디지털 교역 시대의 아날로그 규범 - ‘개인정보’의 국경간 이전과 국가안보 예외

Digital trade has become one of the important subjects for many countries in exploring new trade norms. The current COVID-19 pandemic has further underscored the importance of future digital trade. What lies at the core of the digital trade is the utilization and protection of “personal information”. New trade agreements such as CPTPP and USMCA have adopted chapters setting forth detailed provisions on digital trade and personal information. Among various provisions, the most important and controversial ones relating to personal information are (i) cross-border free flow of data and (ii) prohibition of requiring location of computing facilities in the territory of the regulating country as a condition for the permission of business in the territory. At the same time, these provisions also include exceptions for measures in pursuit of Legitimate Public Policy Objectives(“LPPO”). The specific scope and contours of the LPPO exceptions are not entirely clear. In particular, their relationship with other existing exceptions in trade agreements such as general exceptions and security exceptions are far from clear. Such confusion arguably stems from the fact that digital trade norms are being incorporated without reference to the systemic implication for the entirety of trade agreements. Ensuring the overall compatibility of the digital trade norms with the conventional trade agreements has become an issue of the utmost inportance for the successful incorporation of the new norms. In particular, LPPO exceptions' relationship and interaction with security exceptions in trade agreements draw particular attention because of its increasing relevance to the global trade landscape and the ‘information-specific clause’ in the security exceptions clauses. Given the textual structure of security exceptions and accumulating jurisprudence in this regard, it seems the case that security exceptions may and can be invoked to justify measures relating to personal information in the context of digital trade. This aspect has not been fully taken into account in the current discussion and negotiation of digital trade and personal information. Unless detailed provisions are introduced to regulate LPPO exceptions in the consideration of overlapping security exceptions in a systematic manner, the current LPPO exceptions may not work as they are designed. Also, security exceptions clauses may be invoked to nullify or circumvent the basic structure of the digital trade norms. At the same time, security exceptions clauses need to be amended to reflect new business activities of the digital economy and the unique characteristics of personal information.