The digital policy implications of the USMCA have attracted increasing attention as Canadians consider the risks that the agreement could limit future policy flexibility. In particular, the agreement restricts the use of data localization, an increasingly popular legal method for addressing public interest concerns associated with the collection of online information by mandating that data be stored within the local jurisdiction. Restrictions on data localization are not entirely new to Canada, since similar provisions are found in the CPTPP (the successor to the Trans Pacific Partnership). That means that Canada has already agreed to limits on data localization with or without the USMCA. However, the USMCA’s data localization provision differs in a significant way, suggesting that the Canadian government has agreed to an even more restrictive approach than that found in the CPTPP.

The USMCA provision contained at Article 19.12 states:

No Party shall require a covered person to use or locate computing facilities in that Party’s territory as a condition for conducting business in that territory.

There are no further exceptions or limits to the data localization provision in the chapter, though Article 32.1(2) of the USMCA notes that paragraphs a, b, and c of Article XIV of the General Agreement on Trade in Services (GATS) is incorporated into the digital trade chapter. Those paragraphs create exceptions for measures (1) designed to protect public morals or maintain public order; (2) protect human, animal, or plant life or health; and (3) comply with laws and regulations including prevention of deceptive practices, protection of privacy, and safety. Canadian negotiators presumably interpret the GATS provision as providing an opening for privacy protection, thereby allowing BC and Nova Scotia to retain their provincial data localization laws.

By comparison, Article 14.13 of the CPTPP features the same general prohibition and the applicability of the GATS exception, but adds the following additional exception:

Nothing in this Article shall prevent a Party from adopting or maintaining measures inconsistent with paragraph 2 to achieve a legitimate public policy objective, provided that the measure:

(a) is not applied in a manner which would constitute a means of arbitrary or unjustifiable discrimination or a disguised restriction on trade; and
(b) does not impose restrictions on the use or location of computing facilities greater than are required to achieve the objective.

In other words, Canada previously agreed to restrictions on data localization rules in the CPTPP but carved out an exception for any legitimate public policy objective (subject to not being applied in a discriminatory manner or beyond that necessary to achieve the objective). The USMCA removes that flexibility, creating a significant limitation on the ability for Canadian governments to safeguard the public interest. Indeed, once implemented, policy measures on data localization will be restricted beyond the limits imposed by the CPTPP and leave Canada vulnerable to a challenge should future governments seek to introduce data localization mandates.