。本文描述并评估了应对这一挑战的三种类型：国家或地区法规的单方面制定，例如欧盟的数据保护指令和即将出台的通用数据保护法规；贸易纪律的国际谈判，最近在跨太平洋伙伴关系全面进步协定（CPTPP）中；以及涉及监管机构的国际合作，最重要的是欧盟-美国隐私保护协议。该文件认为，对数据流的单边限制代价高昂，可能会损害出口，尤其是数据处理和其他基于数据的服务的出口；仅限制进口商监管自由的国际贸易规则无法解决隐私带来的挑战；鉴于国家隐私监管存在可取的分歧，旨在协调和相互承认的监管合作不太可能成功。前进的道路是设计贸易规则（如 CPTPP 寻求做的那样），以反映成功国际合作（如欧盟-美国隐私盾）的核心交易：数据目的地国家的监管机构将承担保护隐私的法律义务外国公民对数据来源​​国的义务是不限制数据的流动。