The United Nations Human Rights Council: Background and Policy Issues

Summary: Over the years, many Members of Congress have demonstrated an ongoing interest in the role and effectiveness of the United Nations (U.N.) Human Rights Council (the Council). The Council is the primary intergovernmental body mandated with addressing human rights on a global level. During the Obama Administration and the first part of the Trump Administration, the United States served three terms as a Council member. In June 2018, Trump Administration officials announced U.S. withdrawal from the Council, noting concerns with the Council's focus on Israel, overall ineffectiveness in addressing human rights issues, and lack of comprehensive reform.

Summary: Background

Summary: The U.N. General Assembly established the Human Rights Council in 2006 to replace the Commission on Human Rights, which was criticized for its apparent ineffectiveness in addressing human rights abuses and for the number of widely perceived human rights abusers that served as its members. Since 2006, many governments and observers have expressed serious concerns with the Council's disproportionate attention to Israel and apparent lack of attention to other pressing human rights situations. In particular, some criticize the inclusion of the "human rights situation in Palestine and other occupied Arab territories" (Israel) as a permanent item on the Council's agenda. No other country-specific human rights situation is singled out in this manner. Some are also concerned that countries widely perceived as human rights abusers, such as Saudi Arabia, China, and the Democratic Republic of the Congo, serve as Council members. On the other hand, supporters argue that the Council is an improvement over the previous commission. They contend that the Council's Universal Periodic Review (UPR) process, which aims to evaluate each member state's fulfillment of its human rights obligations, is an effective means for addressing human rights issues in various countries. Many proponents of the Council are encouraged by its increased attention to human rights situations in countries such as Iran, North Korea, and Syria.

Summary: U.S. Policy

Summary: Over the years, U.S. policymakers have debated U.S. participation in and funding of the Human Rights Council. The George W. Bush Administration voted against the General Assembly resolution creating the Council and did not run for membership; it also decided to withhold U.S. funding to the organization in FY2008 under a provision enacted by Congress. Conversely, the Obama Administration supported the overall purpose of the Council and decided that it was better to work from within as a Council member to improve its effectiveness. The Obama Administration was also critical of the Council's focus on Israel, sometimes boycotting debates on the issue. The United States was elected to the Council in 2009 and in 2012. In October 2016, it was elected for a third term, which began in January 2017. The United States remained a member during the Trump Administration until mid-2018, when it announced its withdrawal. The Administration also withheld Council funding in FY2017 and FY2018.

Summary: Some Members of Congress maintain an ongoing interest in the credibility and effectiveness of the Council. Members have been particularly critical of both the Council's focus on Israel and lack of competitive Council elections. Some Members have proposed or enacted legislation calling for U.S. withdrawal; at the same time, others have introduced legislation urging the Council to address specific human rights situations. Most recently, the Consolidated Appropriations Act, 2019 (P.L. 116-6 ), prohibits Council funding unless the Secretary of State determines that U.S. participation is important to the national interest of the United States, and that the Council is taking steps to remove Israel as a permanent agenda item and ensure the integrity of Council elections.

The United Nations (U.N.) Human Rights Council (the Council) is the primary intergovernmental body that addresses human rights worldwide. The United States is not currently a Council member; in June 2018, the Trump Administration announced that the United States would withdraw its membership. Administration officials cited concerns with the Council's disproportionate focus on Israel, ineffectiveness in addressing human rights situations, and lack of reform.

Members of the 116 th Congress may continue to consider the Council's role and effectiveness, including what impact, if any, the U.S. withdrawal might have on (1) the Council's efforts to combat human rights and (2) the United States' ability to further its human rights objectives in U.N. fora. Policymakers might also consider the following questions:

What role, if any, should the Council play in international human rights policy and in addressing specific human rights situations? Is the Council an effective mechanism for addressing human rights worldwide? If not, what reform measures might improve the Council and how can they be achieved? What role, if any, might the United States play in the Council, or in other U.N. human rights mechanisms, moving forward? Should the United States rejoin the Council? If so, under what circumstances?

This report provides background on the Council, including the role of the previous U.N. Commission on Human Rights. It discusses the Council's current mandate and structure, as well as Administration policy and congressional actions. Finally, it highlights policy aspects of possible interest to the 116 th Congress, including the debate over U.S. membership, U.S. funding of the Council, alternatives to the Council in U.N. fora, and the Council's focus on Israel.

The U.N. Commission on Human Rights was the primary intergovernmental policymaking body for human rights issues before it was replaced by the U.N. Human Rights Council in 2006. Created in 1946 as a subsidiary body of the U.N. Economic and Social Council (ECOSOC), the commission's initial mandate was to establish international human rights standards and develop an international bill of rights. During its existence, the commission played a key role in developing a comprehensive body of human rights treaties and declarations, including the Universal Declaration of Human Rights. Over time, its work evolved to address specific human rights violations and complaints, as well as broader human rights issues. It developed a system of special procedures to monitor, analyze, and report on country-specific human rights violations, as well as thematic cross-cutting human rights abuses such as racial discrimination, religious intolerance, and denial of freedom of expression.

In the late 1990s and early 2000s, controversy developed over the human rights records of some commission members that were widely perceived as systematic abusers of human rights. These instances significantly affected the commission's credibility. Critics, including the United States, claimed that countries used their membership to deflect attention from their own human rights violations by questioning the records of others. Some members were accused of bloc voting and excessive procedural manipulation to prevent debate of their human rights abuses. In 2001, the United States was not elected to the commission, whereas widely perceived human rights violators such as Pakistan, Sudan, and Uganda were elected. In 2005, the collective impact of these and other controversies led U.N. Secretary-General Kofi Annan to propose the idea of a new and smaller Human Rights Council to replace the commission.

Council Structure and Selected Policy Issues

In 2006, as part of broader U.N. reform efforts, the U.N. General Assembly approved resolution 60/251, which dissolved the U.N. Commission on Human Rights and created the Human Rights Council in its place. This section provides an overview of Council structure and selected policy issues and concerns that have emerged over the years.

The Council is responsible for "promoting universal respect for the protection of all human rights and fundamental freedoms for all." It aims to prevent and combat human rights violations, including gross and systematic violations, and to make recommendations thereon; it also works to promote and coordinate the mainstreaming of human rights within the U.N. system. As a subsidiary of the General Assembly, it reports directly to the Assembly's 193 members. It receives substantive and technical support from the U.N. Office of the High Commissioner for Human Rights (OHCHR), an office within the U.N. Secretariat currently headed by Michelle Bachelet of Chile. The Council is a political body; each of its members has different human rights standards, domestic considerations, and foreign policy priorities. Its decisions, resolutions, and recommendations are not legally binding.

The Council comprises 47 members apportioned by geographic region as follows: 13 from African states; 13 from Asian states; 6 from Eastern European states; 8 from Latin American and Caribbean states; and 7 from Western European and other states ( Table 1 ). Members are elected for a period of three years and may not hold a Council seat for more than two consecutive terms. If a Council member commits "gross and systematic violations of human rights," the General Assembly may suspend membership with a two-thirds vote of members present. All U.N. members are eligible to run for a seat on the Council. Countries are nominated by their regional groups and elected by the General Assembly through secret ballot with an absolute majority required. Since 2006, the Council has held 13 elections, the most recent of which was in October 2018. The next election is scheduled for late 2019.

A key concern for some critics has been the lack of competitiveness in Council elections. In some elections, countries have run unopposed after regional groups nominated the exact number of countries required to fill Council vacancies. Most recently, members from all five regional groups ran unopposed in the October 2018 election. Many experts contend that such actions limit the number of choices and guarantee the election of nominated members regardless of their human rights records. On the other hand, supporters contend that the Council's election process is an improvement over that of the commission. They emphasize that countries widely viewed as the most egregious human rights abusers, such as Belarus, Sudan, and Syria, were pressured not to run or were defeated in Council elections because of the new membership criteria and process. Many also highlight the General Assembly's March 2011 decision to suspend Libya's membership as an example of improved membership mechanisms.

More broadly, some Council observers have expressed concern that the Council's closed ballot elections in the General Assembly may make it easier for countries with questionable human rights records to be elected to the Council. To address this issue, some experts and policymakers, including the Trump Administration, have proposed requiring open ballots in Council elections to hold countries publicly accountable for their votes.

The Council is headquartered in Geneva, Switzerland, and meets for three or more sessions per year for a total of 10 or more weeks. It can hold special sessions on specific human rights situations or issues at the request of any Council member with the support of one-third of the Council membership. Since 2006, the Council has held 39 regular sessions and 28 special sessions. Since the Council was established, eight of its special sessions have focused on Israel or the Occupied Territories. (See Appendix A for a list of special sessions.)

The Council president presides over the election of four vice presidents representing other regional groups in the Council. The president and vice presidents form the Council bureau, which is responsible for all procedural and organizational matters related to the Council. Members elect a president from among bureau members for a one-year term. The current president is Coly Seck of Senegal.

All Council members and U.N. member states are required to undergo a Universal Periodic Review (UPR) that examines a member's fulfillment of its human rights obligations and commitments. The review is an intergovernmental process that facilitates an interactive dialogue between the country under review and the UPR working group, which is composed of the 47 Council members and chaired by the Council president. Observer states and stakeholders, such as nongovernmental organizations (NGOs), may also attend the meetings and present information. During the first review, the UPR working group makes initial recommendations, with subsequent reviews focusing on the implementation of previous recommendations. The full Council is responsible for addressing any cases of consistent noncooperation with the review. The United States underwent its first UPR in November 2010 and its second in May 2015.

Overall, many governments, observers, and policymakers support the Council's UPR process. They maintain that it provides an important forum for governments, NGOs, and others to discuss and bring attention to human rights situations in specific countries that may not otherwise receive international attention. Some countries have reportedly made commitments based on the outcome of the UPR process. Many NGOs and human rights groups operating in various countries also reportedly use UPR recommendations as a political and diplomatic tool for achieving human rights. At the same time, some human rights experts have been critical of UPR. Many are concerned that the UPR submissions and statements of governments perceived to be human rights abusers are taken at face value rather than being challenged by other governments. Some also contend that the UPR process gives these same countries a platform to criticize countries that may have generally positive human rights records. Many experts have also expressed concern regarding member states' response to and participation in the UPR process.

The Council maintains a system of special procedures that are created and renewed by members. Country mandates allow for special rapporteurs to examine and advise on human rights situations in specific countries, including Cambodia, North Korea, and Sudan. Under thematic mandates, special rapporteurs analyze major global human rights issues, such as arbitrary detention, the right to food, and the rights of persons with disabilities. The Council also maintains a complaint procedure for individuals or groups to report human rights abuses in a confidential setting.

In June 2007, Council members adopted a resolution to address the Council's working methods. In the resolution, Council members included the "human rights situation in Palestine and other occupied Arab territories" as a permanent part of the Council's agenda. No other countries are singled out in this manner. At the time the agenda item was adopted, many U.N. member states and Council observers, including the United States, strongly objected to the Council focusing primarily on human rights violations by Israel. A U.N. spokesperson subsequently noted then-U.N. Secretary-General Ban Ki-moon's "disappointment" with the Council's decision to "single out only one specific regional item, given the range and scope of allegations of human rights violations throughout the world."

The Human Rights Council is funded primarily through the U.N. regular budget, of which the United States is assessed 22%. Estimated Council funding for the 2018-2019 regular budget biennium is $44.43 million (or $22.2 million per year). The Council also receives extrabudgetary (voluntary) funding to help cover the costs of some of its activities, including staff postings and Council trust funds and mechanisms. For the 2018-2019 biennium, such contributions are estimated at $16.27 million (about $8.13 million per year).

Most U.S. policymakers have generally supported the Council's overall purpose and mandate; however, many have expressed concern regarding its effectiveness in addressing human rights issues—leading to ongoing disagreements as to whether or not the United States should be a member of or provide funding for the Council. For example, under President George W. Bush, the United States voted against the Assembly resolution creating the Council and did not run for a seat, arguing that the Council lacked mechanisms for maintaining credible membership. (The George W. Bush Administration also withheld Council funding in FY2008 under a provision enacted by Congress in 2007.) On the other hand, the Obama Administration supported U.S. membership and Council funding, maintaining that it was better to work from within to improve the body; the United States was elected as a Council member in 2009, 2012, and 2016. Under President Obama, the United States consistently opposed the Council actions related to Israel and sought to adopt specific reforms during the Council's five-year review in 2011. Congressional perspectives on the issue have been mixed, with some Members advocating continued U.S. participation and others opposing it. A key concern among many Members of Congress is the Council's focus on Israel.

On June 18, 2018, then-U.S. Permanent Representative to the United Nations Nikki Haley and Secretary of State Michael Pompeo announced that the United States would withdraw from the Human Rights Council, citing concerns about U.S. sovereignty and the Council's disproportionate focus on Israel. In a September 2018 speech to the U.N. General Assembly, the President further stated that the United States "will not return [to the Council] until real reform is enacted." Although Administration officials stated that the United States would fully withdraw from the Council, the United States has continued to participate in some Council activities, including the Universal Periodic Review process. Administration officials have also continued to comment on Council elections and express support for continued reform of the organization. The United States withheld $7.67 million in Council funding in both FY2017 and FY2018 (for a total of $15.3 million over two years) under legislation enacted by Congress.

Prior to withdrawing from the Council, the Trump Administration had expressed strong reservations regarding U.S. membership. It was particularly concerned with the Council's focus on Israel and lack of attention to other human rights abuses. Ambassador Haley called the Council "corrupt" and noted that "bad actors" are among its members; at the same time, she also stated that the United States wanted to find "value and success" in the body. In June 2017, Haley announced that if the Council failed to change, then the United States "must pursue the advancement of human rights outside of the Council." Haley outlined two key U.S. reform priorities: (1) changing the voting process in the General Assembly from a closed to open ballot so that countries can be held publicly accountable for their votes and (2) removing Israel as a permanent agenda item.

Congress maintains an ongoing interest in the credibility and effectiveness of the Council in the context of human rights promotion, U.N. reform, and concerns about the Council's focus on Israel. Over the years, Members have proposed or enacted legislation expressing support for or opposition to the Council, prohibiting U.S. Council funding, or supporting Council actions related to specific human rights situations. Most recently, Members of the 116 th Congress enacted the Consolidated Appropriations Act, 2019 ( P.L. 116-6 ), which requires that none of the funds appropriated by the act be made available for the Council unless the Secretary of State determines and reports to the committees on appropriations that participation in the Council is in the national interest of the United States, and that the Council is taking significant steps to remove Israel as a permanent agenda item and ensure integrity in the election of Council members. (Similar language was included in previous fiscal years' appropriations laws.) P.L. 116-6 also addresses the Council in the context of the human rights situations in Sri Lanka; specifically, it states that funds may be made available to the Sri Lankan government only if the Secretary of State certifies to Congress that the Sri Lankan government is, among other things, supporting a credible justice mechanism in compliance with Human Rights Council resolution 30/1 (October 2015).

In previous Congresses, proposed stand-alone bills have called for U.S. withdrawal from the Council or required that the United States withhold assessed contributions to the Council through the U.N. regular budget and any voluntary contributions. Specifically, some Members of the 115 th Congress introduced legislation addressing a range of issues, including expressing concern with the Council's focus on Israel, seeking to defund or withdraw from the Council, and calling on the Council to take action on specific human rights situations.

Congressional debate regarding the U.N. Human Rights Council has generally focused on a recurring set of policy issues.

In general, U.S. policymakers have been divided as to whether the United States should serve as a member of the Council. Supporters of U.S. participation contend that the United States should work from within the Council to build coalitions with like-minded countries and steer the Council toward a more balanced approach to addressing human rights situations. Council membership, they argue, places the United States in a position to advocate its human rights policies and priorities. Supporters also maintain that U.S. leadership in the Council has led to several promising Council developments, including increased attention to human rights situations in countries such as Iran, Mali, North Korea, and Sudan, among others. Some have also noted that the number of special sessions addressing Israel has decreased since the United States joined the Council. In addition, some Council supporters are concerned that U.S. withdrawal might lead to a possible leadership gap and countries such as China and Russia could gain increased influence in the Council.

Opponents contend that U.S. membership provides the Council with undeserved legitimacy. The United States, they suggest, should not be a part of a body that focuses disproportionately on one country (Israel) while ignoring many human rights situations in countries that are widely believed to violate human rights. Critics further maintain that the United States should not serve on a body that would allow human rights abusers to serve as members. Many also suggest that U.S. membership on the Council provides countries with a forum to criticize the United States, particularly during the UPR process.

Over the years, policymakers have debated to what extent, if any, the United States should fund the Council. Some Members have proposed that the United States withhold a proportionate share of its assessed contributions, approximately 22%, from the U.N. regular budget, which is used to fund the Council. Most recently, FY2017 through FY2019 State-Foreign Operations acts have placed conditions on U.S. funding to the Council, and the Trump Administration subsequently withheld $7.67 million from U.S. contributions to the U.N. regular budget in both FY2017 and FY2018. Information on FY2019 Council funding is currently unavailable. Legislating to withhold Council funds in this manner is a largely symbolic policy action because assessed contributions finance the entire U.N. regular budget and not specific parts of it. The United States had previously withheld funding from the Council in 2008, when the George W. Bush Administration withheld a proportionate share of U.S. Council funding from the regular budget under a law that required the Secretary of State to certify to Congress that funding the Council was in the best national interest of the United States.

Some observers and policymakers have argued that if the United States were to withdraw from the Council, it could pursue its human rights objectives in other U.N. fora. Specifically, some suggest that the United States focus on the activities of the General Assembly's Third Committee, which addresses social, humanitarian, and cultural issues, including human rights. Some also recommend that the United States could increase its support for the U.N. Office of the High Commissioner for Human Rights, as well as the Council's independent experts who address country-specific and functional human rights issues. Other U.S. policymakers have proposed addressing human rights in the U.N. Security Council. In April 2017, U.S. Permanent Representative Haley held the Security Council's first ever thematic debate on human rights issues, where she stated the following:

The traditional view has been that the Security Council is for maintaining international peace and security, not for human rights. I am here today asserting that the protection of human rights is often deeply intertwined with peace and security. The two things often cannot be separated.

On the other hand, critics of this approach might argue that some proposed alternatives do not carry the same level of influence as the Human Rights Council, particularly since bodies such as the General Assembly and Security Council do not focus exclusively on human rights issues. Opponents of U.S. withdrawal contend that unlike the proposed alternatives, the Council includes unique mechanisms to address human rights issues, such as the complaint procedure and Universal Periodic Review process.

The Council's ongoing focus on Israel has continued to concern some Members of Congress. In addition to singling out Israel as a permanent part of the Council's agenda, other Council actions—including resolutions, reports, and statements by some Council experts—have generated significant congressional interest for what many view as an apparent bias against Israel. For example, some Members of Congress demonstrated considerable concern with a September 2009 Council report (often referred to as the "Goldstone Report" after the main author, Richard Goldstone, an independent expert from South Africa), which found "evidence of serious violations of international human rights and humanitarian law," including possible war crimes, by Israel. The report received further attention in April 2011, when Goldstone stated that the report's conclusion that Israel committed possible war crimes may have been incorrect.

In addition, the statements and findings of Richard Falk, the Council's previous Special Rapporteur on the Situation of Human Rights on Palestinian Territories Occupied since 1967 , have drawn considerable criticism from many U.S. policymakers for apparent bias against Israel. More recently, some Members of Congress have expressed alarm regarding a March 2016 Council resolution that, among other things, requested OHCHR to produce a database of all business enterprises that have "directly and indirectly, enabled, facilitated and profited from the construction and growth of the (Israeli) settlements." The United States has opposed this resolution.

Some experts suggest that the Council's focus on Israel is at least partially the result of its membership composition. After the first elections, members of the Organization of Islamic Cooperation (OIC) held 17 seats on the Council, accounting for about one-third of the votes needed to call a special session (15 OIC members currently serve on the Council). Some experts contend that blocs such as the African Group and Non-Aligned Movement (NAM), who may at times account for the majority of Council seats, tend to view economic and security issues as more important than human rights violations.

Appendix A. Special Sessions of the Human Rights Council


Data Flows, Online Privacy, and Trade Policy

Summary: "Cross-border data flows" refers to the movement or transfer of information between computer servers across national borders. Such data flows enable people to transmit information for online communication, track global supply chains, share research, provide cross-border services, and support technological innovation.

Summary: Ensuring open cross-border data flows has been an objective of Congress in recent trade agreements and in broader U.S. international trade policy. The free flow of personal data, however, has raised security and privacy concerns. U.S. trade policy has traditionally sought to balance the need for cross-border data flows, which often include personal data, with online privacy and security. Some stakeholders, including some Members of Congress, believe that U.S. policy should better protect personal data privacy and security, and have introduced legislation to set a national policy. Other policymakers and analysts are concerned about increasing foreign barriers to U.S. digital trade, including data flows.

Summary: Recent incidents of private information being shared or exposed have heightened public awareness of the risks posed to personal data stored online. Consumers' personal online data is valued by organizations for a variety of reasons, such as analyzing marketing information and easing the efficiency of transactions. Concerns are likely to grow as the amount of online data organizations collect and the level of global data flows expand. As Congress assesses policy options, it may further explore the link between cross-border data flows, online privacy, and trade policy; the trade implications of a comprehensive data privacy policy; and the U.S. role in establishing best practices and binding trade rules that seek to balance public policy priorities.

Summary: There is no globally accepted standard or definition of data privacy in the online world, and there are no comprehensive binding multilateral rules specifically about cross-border data flows and privacy. Several international organizations, including the Organisation for Economic Co-operation and Development (OECD), G-20, and Asia-Pacific Economic Cooperation (APEC) forum, have sought to develop best practice guidelines or principles related to privacy and cross-border data flows, although none are legally binding. U.S. and other recent trade agreements are establishing new enforceable trade rules and disciplines.

Summary: Countries vary in their data policies and laws; some focus on limiting access to online information by restricting the flow of data beyond a country's borders, aiming to protect domestic interests (e.g., constituents' privacy). However, these policies can also act as protectionist measures. The EU and China, two top U.S. trading partners, have established prescriptive rules on cross-border data flows and personal data from different perspectives. The EU General Data Protection Regulation (GDPR) is driven by privacy concerns; China is focused on security. Their policies affect U.S. firms seeking to do business in those regions, as well as in other markets that emulate the EU and Chinese approaches. Unlike the EU or China, the United States does not broadly restrict cross-border data flows and has traditionally regulated privacy at a sectoral level to cover data, such as health records.

Summary: U.S. trade policy has sought to balance the goals of consumer privacy, security, and open commerce. The proposed United States-Mexico-Canada Agreement (USMCA) represents the Trump Administration's first attempt to include negotiated trade rules and disciplines on privacy, cross-border data flows, and security in a trade agreement. While the United States and other countries work to define their respective national privacy strategies, many stakeholders seek a more global approach that would allow interoperability between differing national regimes to facilitate and remove discriminatory trade barriers to cross-border data flows; this could offer an opportunity for the United States to lead the global conversation.

Summary: Although Congress has examined issues surrounding online privacy and has considered multiple bills, there is not yet consensus on a comprehensive U.S. online data privacy policy. Congress may weigh in as the Administration seeks to define U.S. policy on data privacy and engages in international negotiations on cross-border data flows.

Cross-border data flows underlie today's globally connected world and are essential to conducting international trade and commerce. Data flows enable companies to transmit information for online communication, track global supply chains, share research, and provide cross-border services. One study estimates that digital commerce relying on data flows drives 22% of global economic output, and that global GDP will increase by another $2 trillion by 2020 due to advances in emerging technologies. However, while cross-border data flows increase productivity and enable innovation, they also raise concerns around the security and privacy of the information being transmitted.

Cross-border data flows are central to trade and trade negotiations as organizations rely on the transmission of information to use cloud services, and to send nonpersonal corporate data as well as personal data to partners, subsidiaries, and customers. U.S. policymakers are considering various policy options to address online privacy, some of which could affect cross-border data flows. For example, new consumer rights to control their personal data may impact how companies can use such data. To enable international data flows and trade, the United States has aimed to eliminate trade barriers and establish enforceable international rules and best practices that allow policymakers to achieve public policy objectives, including promoting online security and privacy.

Building consensus for international rules and norms on data flows and privacy has become increasingly important as recent incidents have heightened the public's awareness of the risk of personal data stored online. For example, the 2018 Cambridge Analytica scandal drew attention because the firm reportedly acquired and used data on more than 87 million Facebook accounts in an effort to influence voters in the 2016 U.S. presidential election and the UK referendum on continued European Union (EU) membership ("Brexit"). In addition, security concerns have been raised about data breaches, such as those that exposed the personal data of half a million Google users or 500 million Marriot hotel customers.

Organizations value consumers' personal online data for a variety of reasons. For example, companies may seek to facilitate business transactions, analyze marketing information, detect disease patterns from medical histories, discover fraudulent payments, improve proprietary algorithms, or develop competitive innovations. Some analysts compare data to oil or gold, but unlike those valuable substances, data can be reused, analyzed, shared, and combined with other information; it is not a scarce resource.

However, personal data is considered personal private property. Individuals often want to control who accesses their data and how it is used. Experts suggest that data may therefore be considered both a benefit and a liability that organizations hold. Data has value, but an organization takes on risk by collecting personal data; they become responsible for protecting users' privacy and not misusing the information. Data privacy concerns may become more urgent as the amount of online information organizations access and collect, and the level of global data flows, continue to expand.

Countries vary in their policies and laws on these issues. The United States has traditionally supported open data flows and has regulated privacy at a sectoral level to cover data, such as health records, rather than create a comprehensive policy. U.S. trade policy has sought to balance the goals of consumer privacy, security, and open commerce, including eliminating trade barriers and opening markets. Other countries are developing data privacy policies that affect international trade as some governments or groups seek to limit data flows outside of an organization or across national borders for a number of reasons. Blocking international data flows may impede the ability of a firm to do business or of an individual to conduct a transaction, creating a form of trade protectionism. Research demonstrates not only the economic gains from digital trade and international data flows, but also the real economic costs of restrictions on such flows.

For many policymakers, the crux of the issue is: How can governments protect individual privacy in the least trade-restrictive way possible? The question is similar to concerns raised about ensuring cybersecurity while allowing the free flow of data. In recent years, Congress has examined multiple issues related to cross-border data flows and online privacy.

In the 115 th Congress, congressional committees held hearings on these topics, introduced multiple bills, and conducted oversight over federal laws on related issues such as data breach notification. Members are introducing new bills and holding hearings in the 116 th Congress. Congress may consider the proposed U.S.-Mexico-Canada Agreement (USMCA) and examine the digital trade chapter as an example of how to address the issues through trade agreements.

In most circumstances, a consumer expects both privacy and security when conducting an online transaction. However, users' expectations and values may vary and there is no globally accepted standard or definition of data privacy in the online world. In addressing online privacy, Congress may need to define personal data and differentiate between sensitive and nonsensitive personal data. In general, data privacy can be defined by an individual's ability to prevent access to personally identifiable information (PII).

According to the U.S. Office of Management and Budget (OMB) guidance to federal agencies, PII refers to

information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.

Since electronic data can be readily shared and combined, some data not traditionally considered PII may have become more sensitive. For example, the OMB definition does not specifically mention data on location tracking, purchase history, o r preferences, but these digital data points can be tracked by a device such as a mobile phone or laptop that an individual carries or logs into. The EU definition of PII attempts to capture the breadth of data available in the online world:

"personal data" means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Policymakers may consider differentiating between sensitive and nonsensitive personal data. For example, sensitive personal data could include ethnic origin, political or religious affiliation, biometric data, health data, sexual orientation, precise geolocation data, etc.

Cross-Border Data Flows and Online Privacy

"Cross-border data flows" refers to the movement or transfer of information between computer servers across national borders. Cross-border data flows are part of, and integral to, digital trade and facilitate the movement of goods, services, people, and finance. A 2017 analysis estimated that global flows of goods, services, finance, and people increased world gross domestic product (GDP) by at least 10% in the past decade, adding $8 trillion between 2005 and 2015. Effective and sustainable digital trade relies on data flows that permit commerce and communication but that also ensure privacy and security, protect intellectual property, and build trust and confidence. Impeding cross-border data flows, including through some privacy regulations, may decrease efficiency and reduce other benefits of digital trade, resulting in the fracturing, or so-called balkanization, of the internet.

In addressing online privacy, some policymakers focus on limiting access to online information by restricting the flow of data beyond a country's borders. Such limits may also act as protectionist measures. Online privacy policies may create barriers to digital trade, or damage trust in the underlying digital economy. For example, measures to limit cross-border data flows could

block companies from using cloud computing to aggregate and analyze global data, or from gaining economies of scale, constrain e-commerce by limiting international online payments, hinder global supply chains seeking to use blockchain to track products or manage supply chains, customs documentation, or electronic payments, impede the trading of crypto-currency, or limit the use of advanced technology like artificial intelligence.

According to the World Trade Organization (WTO), one of the most significant overall impacts of the growth of digital technologies is in transforming international trade. Technology can lower the costs of trade, change the types of goods and services that are traded, and may even change the factors defining a country's comparative advantage. The extent of the impact of digital technologies on trade, however, depends in large part on open cross-border data flows.

One study of U.S. companies found that data localization rules (i.e., requiring organizations to store data on local servers) were the most-cited digital trade barrier. Some governments advocate privacy or security policies that require data localization and limit cross-border data flows. However, many industry stakeholders argue that blocking cross-border data flows and storing data domestically does not make such data more secure or private.

Many experts argue that policymakers should limit cross-border data flows in the least trade-restrictive manner possible and also ensure security and privacy. These objectives are not easily reconciled. Moreover, although an overlap exists between data protection and privacy, the two are not equivalent.

Cybersecurity measures are essential to protect data (e.g., against intrusions or theft by hackers). However, they may not be sufficient to protect privacy. For example, if an organization shares user data with a third party, it may be doing so securely, but not in a way that protects users' privacy or aligns with consumer expectations. Similarly, breach notification requirements are not the same as proactive privacy protection measures. At the same time, policies that protect a consumer's privacy can align with security policies. Laws can limit law enforcement's access to information except in certain circumstances. Keeping user information anonymous may enable firms to analyze data while protecting individuals' identities.

Some see an inherent conflict between online security, privacy, and trade; others believe that policies protecting all three can be coherent and consistent. The U.S. government has traditionally sought to balance these objectives. Some stakeholders note, however, that current U.S. policy has been inadequate in protecting online privacy and that change is needed. In some cases in the past, Congress has acted to address privacy concerns in particular sectors; for example, the Health Insurance Portability and Accountability Act (HIPAA) of 1996 led to health privacy standards regulations. The Trump Administration has begun an effort to devise an overarching data privacy policy (see " Defining the U.S. Approach ") and many Members of Congress are also considering possible approaches.

There are no comprehensive multilateral rules specifically about privacy or cross-border data flows. However, the United States and other countries have begun to address these issues in negotiating new and updated trade agreements, and through international economic forums and organizations such as the Asia-Pacific Economic Cooperation (APEC) forum and the Organisation for Economic Co-operation and Development (OECD).

WTO General Agreement on Trade in Services

The World Trade Organization (WTO) General Agreement on Trade in Services (GATS) entered into force in January 1995, predating the current reach of the internet and the explosive growth of global data flows. Many digital products and services that did not exist when the agreements were negotiated are not covered. On the other hand, privacy is explicitly addressed within GATS as an exception to allow countries to take measures that do not conform with the agreement in order to protect "the privacy of individuals in relation to the processing and dissemination of personal data and the protection of confidentiality of individual records and accounts," as long as those measures are not arbitrary or a disguised trade restriction.

Efforts to update the multilateral agreement and discussions for new digital trade rules under the WTO Electronic Commerce Work Program stalled in 2017. Given the lack of progress on multilateral rules, some have suggested that the WTO should identify best practices or guidelines for digital trade rules that could lay the foundation for a future multilateral WTO agreement.

In December 2017, a group of more than 70 WTO members, including the United States, agreed to "initiate exploratory work together toward future WTO negotiations on trade-related aspects of electronic commerce." Overall U.S. objectives include allowing the free flow of information for international trade and cross-border data flows, "subject to reasonable safeguards like the protection of consumer data when it is exported," but do not specifically address privacy.

The group formally launched the e-commerce initiative in January 2019. The official joint statement lists the United States and EU as participants, and also several developing countries such as China and Brazil. India stated it will not join, preferring to maintain its flexibility to favor domestic firms, limit foreign market access, and raise revenue in the future.

The statement did not define the scope of any potential agreement. After the meeting, the EU noted data localization measures among the potential new rules to be discussed when negotiations officially launch in March 2019. The U.S. Trade Representative's (USTR's) statement emphasized the need for a high-standard agreement that includes enforceable obligations. Although some experts note that harmonization or mutual recognition is unlikely given divergent legal systems, privacy regimes, and norms of the parties, a common system of rules to allow for cross-border data flows while ensuring privacy protection is reportedly under discussion.

International Guidelines and Best Practices

Personal privacy has received increasing focus with the growth of digital trade encouraging global cooperation. The United States has contributed to developing international guidelines or principles related to privacy and cross-border data flows, although none are legally binding.

The OECD 1980 Privacy Guidelines established the first international set of privacy principles emphasizing data protection as a condition for the free flow of personal data across borders. These OECD guidelines were intended to assist countries with drawing up national data privacy policies.

The guidelines were updated in 2013, focusing on national level implementation based on a risk management approach and improving interoperability between national privacy strategies. The updated guidelines identify specific principles for countries to take into account in establishing national policies. The guidelines are to be reviewed and updated again in 2019.

Building on the OECD principles and prior G-20 work, the 2018 G-20 Digital Economy Ministerial Declaration identified principles to "facilitate an inclusive and whole-of-government approach to the use of information and communication technology (ICT) and assist governments in reshaping their capacities and strategies, while respecting the applicable frameworks of different countries, including with regards to privacy and data protection."

Japan is to host the 2019 G-20 and plans to focus on data governance, offering a forum to address potential global standards on privacy and cross-border data flows.

APEC is a regional forum for economic cooperation whose initiatives on privacy and cross-border data flows have influenced members' domestic policies. APEC's 21 members, including the United States, agreed to the 2005 APEC Privacy Framework , based on the OECD guidelines. The framework identifies a set of principles and implementation guidelines to provide members with a flexible approach to regulate privacy at a national level. Once the OECD publishes updated guidelines in 2019, APEC members may revise the framework and principles to reflect the updated guidelines.

The APEC Cross-Border Privacy Rules (CBPR), endorsed by APEC Leaders in 2011, is a privacy code of conduct, based on the framework. The CBPR system establishes a set of principles for governments and businesses to follow to protect personal data and allow for cross-border data flows between CBPR members. They aim to balance information privacy with business needs and commercial interests, and facilitate digital trade to spur economic growth in the region.

Rather than creating a new set of international regulations, the APEC framework and CBPR system identify best practices that each APEC member can tailor to its domestic legal system and allow for interoperability between countries. The scope and implementation mechanisms under CBPR can vary according to each member country's laws and regulations, providing flexibility for governments to design national privacy approaches. To become a member of the CBPR, a government must

1. Be a member of APEC; 2. Establish a regulator with authority to sign the Cross-Border Privacy Enforcement Arrangement (CPEA); 3. Map national laws to the published APEC guidelines, which set baseline standards; and 4. Establish an accountability agent empowered to audit and review a company's practices, and enforce privacy rules and laws.

If a government joins the CBPR system, every domestic organization is not required to also join; however, becoming a member of CBPR may benefit an organization engaged in international trade by indicating to customers and partners that the organization values and protects data privacy. With certified enrollment in CBPR, organizations can transfer personal information between participating economies (e.g., Mexico to Singapore) and be assured of compliance with the legal regimes in both places. To become a CBPR member, an individual organization must develop and implement data privacy policies consistent with the APEC Privacy Framework and complete a questionnaire. The third party accountability agent is responsible for assessing an organization's application, ongoing monitoring of compliance, investigating any complaints, and taking enforcement actions as necessary. Domestic enforcement authorities in each member country serve as a backstop for dispute resolution if an accountability agent cannot resolve a particular issue. All CBPR member governments must join the CPEA to ensure cooperation and collaboration between the designated national enforcement authorities.

In the United States, the Federal Trade Commission (FTC) is the regulator and enforcement authority. TrustArc is the only accountability agent, but many expect the U.S. Department of Commerce to recognize additional agents soon. As of this writing, TrustArc lists about 20 U.S. firms that are APEC CBPR certified.

The CBPR grows in significance as the number of participating economies and organizations increases. The U.S. ambassador to APEC aims to have "as many APEC economies as possible as soon as possible to join the system." Currently, the United States, Japan, Mexico, Canada, South Korea, Singapore, Taiwan, and Australia are CBPR members; the Philippines is in the process of joining. Russia, on the other hand, stated it has no plans to join. Although APEC initiatives are regionally focused, they can provide a basis to scale up to larger global efforts because they reflect economies at different stages of development and include industry participation. Due to its voluntary nature, APEC has served as a testbed for identifying best practices, standards, and principles and for creating frameworks that can lead to binding commitments in plurilateral or larger multilateral agreements (see " Data Flows and Privacy in U.S. Trade Agreements ").

Expanding CBPR beyond APEC could represent the next step toward consistent international rules and disciplines on data flows and privacy.

Countries vary in their privacy policies and laws, reflecting differing priorities, cultures, and legal structures. According to one index, China is the most restrictive digital trade country among 64 countries surveyed, followed by Russia, India, Indonesia, and Vietnam (see Figure 1 ). The United States ranks 22 in the index, less restrictive than Brazil or France but more restrictive than Canada or Australia. The relatively high U.S. score largely reflects financial sector restrictions.

The "restrictions on data" category covers data policies such as privacy and security measures; this category is included in the composite index. Looking specifically at the 64 countries' data policies, Russia is the most restrictive country, followed by Turkey and China. Russia's policies include data localization, retention, and transfer requirements, among others. Turkey's comprehensive Data Protection Law also establishes requirements in these areas. In contrast, the United States ranks 50 for data policy restrictions.

Two of the top U.S. trading partners (the EU and China) have established their data policies from different perspectives. The EU's policies are driven by privacy concerns; China's policies are based on security justifications. Both are setting examples that other countries, especially those with (or seeking) closer trading ties to China or the EU, are emulating; thus, these policies have affected U.S. firms seeking to do business in those other countries as well.

The EU considers the privacy of communications and the protection of personal data to be fundamental human rights, which are codified in EU law. Differences between the United States and EU in their approaches to data protection and data privacy laws have long been sticking points in U.S.-EU economic and security relations. The EU and United States negotiated the U.S.-EU Privacy Shield to allow for the transatlantic transfer of personal data by certified organizations. The bilateral agreement established a voluntary program with commitments and obligations for companies, limitations on law enforcement access, and transparency requirements. U.S. companies that participate in the program must still comply with all of the obligations under EU law (see below) if they process personal data of EU persons. The Privacy Shield is overseen and enforced by EU federal and U.S. agencies, including the Department of Commerce and the FTC, and is reviewed by both parties annually.

The EU's General Data Protection Regulation (GDPR), effective May 2018, establishes rules for EU members, with extraterritorial implications. The GDPR is a comprehensive privacy regime that builds on previous EU data protection rules. It grants new rights to individuals to control personal data and creates specific new data protection requirements.

The GDPR applies to (1) all businesses and organizations with an EU establishment that process (i.e., perform operations on) personal data of individuals in the EU, regardless of where the actual processing of the data takes place; and (2) entities outside the EU that offer goods or services (for payment or for free) to individuals in the EU or monitor the behavior of individuals in the EU. While the GDPR is directly applicable at the EU member state level, individual countries are responsible for establishing some national-level rules and policies as well as enforcement authorities, and some are still in the process of doing so. As a result, some U.S. stakeholders have voiced concerns about a lack of clarity and inadequate country compliance guidelines.

Many U.S. firms doing business in the EU have made and are making changes to comply with the GDPR, such as revising and clarifying user terms of agreement and asking for explicit consent. For some U.S. companies, it may be easier and cheaper to apply GDPR protections to all users worldwide rather than to maintain different policies for different users. Large firms may have the resources to hire consultants and lawyers to guide implementation and compliance; it may be harder and costlier for small and mid-sized enterprises to comply, possibly deterring them from entering the EU market and creating a de facto trade barrier.

Since the GDPR went into effect on May 25, 2018, some U.S. businesses, including some newspaper websites and digital advertising firms, have opted to exit the EU market given the complexities of complying with the GDPR and the threat of potential enforcement actions. European Data Protection Authorities (DPAs) have received a range of GDPR complaints and initiated several GDPR enforcement actions in the fall of 2018. In January 2019, the French DPA issued the largest penalty to date for a data privacy breach. The agency imposed a €50 million (approximately $57 million) fine on Google for the "lack of transparency" regarding how the search engine processes user data. Analysts contend that the high fine may set a benchmark and signal for future enforcement, raising concerns among some firms doing business in the EU.

Under the GDPR, a few options exist to transfer personal data in or out of the EU and ensure that privacy is maintained.

1. An organization may use specific Binding Corporate Rules (BCRs) or Model Contracts approved by the EU; 2. An organization may comply with domestic privacy regimes of a country that has obtained a mutual adequacy decision from the EU, which means that the EU has deemed that a country's laws and regulations provide an adequate level of data protection; currently, fewer than 15 jurisdictions are deemed adequate by the EU; or 3. A U.S.-based organization may enroll in the bilateral U.S.-EU Privacy Shield program for transatlantic transfer of personal data.

The GDPR legal text seems to envision a fourth way, such as a certification scheme to transfer data, that the EU has yet to elaborate. A certification option(s) could create a less burdensome means of compliance for U.S. and other non-EU organizations to transfer personal data to or from the EU in the future. This could be an opportunity for the United States to work with the EU on creating a common system, perhaps even setting a global standard.

Some experts contend that the GDPR may effectively set new global data privacy standards, since many companies and organizations are striving for GDPR compliance to avoid being shut out of the EU market, fined, or otherwise penalized, or in case other countries introduce rules that imitate the GDPR.

The EU is actively promoting the GDPR and some countries, such as Argentina, are imitating all or parts of the GDPR in their own privacy regulatory and legislative efforts or as part of broader trade negotiations with the EU. In general, the EU does not include cross-border data flows or privacy in free trade agreements. However, alongside trade negotiations with Japan, the EU and Japan agreed to recognize each other's data protection systems as "equivalent," allowing for the free flow of data between the EU and Japan and serving as a first step in adopting an adequacy decision. Under the agreement, Japan committed to implementing additional measures to address the handling of the personal data of EU persons on top of Japan's own privacy regime.

China's trade and internet policies reflect state direction and industrial policy, limiting the free flow of information and individual privacy. For example, the requirement for all internet traffic to pass through a national firewall can impede the cross-border transmission of data. China's 2015 counterterrorism law requires telecommunications operators and internet service providers to provide assistance to the government, which could include sharing individuals' data. Citing national security concerns, China's Internet Sovereignty policies, Cybersecurity Law, and Personal Information Security Specification impose strict requirements on companies, such as storing data domestically; limiting the ability to access, use, or transfer data internationally; and mandating security assessments that provide Chinese authorities access to proprietary information.

In 2014, China announced a new social credit system, a centralized big-data-enabled system for monitoring and shaping businesses' and citizens' behavior that serves as a self-enforcing regulatory mechanism. According to the government, China aims to make individuals more "sincere" and "trustworthy," while obtaining reliable data on the creditworthiness of businesses and individuals. An individual's score would determine the level of government services and opportunities he or she could receive.

China seeks to have all its citizens subject to the social credit system by 2020, forcing some U.S. businesses who do business in China, such as airlines, to participate. As of 2018, multiple government agencies and financial institutions contribute data to the platform. Pilot projects are underway in some provinces to apply various rewards and punishments in response to data collected. The lack of control an individual may have and the exposure of what some consider private data is controversial among observers in and out of China.

Some countries, such as Vietnam, are following China's approach in creating cybersecurity policies that limit data flows and require local data storage and possible access by government authorities. Some U.S. firms and other multinational companies are considering exiting the Vietnamese market rather than complying, while some analysts suggest that Vietnam's law may not be in compliance with its recent commitments in trade agreements (see below). India has also cited security as the rationale for its draft Personal Data Protection Bill, which would establish broad data localization requirements and limit cross-border transfer of some data. Unlike the EU, these countries do not specify mechanisms to allow for cross-border data flows. U.S. officials have raised concerns with both Vietnam's and India's localization requirements.

The EU's emphasis on privacy protection and China's focus on national security (and the countries that emulate their policies) have led these countries to create data-focused policies that restrict international trade and commerce. The United States has traditionally sought a balanced approach between trade, privacy, and security.

U.S. data flow policy priorities are articulated in USTR's Digital 2 Dozen report, first developed under the Obama Administration, and the White House's 2017 National Security Strategy. Both Administrations emphasize the need for protection of privacy, the free flow of data across borders, and an interoperable internet. These documents establish the U.S. position that the free flow of data is not inconsistent with privacy protection. Recent free trade agreements translate the U.S. position into binding international commitments.

The United States has taken a data-specific approach to regulating data privacy, with laws protecting specific information, such as healthcare or financial data. The FTC enforces consumer protection laws and requires that consumers be notified of and consent to how their data will be used, but the FTC does not have the mandate or resources to enforce broad online privacy protections. There is growing interest among some Members of Congress and in the Administration for a more holistic U.S. data privacy policy.

Data Flows and Privacy in U.S. Trade Agreements

The United States has played an important role in international discussions on privacy and data flows, such as in the OECD, G-20, and APEC, and has included provisions on these subjects in recent free trade agreements.

Congress noted the importance of digital trade and the internet as a trading platform in setting the current U.S. trade negotiating objectives in the June 2015 Trade Promotion Authority (TPA) legislation ( P.L. 114-26 ). TPA includes a specific principal U.S. trade negotiating objective on "digital trade in goods and services and cross-border data flows." According to TPA, a trade agreement should ensure that governments "refrain from implementing trade-related measures that impede digital trade in goods and services, restrict cross-border data flows, or require local storage or processing of data." However, TPA also recognizes that sometimes measures are necessary to achieve legitimate policy objectives and aims for such regulations to be the least trade restrictive, nondiscriminatory, and transparent.

Comprehensive and Progressive Agreement for Trans‐Pacific Partnership (CPTPP /TPP-11 ) . The CPTPP is a recently concluded trade agreement among 11 Asia-Pacific countries. The CPTPP is based on the proposed Trans-Pacific Partnership (TPP) agreement negotiated by the Obama Administration and from which President Trump withdrew the United States in January 2017. The electronic commerce chapter in TPP, left unchanged in CPTPP, contains the strongest binding trade agreement commitments on digital trade in force globally.

CPTPP includes provisions on cross-border data flows and personal information protection. The text specifically states that the parties "shall allow the cross-border transfer of information." The agreement allows restrictive measures for legitimate public policy purposes if they are not discriminatory or disguised trade barriers. The agreement also prohibits localization requirements for computing facilities, with similar exceptions.

On privacy, the CPTPP requires parties to have a legal framework in place to protect personal information and to have consumer protection laws that cover online commerce. It encourages interoperability between data privacy regimes and encourages cooperation between consumer protection authorities.

United States-Mexico-Canada Agreement (USMCA). The released text for the proposed USMCA aims to revise and update the trilateral North American Free Trade Agreement (NAFTA), and illustrates the Trump Administration's approach.

The USMCA chapter 19 on digital trade includes articles on consumer protection, personal information protection, cross-border transfer of information by electronic means, and cybersecurity, among other topics. Building on the TPP, the agreement seeks to balance the legitimate objectives by requiring parties to

have a legal framework to protect personal information, have consumer protection laws for online commercial activities, and not prohibit or restrict cross-border transfer of information.

While the agreement does not prescribe specific rules or measures that a party must take to protect privacy, it goes further than the TPP (or CPTPP) provisions and provides guidance to inform a country's privacy regime. In particular, the USMCA explicitly refers to the APEC Privacy Framework and OECD Guidelines as relevant and identifies key principles.

In general, the proposed USMCA requires that parties not restrict cross-border data flows. Governments are allowed to do so to achieve a legitimate public policy objective (e.g., privacy, national security), provided the measure is not arbitrary, discriminatory, a disguised trade barrier, or greater than necessary to achieve the particular objective. In this way, the parties seek to balance the free flow of data for commerce and communication with protecting privacy and security. The agreement specifically states that the parties may take different legal approaches to protect personal data and also recognizes APEC CBPR as a "valid mechanism to facilitate cross-border information transfer while protecting personal information."

The agreement aims to increase cooperation between the United States, Mexico, and Canada on a number of digital trade issues, including exchanging information on personal information protection and enforcement experiences; strengthening collaboration on cybersecurity issues; and promoting the APEC CBPR and global interoperability of national privacy regimes. The governments also commit to encourage private-sector self-regulation models and promote cooperation to enforce privacy laws. While the agreement is only between three parties, the provisions are written broadly to encompass global efforts. Some stakeholders look at USMCA as the basis for potential future trade agreements (such as with the UK). Cross-border data flows will likely be a key issue in future U.S.-EU trade negotiations.

U.S. Federal Data Privacy Policy Efforts

The United States has articulated a clear position on data privacy in trade agreements; however, there is no single U.S. data privacy policy. Nevertheless, the Trump Administration is seeking to define an overarching U.S. policy on data privacy. The Trump Administration's ongoing three-track process is being managed by the Department of Commerce (Commerce) in consultation with the White House. Different bureaus in Commerce are tasked with different aspects of the process, as follows.

1. The National Institutes of Standards and Technology (NIST) is developing a privacy framework. Similar to its cybersecurity framework, NIST aims to create a voluntary framework as a tool for organizations to adopt to identify, assess, manage, and communicate about privacy risks. By classifying specific privacy outcomes and potential approaches, the framework is intended to enable organizations to create and adapt privacy strategies, innovate, and manage privacy risks within diverse environments. As part of its transparent approach, NIST is currently consulting with public- and private-sector stakeholders through various forms of outreach to collect feedback and aims to have a draft framework before the end of 2019. 2. The National Telecommunications and Information Administration (NTIA) is developing a set of privacy principles to guide a domestic legal and policy approach. The NITA sought public comment on a proposed set of "user-centric privacy outcomes" and a set of high-level goals. 3. The International Trade Administration (ITA) engages with foreign governments and international organizations such as APEC. ITA is focusing on the international interoperability aspects of potential U.S. privacy policy. ITA's role is to ensure that the NIST and NTIA approaches are consistent with U.S. international policy objectives, including TPA, and principles, such as the OECD framework and APEC CBPRs.

Like the EU and China, Commerce is seeking input through a public- and private-sector consultation process. However, unlike the EU or China, Commerce is expecting to create a voluntary privacy framework. Some observers question whether the Commerce approach is sufficient to result in strong privacy protections if it is not backed up by congressional action and federal legislation.

Some suggest that Congress could lead a whole-of-government approach through new federal legislation. In the 115 th Congress, then-House Committee on Energy and Commerce Ranking Member Frank Pallone, Jr. requested that the Government Accountability Office (GAO) examine issues related to federal oversight of internet privacy. The January 2019 GAO report concluded that now is "an appropriate time for Congress to consider comprehensive Internet privacy." GAO stated that "Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment. Issues that should be considered include what authorities agencies should have in order to oversee Internet privacy, including appropriate rulemaking authority."

Recognizing the importance of protecting open data flows amid growing concerns about online privacy, some stakeholders seek to influence U.S. policies on these issues. In addition to submitting comments in response to NTIA and NIST requests and participating in their forums, multiple organizations issued their own sets of principles or guidelines, some referencing the EU GDPR. The U.S. Chamber of Commerce has also published model privacy legislation for Congress to consider.

Though they vary in emphasis, these proposals share common themes:

transparency on what data is being collected and how it is being used; user control, including the ability to opt out of sharing at least some information and to access and correct personal data collected; data security measures, like data breach notification requirements; and enforcement by the FTC; FTC commissioners also voiced support for the agency as the appropriate federal enforcer for consumer privacy.

But these groups also differ in some areas, such as whether, or to what extent, to include certain aspects included in the GDPR, such as the right to deletion (so-called "right to be forgotten"), requirements for data minimization, or extraterritorial reach. There is not consensus on whether the FTC should be given rule-making authority or additional resources, the enforcement role of states, or if an independent data protection commission is needed similar to EU DPAs.

Consistent with U.S. trade policy, industry groups generally point out the need to be flexible, encourage private-sector innovation, establish sector- and technology-neutral rules, create international interoperability between privacy regimes, and facilitate cross-border data flows. Private-sector stakeholders generally want to avoid what they regard as overregulation or high compliance burdens. These groups emphasize risk management and a harm-based approach, which they state keeps an organization's costs proportional to the consumer harm prevented.

On the other hand, some consumer advocates point to a need for baseline obligations to protect against discrimination, disinformation, or other harm. In general, consumer advocates believe that any comprehensive federal privacy policy should complement, and not supplant, sector-specific privacy legislation or state-level legislation.

Finding a global consensus on how to balance open data flows and privacy protection may be key to maintaining trust in the digital environment and advancing international trade. One study found that over 120 countries have laws related to personal data protection. Divergent national privacy approaches raise the costs of doing business and make it harder for governments to collaborate and share data, whether for scientific research, defense, or law enforcement.

A system for global interoperability in a least trade-restrictive and nondiscriminatory way between different national systems could help minimize costs and allow entities in different jurisdictions with varying online privacy regimes to share data via cross-border data flows. Such a system could help avoid fragmentation of the internet between European, Chinese, and American spheres, a danger that some analysts have warned against. For example, Figure 2 suggests the potential of an interoperability system that allows data to flow freely between GDPR- and CBPR-certified economies.

The OECD guidelines, G-20 principles, APEC CBPR, CPTPP, and USMCA provisions demonstrate an evolving understanding on how to balance cross-border data flows, security, and privacy, to create interoperable policies that can be tailored by countries and avoid fragmentation or the potential exclusion of other countries or regulatory systems. The various trade agreements and initiatives with differing sets of parties may ultimately pave the way for a broader multilateral understanding and eventually lead to more enforceable binding commitments founded on the key WTO principles of nondiscrimination, least trade restrictiveness, and transparency.

Future U.S. Trade Negotiations and Agreements

Congress may consider the trade-related aspects of data flows in trade agreements, including through close examination of these provisions during the congressional debate and consideration of legislation to implement the proposed USMCA. Issues include whether the agreements make progress in meeting TPA's related trade negotiating objectives and if the provisions strike the appropriate balance among public policy objectives. In addition, USTR's specific trade negotiating objectives for future agreements with the EU and Japan include establishing rules to protect cross-border data flows. These future trade negotiations present challenges and provide opportunities for Congress to further engage USTR on the issues and to conduct oversight.

Congress may further consider how best to achieve broader consensus on data flows and privacy at the global level. Congress could, for example, conduct additional oversight of current best practice approaches (e.g., OECD, APEC) or ongoing negotiations in the WTO on e-commerce to create rules through plurilateral or multilateral agreements. Congress may consider endorsing certain of these efforts to influence international discussions and the engagement of other countries. Congress may want to examine the potential challenges and implications of building a system of interoperability between APEC, CBPR, and the EU GDPR.

Related issues are the extent to which the EU is establishing its system as a potential de facto global approach through its trade agreements and other mechanisms, and how U.S. and other trade agreements may ultimately provide approaches that could be adopted more globally.

Congress may seek to better understand the economic impact of data flows and privacy regimes in other countries related to U.S. access to other markets and the extent to which barriers are being put in place that may discriminate against U.S. exporters. Congress may examine the lack of reciprocal treatment and limits on U.S. firms' access to some foreign markets.

Congress may consider the implications of not having a comprehensive national data privacy policy. Will the EU GDPR and China cybersecurity policies become the global norms that other countries follow in the absence of a clear U.S. alternative?

Congress may enact comprehensive privacy legislation. In considering such action, Congress could investigate and conduct oversight of the Administration's ongoing privacy efforts, including requesting briefings and updates on the NTIA, NIST, and ITA initiatives to provide congressional feedback and direction and ensure they are aligned with U.S. trade objectives. Congress may also seek input from other federal agencies.

In deliberating a comprehensive U.S. policy on personal data privacy, Congress may review the GAO report's findings and conclusions. Congress may also weigh several factors, including:

How can U.S. trade and domestic policy achieve the appropriate balance to encourage cross-border commerce, economic growth, and innovation, while safeguarding individual privacy and national security? How would a new privacy regime affect U.S. consumers and businesses, including large multinationals who must comply with different national privacy regimes and small- and medium-sized enterprises with limited resources and technology expertise? Do U.S. agencies have the needed tools to accurately assess the size and scope of cross-border data flows to help analyze the economic impact of different privacy policies, or measure the costs of trade barriers? How should an evolving U.S. privacy regime align with U.S. trade policy objectives and evolving international standards, such as the OECD Guidelines for privacy and cybersecurity, and should U.S. policymakers prioritize interoperability with other international privacy frameworks to avoid further fragmentation of global markets and so-called balkanization of the internet?

In addition, there are a host of other policy considerations not directly related to trade.