On September 25, the world’s first fully digitalised cross-border movement of goods arrived in Singapore. The shipment, which came from the UK, marked a major milestone in trade history as the entire transaction process was wholly paperless. Enabled by the UK-Singapore Digital Economy Agreement, a pioneering trade deal in the governance of digital trade, the transaction reflects both the success of digital integration and demand for progressive trade rules globally.
The Association of Southeast Asian Nations (Asean), too, strides forward in advancing digital integration. Asean launched negotiations on the Digital Economy Framework Agreement (DEFA) last month (September). Touted as the world’s first region-wide digital economy agreement, the DEFA is an opportunity for Asean to write its own rules for digital trade governance. With South-east Asia’s digital economy expected to be worth up to US$2 trillion by 2030 with the launch of a high-quality DEFA, rule-making in digital trade governance will enable Asean to leverage the growth opportunities presented by the rapidly growing digital economy.
Central to digital integration is the harmonisation of data regulations. Establishing clear rules that govern the movement, use and protection of cross-border data flows is key for countries to leverage an increasingly digitalised trade environment. From digital payments and digitalised custom procedures to data privacy and security, cross-border data flows underpin much of today’s global economic activities.
Asean’s acceleration of regulatory harmonisation on data issues comes at an opportune moment when global data governance is at a precipice. The global data governance regime is potentially at risk of fragmentation as data rules diffuse across countries through free trade agreements (FTAs). Distinctive models of data regulation centred around the major economies of China, the EU and the US are already emerging.
The potential bifurcation of the global data governance regime where Asean member states are made to choose among different models of data regulation will be a major blow to Asean’s digital integration.
Caught in the middle of distinct data rules
Regulatory harmonisation among Asean member states is especially challenging given the patchwork of data rules adopted in the region. Domestic data regulation policies of Asean member states are revealing of diverging preferences towards how to govern data. Some have implemented stringent data regulation frameworks that prioritise data protection, while others provide for less restrictions on data flows. For instance, Indonesia and Vietnam have opted to implement data localisation laws that mandate the storage of locally generated data within their territories. The frameworks in Singapore, Thailand, and Malaysia, meanwhile, allow for data transfers conditional on adequate data protection, among other requirements.
Actual harmonisation of cross-border data regulation across Asean member states is also limited and highly uneven. Data-related provisions in most Asean member states’ FTAs are few, the majority of which are weakly legalised and also emphasise exceptions. This means that obligations for the free transfer or movement of data do not preclude unilateral imposition of data protection measures by signatories. This essentially undermines the intended regulatory coherence from incorporating data rules in FTAs.
Diverging preferences among member states and limited intra-Asean regulatory harmonisation make the region vulnerable to potential fragmentation of the global data governance regime. Already, there are distinct data regulatory models centred around China, EU and the US. The FTAs signed by each of these major economies respectively are also characterised by different priorities. China’s FTAs prioritise legally binding provisions on the protection of personal data and information, while similar provisions in the EU’s and the US’ FTAs are weakly binding. Instead, EU and US FTAs contain more provisions for the free transfer or movement of data.
If countries increasingly lean in to their preferred data regulatory models, distinct regimes in global data governance could potentially emerge. Asean risks being caught in the middle as data rules defined by China, the EU or the US dominate and shape countries’ choices for data governance. Existing legislative packages, such as the EU’s Digital Services Act and Digital Markets Act, raise the spectre of fragmentation as these major players externalise their own regulatory frameworks. Despite its ambitions, Asean will not only become a rule-taker in global trade but will also be hard-pressed to choose among these possibly contradictory or competing rules.
Define own rules for governing data
Asean is well-positioned to write its own rules on data governance, and the DEFA offers an opportunity to do so. Frontrunners in data governance in Asean, such as Singapore – which has inked several digital trade deals – already possess the experience and expertise to expedite this process. Novel rules introduced in Singapore’s digital economy agreements relate to issues including encryption, source code and artificial intelligence which are at the cutting edge of global data governance.
Asean’s ongoing collaborations on the digital economy with its dialogue partners should also be leveraged. The Regional Comprehensive Economic Partnership – a landmark FTA between Asean and its FTA partners including Australia, China, Japan, New Zealand and South Korea – offers a starting point for DEFA. The agreement can afford to address issues beyond those included in RCEP which pertain to limits on cross-border data flows and location of computing facilities. Pinpointing specific international standards as the benchmark for policy development, articulating mechanisms to address barriers to data flows, or specifying conditions under which reserved rights to limit cross-border data flows can be invoked are potential areas for progress.
With DEFA negotiations set to be concluded by 2025, this is the golden hour for Asean to write the data rules it needs to achieve and thrive from digital integration.
This article was first published in The Business Times on 3 October 2023.