International Trade Law and Cybersecurity : Balancing Market-Oriented and Domestic State Regulation

This Chapter considers how domestic cybersecurity measures interact with the international trade law regime. To that end this chapter discusses the relationship between cybersecurity and the international trade law regime. In so doing, it reveals some of the gaps associated with applying the multilateral trade law rules to the digital economy and highlights the correlative shift in international trade governance to regional trade agreements.Tensions between cybersecurity measures in multilateral trade treaties are most likely to arise under national security exceptions. This chapter considers cybersecurity under the national security exception articulated in the General Agreement on Tariffs and Trade (GATT) Article XXI. In so doing it contends that GATT Article XXI is not an adequate doctrinal means through which to evaluate cybersecurity measures. This chapter then considers security exceptions in more recently included in RTAs, including the Regional Comprehensive Economic Partnership Agreement (RCEP), the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), the Canada-United States-Mexico Agreement (CUSMA), and Canada-European Union Comprehensive Economic and Trade Agreement (CETA). The purpose of this discussion is to consider whether recent developments in RTA security exceptions are better equipped to address cybersecurity measures. Ultimately, this portion of the chapter concludes that security exceptions found in RTAs may be more applicable than GATT’s security exception in the cybersecurity context. However, much will depend on the language of the provision and how arbitral tribunals ultimately interpret those provisions.Apart from considering cybersecurity measures as justifiable exceptions, this chapter is devoted to consideration of governance cybersecurity in RTAs, again focusing on RCEP, CPTPP, CUSMA and CETA. This section identifies and discusses three developments in those RTAs that are relevant to cybersecurity, namely inclusion of cybersecurity specific provisions, data protection, and mutual coordination, cooperation and collaboration provisions