Bhavit Baxi
The Permanent Court of Arbitration ‘PCA’ in Tennant Energy vs. Canada[1] ruled that EU General Data Protection Regulations (‘GDPR’) will not come within the material scope in investor-state arbitrations under Chapter 11 of North American Trade Agreement ‘NAFTA’, a treaty to which neither the European Union nor its Member States are the parties.
Factual Background
In June 2017, the Tennant Energy LLC instituted the arbitration proceedings against Canada which were in front of Permanent Court of Arbitration. Thereby Tennant Energy under Chapter 11 of NAFTA claimed the damages from Canada amounting to $ 116 Million relating to its investment in a wind project.
Since the beginning of the proceedings the preliminary issues of Data Protection were the prime focus of the discussions.[2] It was Argued by the Claimant that EU General Data Protection Regulation 2016/679 should be taken into account and the procedures developed to comply with it, since one of the tribunal members (Arbitrator) is based in the UK.[3] Canada, on the other hand, argued that the GDPR does not generally govern the arbitration proceedings because, among other things, the claim was made under a treaty to which neither the EU nor its Member States are a party. Therefore, the arbitration is outside of the material scope of the GDPR.[4]
Procedural order
The Arbitral Tribunal on 24 June 2019 informed both the parties via email very briefly in two paragraphs stating “Arbitration under NAFTA Chapter 11, a treaty to which neither the European Union nor its Member States are party, does not, presumptively, come within the material scope of the GDPR.”
Further Tribunal also clarified that Procedural Order would not make any reference to GDPR, however this would be ‘without prejudice to the importance of ensuring a high level of data protection’.[5]
Applicability of GDPR
The fundamental objective of GDPR is to protect natural persons with regard to the processing of their personal data. It regulates and safeguards the fundamental rights and freedom of natural persons and in particular the right to have their personal data protected.
On plain reading of Article 3 of General Data Protection Regulation 2016/679 it could be concluded that the regulation is applicable to Arbitral Tribunals seated in EU and also tribunals outside EU concerning EU data subjects.
In Tennant Energy vs. Canada it was argued[6] by Canada that since the Permanent Court of Arbitration seats in the Netherlands, this grants certain immunities to PCA and it should exclude PCA from the applicability of GDPR.
Article 44, Chapter V of GDPR, expressly states that it covers the transfer of data to international organizations or third countries in order to ensure that the level of protection of natural persons is guaranteed. Moreover, a European Commission decision of ‘adequacy’ is necessary prior to the transfer of the personal data to third countries or international organizations.
Further the guidelines issued by European Data Protection Board[7] on the territorial scope of GDPR, which more explicitly clarifies that GDPR can extend to data processing that occurs outside of the EU: “The text of Article 3(1) does not restrict the application of the GDPR to the processing of personal data of individuals who are in the Union. The EDPB, therefore, considers that any personal data processing in the context of the activities of an establishment of a controller or processor in the Union would fall under the scope of the GDPR, regardless of the location or the nationality of the data subject whose personal data are being processed. This approach is supported by Recital 14 of the GDPR which states that “the protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data.” It was further submitted by the claimant[8] that one of the London-based arbitrator has confirmed in a data privacy notice that the GDPR applies to him, as he is is both a data “processor” and a data “controller”, pursuant to how the terms are defined in the GDPR. Thus, it could be prima facie concluded that by no means Canada can escape from the applicability of GDPR.
Conclusion
GDPR serves as a strongest medium to protect sensitive and privileged, personal and commercial information, in international disputes. However, the impact of GDPR in international treaty arbitrations still remains faded and it continues to be a big topic of debate in the arbitration arena. It seems that there is a great need of case law which could settle this issue.
Lastly, ICCA and the IBA have established a Joint Task Force on Data Protection in International Arbitration Proceedings. The task force is developing the guidance to facilitate arbitration professionals with regards to data protection in arbitration proceedings, which is due to be published later in the year.
The author
BLS-LLB (Hons.) Student at M.K.E.S College of Law, University of Mumbai, India.
[1] PCA Case No. 2018-54: Tennant Energy, LLC (U.S.A.) v. Government of Canada.
[2] Claimants Submission on confidentiality.
[3] Investor comments on the EU General Data Privacy Regulation; – Tennant Energy, LLC (U.S.A.) v. Government of Canada.
[4] Reply to Claimant’s Submissions.
[5] See 1.
[6] Tennant Energy LLC v. Government of Canada Response to the Claimant’s Submission on the European Union General Data Protection Regulation
[7] Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) – Version for public consultation
[8] Questions And Investor’s Response To Tribunal GDPR Questions And Data Privacy Questions June 4, 2019