10 Ch.6 RCEP on E Commerce
10 Ch.6 RCEP on E Commerce
10 Ch.6 RCEP on E Commerce
Jane Kelsey
Faculty of Law, University of Auckland, New Zealand
Kelsey, J. (2022), 'Opportunities and Challenges for ASEAN and East Asia from the
Regional Comprehensive Economic Partnership on E-Commerce', in Kimura, F., S. Urata,
S. Thangavelu, and D. Narjoko (eds.), Dynamism of East Asia and RCEP: The Framework for
Regional Integration . Jakarta: ERIA, pp.119-144.
The Regional Comprehensive Economic Partnership (RCEP) is a microcosm of the current
tensions in negotiations on digital trade involving parties that have divergent positions on
the digital economy, data, and regulation, including within the Association of Southeast
Asian Nations (ASEAN) itself. It adopts a prudent approach that recognises the state
parties need flexibility and policy space at the national and regional levels to develop
of policy and regulation in the rapidly changing digital ecosystem and seeks to advance
their collective interests through dialogue and cooperation. This paper contrasts that
approach with the disciplinary nature of binding legal obligations that are enforceable
by other states and their investors, as in the Trans-Pacific Partnership Agreement and
similar recent treaties. The analysis of key differences focuses on matters of particular
importance to ASEAN, such as local content and government procurement, data
rules and flexibilities, financial data, source codes, and transparency. RCEP’s cautious
approach enables ASEAN members to deepen their national and regional understanding
of the opportunities and challenges these agreements present, whilst developing and
implementing their own digital development strategies. Yet those good efforts may be
undermined through the binding and enforceable trade in services rules.
Introduction
Electronic commerce, also called digital trade, is the most prominent ‘new issue’ in
international trade negotiations and has become increasingly controversial. Novel rules
on e-commerce that were adopted in the Trans-Pacific Partnership (TPP) Agreement in
2016 were originally designed by and for the United States (US) technology companies
that dominate the digital domain globally (Kelsey, 2018). These binding and enforceable
rules presumed a hands-off approach to regulation, consistent with the US model, and
were carried through unchanged to the Comprehensive and Progressive Agreement for
Trans-Pacific Partnership (CPTPP) following the United States stepping away from the
original agreement.
The TPP/CPTPP precedent has since informed negotiations on digital trade in various free
trade agreements (FTAs) and in a plurilateral initiative at the World Trade Organization
(WTO). The most expansive agreements to date are the US–Mexico–Canada Agreement
(USMCA)1 and the Singapore–Australia Digital Economy Agreement,2 both of which
1
US–Mexico–Canada Agreement, signed 10 December 2019, entered into force 1 July 2020. For example, Chapter 19 on Digital Trade
extended the protection for owners of source codes in the TPP/CPTPP from disclosure requirements to include algorithms (Article 19.16).
2
Singapore–Australia Digital Economy Agreement, signed 6 August 2020, entered into force 8 December 2020. This agreement also
extended protections for algorithms (Article 7) and has stronger requirements for cross-border data transfer (Art 23) and online consumer
protection laws (Article 15).
3
European Union Mercosur Trade Agreement, Agreement in Principle 28 June 2019, Sub-section 6 E-commerce of Section 3 Regulatory
Framework, in Title XXX Trade in Services and Establishment.
4
India was a participant in the negotiations but withdrew in November 2019 before the RCEP agreement was signed.
Section 2 of this paper outlines the context and structure of the electronic commerce
provisions in RCEP, addressing the complex configurations amongst the 16 RCEP
negotiating countries in relation to e-commerce, the dominance of big tech incumbents,
and the spread of e-commerce-related provisions across the e-commerce, trade in
services, and financial services chapters.
In section 4 a number of key differences between the TPP/CPTPP and RCEP are examined
to highlight current sensitivities over digital trade rules, including on enforcement,
revenue, local content and government procurement, data rules and flexibilities, financial
data, source codes, and transparency.
Section 5 briefly discusses the general regulatory provisions that require governments
to have consumer protection and personal privacy laws without specifying any minimum
standards.
The paper concludes that RCEP is a microcosm of the current tensions in negotiations
on digital trade. It has adopted a prudent approach that recognises that state parties
need flexibility and policy space at the national and regional levels to develop policies
and regulations in the rapidly changing digital ecosystem and seeks to advance their
collective interests through dialogue and cooperation, in contrast to the coercive
approach of legal obligations that are enforceable by other states and their investors
adopted in the TPP/CPTPP.
China X + X
India ^
Indonesia * X X
Japan X X X
Lao PDR X X X
Malaysia X X * X
5
Brunei, Cambodia, Lao People’s Democratic Republic, Singapore, Thailand, Viet Nam, as per Regional Comprehensive Economic Partnership
agreement, signed 15 November 2020, entered into force 1 January 2022 (RCEP) Art 20.6.2.
6
In fact, four non-ASEAN signatories (Australia, China, Japan, New Zealand) became original parties.
7
RCEP Article 20.6.3. Malaysia and the Republic of Korea subsequently submitted instruments of ratification.
New Zealand X X X
Philippines * X X
Singapore X X X X
Republic of Korea X + X
Thailand X X X
Viet Nam X X X
ASEAN = Association of Southeast Asian Nations, CPTTP = Comprehensive and Progressive Agreement for Trans-Pacific Partnership, JSI
= Joint Statement Initiative, RCEP = Regional Comprehensive Economic Partnership, TPP = Trans-Pacific Partnership, WTO = World Trade
Organization.
Notes: ^ withdrew before signing, * signed but not yet ratified, + applied to join.
Source: Compiled by the author (as of May 2022).
8
The text has not been released publicly but the Revised WTO Electronic Commerce Negotiations. Updated consolidated negotiating text –
September 2021, INF/ECOM/62/Rev.2 is available at https://www.bilaterals.org/?-other-292-.
9
ASEAN Agreement on Electronic Commerce 2019 signed on 22 January 2019. https://agreement.asean.org/media/
download/20190306035048.pdf.
10
Trans-Pacific Partnership Agreement (TPP) signed on 4 February 2016, and Comprehensive Agreement for Trans-Pacific Partnership
(CPTPP) signed on 8 March 2018, entered into force 30 December 2018, Article 14.18 provides for non-enforcement for 2 years after the
TPP’s entry into force. Additional side-letters extended this for Viet Nam’s laws related to cyber security for 5 years after the CPTPP’s entry
into force for Viet Nam. See, for example, the exchange of letters between the Governments of Viet Nam and New Zealand dated 2 March
2018. https://www.mfat.govt.nz/assets/Trade-agreements/CPTPP/Viet-Nam-New-Zealand-Cyber-Security.pdf
China’s approach was consistent with its Digital Silk Road strategy that focuses on
infrastructure and the digital eco-system. Some TPP/CPTPP-style rules benefit China’s
tech giants, such as AliBaba and Tencent, with their integrated search engines, trading
platforms, e-finance, logistical hubs, as well as data mining and engineering. China
also has interests in reducing tariffs and easing technical standards for information
technology and smart products and in customs facilitation for products traded through
regional supply chains. At the same time, China was concerned to protect its stringent
restrictions on digital operators and users within, and increasingly outside, the country
under the broad rubric of ‘national security’. China has taken a similar approach at the
WTO (Gao, 2020). It remains to be seen how China intends to navigate these issues in its
application to accede to the CPTPP.
The tensions between these diverse, and often conflicting, strategic, commercial,
regulatory, security, and geopolitical interests are evident in the final RCEP text.
Nevertheless, the digital multinational enterprises (MNEs) still stand to be the principal
beneficiaries of RCEP’s e-commerce chapter as the main suppliers of services in or into
the region. The Asian Internet Coalition, for example, represents Airbnb, Amazon, Apple,
Booking.com, Cloudfare, Facebook (now Mega), Google, Expedia, Line, Linkedin, Rakuten,
Sap, Twitter, and Yahoo.11 These and other tech industry giants have shown themselves
to be pass masters at regulatory and tax arbitrage, with complex corporate structures
11
For an example of the tech industry’s lobbying position, see GSMA Asia-Pacific (2017).
Notionally, businesses in ASEAN and East Asian countries should also benefit from the
RCEP rules. However, not all tech companies are equal. The digital trade rules facilitate
the concentration of operations from a regional, if not global, hub. This enables the
incumbents to collect, consolidate, mine, and engineer data, the essential raw material in
the global digitalised economy, so as to strengthen their oligopolies. It will remain difficult
for most domestic businesses to compete, or even to enter the mainstream digital market.
That is especially so for micro, small, and medium-sized enterprises (MSMEs). Rules that
prevent requirements for data to be stored locally will also fetter the ability of states and
their businesses to benefit from data generated within their own territory to advance their
digital development strategies. Those, and other, rules will constrain how governments
can address a wide range of other public policy, revenue, and security issues.
Concerns over these commercial realities, the dominance of incumbents over the digital
eco-system, and constraints on regulation imposed by the rules are reflected in the
flexibilities and exceptions written into RCEP, in contrast to other recent agreements.
12
RCEP Article 1.2.q.
12.1 Definitions
12.2 Principles and Objectives
12.3 Scope
12.4 Cooperation
Similarly, the two rules in Section D, Promoting Cross Border Electronic Commerce,
which cover Location of Computer Facilities and Cross-border Transfer of Information by
Electronic Means, restrict Parties’ regulation of data flows and their ability to require that
domestically sourced data is retained and accessible within the country.
The chapter’s final section, Other Provisions, provides for Dialogue on Electronic
Commerce, especially TPP/CPTPP matters omitted from RCEP. Crucially, it also excludes
the chapter from coverage of the state–state dispute settlement chapter, for now.
Financial institutions, public entities, and financial service suppliers are excluded
from coverage of the e-commerce chapter, as are investors in financial services and
institutions. However, Annex 8-A Financial Services applies some related, but different,
rules to those entities and activities.
13
RCEP Articles 8.3, 8.7, and 8.8.
This multi-chapter interface comes with further complexities. The sectoral commitments
and reservations made by Parties in the services and investment chapters are imported
to the e-commerce chapter only for the data transfer and location provisions, and only
to the extent that measures a government adopts are protected in those schedules –
which is difficult to interpret, because these commitments and reservations are framed
to address different rules from those in the electronic commerce chapter.
The accumulation of these chapters creates a legal minefield for domestic regulators and
digital companies.
Paperless Trading
The general obligation on Paperless Trading is mandatory (‘shall’).15 However, it only
requires parties to ‘work towards’ implementing paperless trading initiatives and to
‘endeavour’ to accept trade administration documents as the legal equivalent of paper
versions and make trade administration documents available to the public in electronic
form. The three ASEAN least-developed countries (LDCs) – Cambodia, the Lao People’s
Democratic Republic (Lao PDR), and Myanmar – have a grace period for compliance of 5
years after RCEP enters into force for them.
14
RCEP Article 10.1 uses a wide asset-based definition of investment to include enterprises, shares, intellectual property rights, rights under
contracts and licenses, and more.
15
RCEP Article 12.5.
Full implementation of these obligations would make transactions easier for ASEAN
businesses to operate across the border, and potentially within the domestic economy,
provided those businesses have access to the necessary technology and the relevant
platforms. That proviso could be problematic for smaller businesses and those from
countries with limited technology and connectivity. At the same time, full compliance
could impose significant implementation costs on governments, which is why the
provisions only require ‘endeavours’ to comply.
e-Authentication
There is less flexibility in the third kind of measure, e-authentication,17 which more closely
aligns with the TPP/CPTPP. Governments must allow participants in e-transactions to
decide what they consider are appropriate authentication technologies and implementation
models (such as multi-factor, certificate based, biometric or token-based authentication)
and not limit recognition of those technologies and models. The Party can still have laws
on electronic authentication, but transactors must have the opportunity to show that the
e-authentication methods they have chosen are compliant with those laws.
Whilst financial services are excluded from Chapter 12 Electronic Commerce, regulations
on e-authentication might also be considered to be ‘measures affecting’ the supply of
services electronically, such as computer and related services and financial services,
under the Trade in Services chapter and its Financial Services Annex. It is unclear
whether the negotiators discussed that possibility as the negotiating history is not
publicly available.
16
RCEP Article 12.6.1.
17
RCEP Article 12.6.2.
The provision provides some flexibility for governments to impose performance standards
or certification requirements on a particular category of e-transactions. Whilst the scope
of this flexibility is limited to performance measures or certification, and must apply to
specified categories, the content of those measures and the number of categories is not
prescribed. However, the provision appears to prevent RCEP governments from requiring
the use of particular forms of cybersecurity, etc, such as two-factor authentication or
encryption of personal details, unless the government frames them as ‘performance
standards’ and designates special categories to which those standards apply.
The framework is not prescribed but must ‘take into account’ the relevant United Nations
Commission on International Trade Law (UNCITRAL), United Nations (UN), or other
international conventions and model laws on electronic commerce. The UN Convention
on the Use of Electronic Communications in International Contracts, which is specifically
cited, applies only to use of electronic communications in international contracts; however,
the UNCITRAL Model Law on Electronic Commerce inscribes fundamental legal notions
of non-discrimination, technological neutrality and functional equivalence, which makes
it vital for governments to understand the scope of its application.19
18
RCEP Article 12.11.
19
The TPP/CPTPP more strictly requires the framework to be consistent with the UNICTRAL Model Law or UN Convention, TPP/CPTPP Article
12.14.5.1.
Enforcement
By far the most significant difference between the agreements involves enforcement.
The e-commerce chapter of the TPP/CPTPP is fully enforceable through the state–state
dispute settlement system. The TPP/CPTPP also provides for investor–state dispute
settlement; whilst tech companies established in another Party could not directly enforce
the e-commerce chapter rules, they could seek awards of compensation for the same
measures by claiming that they breach the investor protection rules in the Investment
Chapter.20
The main operational provision promotes dialogue between the Parties, under the auspices
of the RCEP Joint Committee, on a number of mandated matters:23 cooperation to assist
MSMEs and to enhance capacity in the regulatory space, information sharing, building trust,
and promoting development of e-commerce in regional and multilateral forums; current
and emerging issues, including source codes and data flows and storage; and matters
relating to development of e-commerce, such as anti-competitive practices, online dispute
resolution, and temporary movement of professionals. The outcome of the dialogue is to be
considered as part of the 5-yearly general reviews of the Agreement as a whole.24
20
TPP/CPTPP Article 9.6.3 says an investor cannot rely on a finding of a breach of another provision of the Agreement as establishing a
breach of minimum standard of treatment for investors. However, that does not stop the investor making a claim about the same measure.
21
RCEP Article 12.17.
22
That is provided for in RCEP Article 20.8.
23
RCEP Article 12.16.
24
RCEP Article 20.8.
Despite this lack of clarity, developed countries want the ban made permanent in the
WTO and have already done so in various FTAs.29 Conversely, many developing countries
want the moratorium removed because of its escalating impacts on revenue and on
their ability to use tariffs to support their fledgling digital industrialisation (Kanth, 2021).
Research published by UNCTAD in June 2020 shows the moratorium has disproportionate
and significant tariff revenue losses and development impacts for developing countries,
whatever definition of e-transmissions is applied (Kozul-Wright and Banga, 2020). A recent
analysis for ERIA made similar findings for ASEAN countries (Montes and Lunenborg,
forthcoming).
The TPP/CPTPP and RCEP reflect these conflicting positions. The former commits the
Parties to a permanent ban on customs duties on an ‘electronic transmission’, which it
defines as ‘a transmission made using any electromagnetic means’, but still leaves the
distinction between digital carriage (just the technology) and digital content unresolved
for the purposes of the ban. Parties to RCEP that have ratified the CPTPP (which Brunei and
Malaysia have not) are bound by that obligation, as will be any country that subsequently
accedes to the CPTPP.
25
RCEP Article 10.18.
26
WTO General Council (1998), ‘Work Programme on Electronic Commerce’, adopted 25 September 1998, WT/L/274 (30 September 1998).
27
Taxes, fees, or other charges on electronic transmissions are explicitly excluded, but that simply clarifies the kind of tax, not what it applies to.
28
World Trade Organization. ‘Statement by Indonesia. Facilitator’s consultation on electronic commerce. MC11 Declaration, and other
relevant plenary sessions. 13 December 2017’, WT/MIN(17)/68, 20 December 2017.
29
Of course, any State can unilaterally remove all customs duties on e-transmissions, including content.
For some years, the Group of 24 Finance Ministers from developing countries, and the
more dominant OECD/G20 Inclusive Framework, have been considering how to update
international tax norms to deal with Base Erosion and Profit Shifting by digital MNEs.
As discussions within the Inclusive Framework stalled, a number of countries, including
several from ASEAN, implemented or proposed to adopt taxes on digitalised services
transactions and digital multinational enterprises’ revenues.31
A digital services tax could be considered a ‘measure that affects’ e-commerce or trade
in various services, such as computer and related services, advertising or distribution
services for the purposes of RCEP’s trade in services and e-commerce chapters. In
addition to non-discrimination rules, a number of e-commerce provisions, especially
those that prevent requirements for a local presence (located in the services chapter)
and for localisation of data, could hinder a government’s ability to tax the digital economy
effectively.
Whilst the e-commerce chapter is not enforceable, tax measures may be subject to a
state–state dispute under Chapter 8 Trade in Services, discussed earlier. In its defence,
governments would have to invoke the taxation exception. As with the moratorium on
customs duties, there are stark differences here between the TPP/CPTPP and RCEP.
30
RCEP Article 12.11.
31
Under the high-level agreement reached by the OECD/G20 Inclusive Framework in 2021 a proposed Multilateral Convention would require
the removal of existing digital services taxes and prevent the introduction of such taxes in the future. See OECD/G20 (2021).
32
TPPA Article 29.4.
However, RCEP’s tax exception only addresses problems that might be posed by its new
rules. It does not resolve the existing difficulties with the WTO’s exceptions on taxation
of goods or services, in particular, Article XIV of the General Agreement on Trade in
Services (GATS).35 That exception is limited to breaches of the national treatment (non-
discrimination) rule, and applies only where the measure aims to achieve the equitable
and effective implementation or collection of direct taxes and the measure does not
constitute arbitrary or unjustifiable discrimination between countries or a disguised
restriction on trade.36
33
RCEP Article 17.14.
34
RCEP Article 17.14.
35
WTO General Agreement on Trade in Services Article XIV(d).
36
The US has targeted digital services taxes, in particular, by investigations under Section 301 of the US Trade Act 1974, resulting in threats
of sanctions against countries who adopt or maintain them. The analysis in those Investigations would treat digital services taxes as failing
this test. See discussion in Kelsey (2021).
37
The RCEP government procurement chapter is much more limited than the TPP/CPTPP and is also not subject to dispute settlement.
38
RCEP Article 12.16.
The e-commerce chapters in both the TPP/CPTPP and RCEP exclude government
procurement from their scope. However, an agreement-wide definition of government
procurement in the TPP/CPTPP limits the term to the process of procuring goods or
services for the internal and non-commercial use of a government.39 Therefore, the
carveout for government procurement from the rules in the TPP/CPTPP e-commerce
chapter does not apply to the substance of the procurement or inputs into governments’
for-profit activities.
The principal objective of the tech industry lobby in the TPP negotiations was therefore
to secure unfettered rights to collect, accumulate, process, and exploit data in their
place of choice on their own terms (Kelsey, 2018). Tech-based firms, especially the big
services MNEs, want to centralise their facilities and processing of data sourced from
their operations across the Asian region to maximise its value and minimise costs.
They also want to decide where to locate the data so they can engage in regulatory and
jurisdictional, as well as tax, arbitrage.
39
TPP/CPTPP Article 1.3.
Countries have to balance a variety of objectives when they are hosting foreign tech
suppliers. As part of their digital development strategies, governments may want to
ensure that their national firms have access to data generated locally. They may want
to require companies with large holdings of data to use local storage facilities to justify
their investment of public funds to build expensive infrastructure. They also need to
address myriad non-commercial policy concerns about data security, cybersecurity,
political manipulations, terrorist organisation and dissemination of content, human rights
violations, unregulated blockchains, cryptocurrency trading, money laundering, privacy,
consumer protection, and more.
Data Localisation
Both the TPP/CPTPP and RCEP require covered businesses to be allowed to transfer
information outside the source country for the purpose of their business and prohibit
governments from requiring them to use local computing facilities, such as servers.
However, the TPP/CPTPP guarantees far greater protection to commercial firms and is
far more restrictive of governments than RCEP.
Both the so-called ‘data localisation’ provisions have an important carveout for
information ‘held or processed on behalf of a party’. The problematic words are ‘on
behalf’. This exclusion would clearly apply to national or sectoral data bases that are run
by the government, or where a private firm is contracted to store and process data for
government. It is less clear when it comes to projects co-developed with private interests,
including for surveillance, traffic control or smart city projects, especially when a private
firm collects and controls the data and integrates it with its other activities. Private firms
that provide data services for public and private providers, such as health systems, may
also fall outside the exclusion, unless their contract provides otherwise.
There are three major differences in the flexibility that the TPP/CPTPP and RCEP provide
for governments to adopt policy measures that are inconsistent with these two rules.
The first difference relates to public policy objectives. Both data localisation rules
allow a Party to adopt inconsistent measures that it considers ‘necessary’ to achieve a
‘legitimate public policy objective’. That flexibility is subject to a proviso that the measure
The second difference the protection of ‘essential security interests’. Recent controversies
over data mining, cyber-espionage, use of bots and encrypted messaging have heightened
states’ sensitivity. Governments have restricted sites, apps, and movement of data on
the basis of national security for a variety of motivations. China’s sweeping digital laws
have been highlighted as being repressive (Kynge and Yu, 2021), but state censorship and
surveillance in the name of national security is increasingly common in many countries.
The data transfer and storage provisions in RCEP exclude measures a Party considers
necessary for its ‘essential security interests’.41 The exercise of this power is explicitly
self-judging and reliance on the exception cannot be disputed by the other Parties. There
is no similar exception in the equivalent TPP/CPTPP provisions on data localisation.
However, that omission could be explained by the difference in the agreement-wide
security exceptions. The TPP/CPTPP’s general security exception is broad and explicitly
self-judging,42 whereas RCEP follows the more limited WTO approach of specifying
criteria that need to be met.43 The RCEP self-judging national security exception also
applies only to the data transfer and storage provisions; it does not apply, for example, to
the provision on e-authentication in the same chapter.
40
RCEP Article 12.14.3(a) fn 12, Article 12.15.3(a) fn 14.
41
RCEP Articles 12.14.3(b) and 12.15.3(b).
42
TPP/CPTPP Article 29.2.
43
RCEP Article 17.3
44
TPPA/CPTPP Article 14.16; RCEP Article 12.13.
The third major difference relates to phase in periods for developing countries. There
is no ability for Parties to take reservations to these data-related obligations in either
agreement. The CPTPP has granted Viet Nam a waiver of the dispute settlement provisions
for its cybersecurity law for 5 years after entry into force, being January 2025. Brunei and
Malaysia are also currently not subject to these rules, as they have not ratified the CPTPP.
In RCEP all three LDCs have a grace period of 5 years from entry into force to comply, with
a possible 3-year extension for both provisions. Viet Nam also has 5 years to comply. Of
course, failure to meet these obligations in RCEP can only be pursued through the inter-
Party consultative mechanisms, unless a complaint can be brought under Chapter 12 on
Trade in Services relating to ‘a measure affecting trade in services’. That would not be
protected by the self-judging exceptions in the e-commerce chapter.
Financial Data
Both agreements exclude financial services from the scope of their e-commerce
chapters.45 The original exclusion from the TPP was at US insistence, informed by its
difficulties accessing data held offshore during the finance sector collapse in 2007. Yet
financial data is not excluded from either agreement altogether. Definitions of financial
services in Chapter 11 of the TPP/CPTPP and Annex 8A in RCEP explicitly include the
‘provision and transfer of financial information, and financial data processing and related
software by suppliers of other financial services’. Similar financial services rules apply in
both the TPP/CPTPP and RCEP (for example, on non-discrimination, cross-border trade,
and new financial services46). In RCEP they apply more broadly to ‘measures affecting’
the supply of financial services, compared to the TPP/CPTPP’s ‘measures relating to’.47
However, RCEP also has an explicit financial data transfer provision that is not in the TPP/
CPTPP.48 Echoing the e-commerce chapter, it guarantees that finance firms can transfer
data out of the source country for processing as an ordinary part of their business. A
government can require a copy of information to be held in the country, provided that
information can also be moved and stored offshore.
45
TPPA/CPTPP Article 14.1; RCEP Article 12.1.
46
RCEP Annex 8A, Article 3 provision on ‘new financial services’ is more flexible. It requires a Party to make ‘best endeavours’ to allow the
supply of a financial service not already being provided in the country, or a new form of one that is already being provided, if it is being
legally supplied and regulated in another RCEP country.
47
RCEP Annex 8A Article 2 cf TPP/CPTPP Article 11.2.1.
48
RCEP Annex 8A Article 9.
Source Code
A further very significant variation relates to exclusive rights over technology, specifically
source code. The TPP/CPTPP prevents Parties from requiring the owners of the source
code used in mass-market software to provide access to it as a condition of the code,
or products that contain it, being sold, or used in their territory, except where the code
is used for critical infrastructure.49 The USMCA explicitly extends this protection to
algorithms expressed in source code. There is no equivalent provision on source code in
RCEP, although it is flagged as a matter for future dialogue between the Parties.50
Transparency
Finally, there is an important difference in the transparency requirements in the two
agreements. The TPP/CPTPP requires prior consultation with other Parties and their
commercial interests on proposed new regulation, to the extent possible.51 The RCEP’s
transparency obligations are all post-regulation,52 which reduces the potential for
lobbying and threats by digital companies where governments regulate. Parties are
required to make general measures that comply with this chapter available publicly, at
least on the Internet, ‘as promptly as possible’ but only ‘where feasible’. They must also
respond as promptly as possible to requests from another Party for specific information
about those measures.
49
Later agreements, such as the USMCA, go further, covering all source code and algorithms contained in source code, although the USMCA
has a broader exception than the TPP/CPTPPP to enable specific investigations by regulators.
50
RCEP Article 12.16.
51
TPPA/CPTPP Article 26.2.
52
RCEP Article 12.13.
The personal privacy provisions in the TPP/CPTPP and RCEP are also similar. Personal
information is defined as ‘any information, including data, about an identified or identifiable
individual’. In RCEP, Parties must have a legal framework that ‘ensures the protection of
personal information of the users of electronic commerce’.54 The TPP only requires the
law to provide for protection of personal information of an identifiable natural person.
53
RCEP Article12.8.
54
RCEP Article12.9.
there are serious questions about how suitable the trade regime is to regulate the
issue of data. … Provisions in trade agreements have implications for domestic policies
– such as those related to privacy, national security and industrial development –
through these implications are not sufficiently considered. Furthermore, … developing
countries might face the choice of ‘trading away their right (or policy space) to regulate
data flows’ to protect other interests in the trade agenda (UNCTAD, 2021, p.166).
Given the unequal negotiating power of state parties and the lobbying power of the
technology industry, such agreements are likely to consolidate the dominance of a small
number of very powerful multinationals that already control the digital eco-system and
the vital resource of data (UNCTAD, 2021, p.146). The rules that are designed to serve
their model work to encourage tax, data and regulatory arbitrage and further disable
governments that need to find a new balance between development strategies, support
for innovation, and protective regulation in the 21st century digitalised economy. The
overreach of FTAs into the general regulation of the digital domain beyond traditional
areas of trade has also fuelled a growing resistance to digital trade rules, including the
plurilateral e-commerce negotiations in the WTO.
This paper has highlighted the significance of RCEP in promoting a more flexible approach
that encourages regional cooperation on the development of appropriate policy and
regulation, instead of rigid, enforceable rules that are subject to limited and uncertain
exceptions. The RCEP electronic commerce chapter reflects an increasingly sophisticated
understanding about these issues amongst policymakers, academics, civil society, and
media analysts in the years since the TPP chapter was agreed.
The wisdom of ASEAN countries holding back from making enforceable commitments
on e-commerce should allow them to deepen their national and regional understanding
of the opportunities and challenges these agreements present, including through the
mechanisms of dialogue and cooperation, whilst developing and implementing their
own digital development strategies. Unfortunately, those good efforts may yet be undone
through the back door of the binding and enforceable trade in services rules.