Data Flows & National Security: A Conceptual Framework to Assess Restrictions on Data Flows Under GATS Security Exception

This paper explores the national security implications of a potential for a WTO dispute on data flow restrictions. It proposes a basic conceptual framework to assess data flows’ restrictions under GATS security exception. The paper represents a contribution to the literature because it is the first paper to address systematically the issue of data flows and national security in the context of a GATS dispute and because it provides a unique perspective that looks both at legal and technical arguments. If a case where to be brought before the WTO dispute settlement, there are certain national security concerns which can be considered essential and imminent, and that therefore the defender might bring up to support its case for invoking the security exception. These are: protection from cyber espionage, protection from cyber attacks on critical infrastructure, and access data in order to prevent terrorist threats. The paper presents both a legal and technical analysis of these three cases in order to assess the relevance of restrictions on data flows under GATS security exception. This analysis can, more generally, inform the debate on the protection of national security in the digital era. The paper finds that in the three cases, restrictions on data considered critical for national security might raise the cost of certain attacks. However, the risks would remain pervasive and national security would not be significantly enhanced both legally and technically. As a matter of fact, several studies claim that local processing requirements can have rather a detrimental impact on security. The implementation of good security standards and encryption techniques appears to be a more effective way to ensure a better response to cyber threats. All in all, it will be important to investigate on a case by case basis whether the scope of the measure (sectors and data covered) is considered proportionate and whether the measure in question in practice reduces the exposure of the country to cyber espionage, cyber attacks and terrorist threats.