Data flows enable companies to transmit information for online communication, track global supply chains, share research, and provide cross-border services. U.S. policymakers are considering various policy options to address online privacy, some of which could affect cross-border data flows. To enable international data flows and trade, the United States has aimed to eliminate trade barriers and establish enforceable international rules and best practices that allow policymakers to achieve public policy objectives, including promoting online security and privacy. Building consensus for international rules and norms on data flows and privacy has become increasingly important as recent incidents have heightened the public's awareness of the risk of personal data stored online. Organizations value consumers' personal online data for a variety of reasons. However, personal data is considered personal private property. Data privacy concerns may become more urgent as the amount of online information organizations access and collect, and the level of global data flows, continue to expand. Countries vary in their policies and laws on these issues. The United States has traditionally supported open data flows and has regulated privacy at a sectoral level to cover data, such as health records, rather than create a comprehensive policy. U.S. trade policy has sought to balance the goals of consumer privacy, security, and open commerce, including eliminating trade barriers and opening markets. In recent years, Congress has examined multiple issues related to cross-border data flows and online privacy. However, users' expectations and values may vary and there is no globally accepted standard or definition of data privacy in the online world. Cross-Border Data Flows and Online Privacy

"Cross-border data flows" refers to the movement or transfer of information between computer servers across national borders. In addressing online privacy, some policymakers focus on limiting access to online information by restricting the flow of data beyond a country's borders. Such limits may also act as protectionist measures. Multilateral Rules

There are no comprehensive multilateral rules specifically about privacy or cross-border data flows. However, the United States and other countries have begun to address these issues in negotiating new and updated trade agreements, and through international economic forums and organizations such as the Asia-Pacific Economic Cooperation (APEC) forum and the Organisation for Economic Co-operation and Development (OECD). Overall U.S. objectives include allowing the free flow of information for international trade and cross-border data flows, "subject to reasonable safeguards like the protection of consumer data when it is exported," but do not specifically address privacy. The United States has contributed to developing international guidelines or principles related to privacy and cross-border data flows, although none are legally binding. Two of the top U.S. trading partners (the EU and China) have established their data policies from different perspectives. The EU's policies are driven by privacy concerns; China's policies are based on security justifications. Both are setting examples that other countries, especially those with (or seeking) closer trading ties to China or the EU, are emulating; thus, these policies have affected U.S. firms seeking to do business in those other countries as well. The United States has traditionally sought a balanced approach between trade, privacy, and security. There is growing interest among some Members of Congress and in the Administration for a more holistic U.S. data privacy policy. Data Flows and Privacy in U.S. Trade Agreements

The United States has played an important role in international discussions on privacy and data flows, such as in the OECD, G-20, and APEC, and has included provisions on these subjects in recent free trade agreements. CPTPP includes provisions on cross-border data flows and personal information protection. United States-Mexico-Canada Agreement (USMCA). In general, the proposed USMCA requires that parties not restrict cross-border data flows. Nevertheless, the Trump Administration is seeking to define an overarching U.S. policy on data privacy. Impact on U.S. Trade

Congress may seek to better understand the economic impact of data flows and privacy regimes in other countries related to U.S. access to other markets and the extent to which barriers are being put in place that may discriminate against U.S. exporters. Congress may consider the implications of not having a comprehensive national data privacy policy.
"Cross-border data flows" refers to the movement or transfer of information between computer servers across national borders. Such data flows enable people to transmit information for online communication, track global supply chains, share research, provide cross-border services, and support technological innovation.
Ensuring open cross-border data flows has been an objective of Congress in recent trade agreements and in broader U.S. international trade policy. The free flow of personal data, however, has raised security and privacy concerns. U.S. trade policy has traditionally sought to balance the need for cross-border data flows, which often include personal data, with online privacy and security. Some stakeholders, including some Members of Congress, believe that U.S. policy should better protect personal data privacy and security, and have introduced legislation to set a national policy. Other policymakers and analysts are concerned about increasing foreign barriers to U.S. digital trade, including data flows.
Recent incidents of private information being shared or exposed have heightened public awareness of the risks posed to personal data stored online. Consumers' personal online data is valued by organizations for a variety of reasons, such as analyzing marketing information and easing the efficiency of transactions. Concerns are likely to grow as the amount of online data organizations collect and the level of global data flows expand. As Congress assesses policy options, it may further explore the link between cross-border data flows, online privacy, and trade policy; the trade implications of a comprehensive data privacy policy; and the U.S. role in establishing best practices and binding trade rules that seek to balance public policy priorities.
There is no globally accepted standard or definition of data privacy in the online world, and there are no comprehensive binding multilateral rules specifically about cross-border data flows and privacy. Several international organizations, including the Organisation for Economic Co-operation and Development (OECD), G-20, and Asia-Pacific Economic Cooperation (APEC) forum, have sought to develop best practice guidelines or principles related to privacy and cross-border data flows, although none are legally binding. U.S. and other recent trade agreements are establishing new enforceable trade rules and disciplines.
Countries vary in their data policies and laws; some focus on limiting access to online information by restricting the flow of data beyond a country's borders, aiming to protect domestic interests (e.g., constituents' privacy). However, these policies can also act as protectionist measures. The EU and China, two top U.S. trading partners, have established prescriptive rules on cross-border data flows and personal data from different perspectives. The EU General Data Protection Regulation (GDPR) is driven by privacy concerns; China is focused on security. Their policies affect U.S. firms seeking to do business in those regions, as well as in other markets that emulate the EU and Chinese approaches. Unlike the EU or China, the United States does not broadly restrict cross-border data flows and has traditionally regulated privacy at a sectoral level to cover data, such as health records.
U.S. trade policy has sought to balance the goals of consumer privacy, security, and open commerce. The proposed United States-Mexico-Canada Agreement (USMCA) represents the Trump Administration's first attempt to include negotiated trade rules and disciplines on privacy, cross-border data flows, and security in a trade agreement. While the United States and other countries work to define their respective national privacy strategies, many stakeholders seek a more global approach that would allow interoperability between differing national regimes to facilitate and remove discriminatory trade barriers to cross-border data flows; this could offer an opportunity for the United States to lead the global conversation.
Although Congress has examined issues surrounding online privacy and has considered multiple bills, there is not yet consensus on a comprehensive U.S. online data privacy policy. Congress may weigh in as the Administration seeks to define U.S. policy on data privacy and engages in international negotiations on cross-border data flows.