Japan Should Lead Making Desirable Rules for Digital Trade toward the "Data Free Flow with Trust"(DFFT) at APEC

Overview of the Situation

First, based on the report by Nishimura & Asahi and Nomura Research Institute, Ltd., I would like to summarize the current situation regarding digital trade and related agreements (provisions).

In general, digital trade (e-commerce) refers to trade in which orders are placed and received via digital means, and trade in which services (such as music streaming) are provided digitally. In any case, the core of this economic activity is the cross-border transfer of data (information) via digital means (cross-border data transfer).

Let us take a look at the current situation of digital trade (cross-border data transfer) as corporate and industrial activity.

According to various surveys, many Japanese firms exchange data with overseas entities. The forms of such services include:

1. (1) Management and corporate integration (aggregation and management of performance and human resources (HR) data between headquarters and overseas subsidiaries)
2. (2) Commercial distribution and supply chain coordination (managing orders and logistics with overseas subsidiaries and business partners)
3. (3) Marketing and service provision (using overseas cloud services for customer analysis, advertisement distribution and payment)
4. (4) Development and data utilization (services such as development and analysis using cloud environments)
5. (5) Remote monitoring and operation of IoT devices (real-time monitoring of overseas IoT devices)

Thus, cross-border data transfer is essential for improving efficiency and creating higher value-added in corporate and industrial activities. Therefore, it is desirable to minimize restrictions and harmonize rules under global standards wherever feasible, and to maintain interoperability between systems even where differences exist.

Regulations governing digital trade exist as either those positioned as specific chapters or articles within general (free) trade agreements or standalone agreements specifically on digital trade. The former category includes FTAs and economic partnership agreements (EPAs) by various economies. In Japan’s case, many FTAs and EPAs include chapters on e-commerce. In the Japan-EU EPA, the provisions on "DFFT" entered into force in 2024 (after the EPA entered into force in 2019). Examples of the latter include the U.S. - Japan Digital Trade Agreement and the Digital Economy Partnership Agreement (DEPA) between Singapore, New Zealand, Chile, and South Korea.

One of the core provisions ensures the freedom of cross-border data transfer. However, there are often conditions that impose obligations to build and maintain domestic privacy protection systems for personal information. There are also variations in the provisions on exceptions and limitations to the freedom of cross-border data transfer.

In the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), which was agreed in 2018 and serves as a template for subsequent digital trade agreements, the following are provided for:

1. (1) Freedom of cross-border data transfer
2. (2) Prohibition of data localization requirements for computing facilities (such as servers for information processing and storage)
3. (3) Prohibition of source code disclosure requirements.
   These are the so-called “three principles of digital trade,” reflecting a strong free-trade orientation.

Author’s Impressions

Based on the above overview of the situation, I would like to share my personal takeaways and observations from the discussions at the workshop.

First, digital trade rulemaking must continue to evolve in response to the changing environment, requiring appropriate progress in global and/or regional initiatives.

A major driver of environmental change is technology and the business models that adapted to it. The introduction of AI and other technologies is expected to lead to the rapid evolution of economic activities. Amid this digital transformation of the economy, digital trade will become increasingly important and its myriad forms will continue to change, making it necessary to establish rules that appropriately respond to these changes.

Another significant and impactful environmental change is the shifting geopolitical situation. Conflicts and wars between nations are becoming more common worldwide, and each country is becoming increasingly security conscious. There is a growing tendency to restrict the freedom of cross-border data transfer from the security perspective. While the government recognizes the legitimacy of this policy, it should be aware that excessively restrictive measures could negatively affect economic development.

Looking back at the evolution of digital trade agreement provisions, e-commerce chapters in trade agreements in the 2000s were primarily designed for goods and limited services (such as music streaming) that are delivered electronically, and the non-imposition of customs duties on digital contents was the primary focus. However, since the 2010s, cloud services have become an increasingly significant part of the economic landscape, and the recent rapid spread of AI has only accelerated the growth of cloud services. As a result, there is a growing trend toward establishing rules governing server localization and the handling of source code.

Because rulemaking tends to lag behind the evolution of technologies and business models, the balance between facilitative factors (free trade oriented) and regulatory and restrictive factors (free-trade-exception-oriented) is changing over time. In addition, the different provisions across various agreements have created a “Spaghetti Bowl” phenomenon in which the entire set of rules is intricately intertwined.

Facilitative provisions are based on the principle that "cross-border data flows should be free." Regulatory and restrictive provisions reflect ideas such as "matters related to national security are legitimate exceptions to free trade principles" or "free trade may be restricted for legitimate public policy purposes (LPPOs)." Achieving an appropriate balance between these two factors is necessary.

CPTPP is a prime example of a free trade agreement. The three principles of digital trade are:

1. (1) Freedom of cross-border data transfer
2. (2) Prohibition of localization requirements for computing facilities
3. (3) Prohibition of source code disclosure requirements

The Japan-U.S. Digital Trade Agreement and the United States-Mexico-Canada Agreement (USMCA), which were concluded after CPTPP, can be viewed as further advancing this position.

Of course, circumstances differ among economies and regions, so a one size-fits-all approach is difficult in rulemaking. Nevertheless, rules must evolve in response to technological advancements and societal changes. From a business perspective, it is desirable to have a global business environment that is as interoperable as possible.

Under these circumstances, it is important to steadily and promptly develop building blocks for creating desirable rules that meet the needs of the times.

Second, among the principal actors in digital trade rulemaking, the U.S., the EU, China, and the Association of Southeast Asian Nations (ASEAN), Japan has a significant role to play as a bridge-builder, mediator and leader. In particular, given the difficulties in the discussions and negotiations on the Joint Statement Initiative on e-commerce, which was initiated by about 80 countries of the World Trade Organization (WTO) and aimed at realizing DFFT, it would likely be effective for Japan to take the lead in rulemaking within forums such as APEC.

The United States previously supported a free trade approach (the three principles of digital trade mentioned above) reflecting the interests of tech companies, but since 2023, it has shifted to a more defensive stance emphasizing consumer protection and national security. A characteristic feature of the U.S. is the wide range of policy fluctuations, partly influenced by changes in administrations.

Although the EU is outside the APEC region, Japan considers it a partner that shares the values of free trade, the rule of law and multilateralism. However, as seen in the General Data Protection Regulation (GDPR), the EU has exerted significant global influence by promoting defensive rules that treat privacy protection as fundamental human rights, and this cannot be ignored.

As a Communist Party-led country, China naturally places a strong emphasis on security (both domestic and international). Its position contrasts sharply with that of the CPTPP. In the Regional Comprehensive Economic Partnership (RCEP), security and public policy exceptions have been attached to Principles (1) and (2) of the Three Principles of Digital Trade, and those exceptions are excluded from dispute settlement. Principle (3) is absent altogether. This is believed to primarily reflect China’s position.

With the exception of Singapore, ASEAN is a grouping of developing countries, and its stance on digital free trade can be described as gradualist, in a manner that is similar to China. However, ASEAN is a critical part of the supply chain for Japanese industry, making it necessary to take its perspective into consideration. Singapore is particularly conspicuous as a strong supporter of digital trade liberalization and a leader in making it an important, like-minded partner for Japan.

Under these regional and international circumstances, Japan should take the lead in creating digital trade rules through APEC, in anticipation of future FTAAP negotiations, while maintaining awareness of its relationship with the EU and cooperating closely with ASEAN, particularly Singapore. With regard to personal data, Japan should promote the practical framework based on APEC's Cross-Border Privacy Rules (CBPR) and its successor, the Global CBPR framework.

In this respect, the USMCA is commendable in that it positions APEC as a framework for both privacy protection and cross-border data transfer.

Third, when considering cross-border data transfers, attention should be paid not only to personal data but also to non-personal data, and especially industrial data, which is particularly important from an industry perspective, and Japan should take the lead in making rules with this in mind.

Related issues were raised by industry on this point, and legal experts proposed specific provisions.

In practice, the technical and procedural treatment of personal or industrial data is often the same when companies transfer data internationally. Companies that are familiar with the handling of personal data in accordance with applicable regulations are increasingly concerned about whether the cross-border transfer of industrial data will be regulated and whether such transfers will face additional obstacles.

Industrial data is often combined with personal data. Such cases are examples where restrictions on personal data affect the cross-border transfer of industrial data. Furthermore, there may be restrictions on cross-border transfers of sensitive data, i.e., security-related data, when industrial data is related to critical infrastructure.

There are additional cases such as the EU’s Digital Product Passport (DPP) and the Battery Passport, where products cannot enter the EU market without the required disclosures (such as carbon footprint measurements). In the case of the Carbon Border Adjustment Mechanism (CBAM), tariff-equivalent costs vary depending on the disclosed carbon footprint data. In such situations, cross-border data transfer becomes critical, making it necessary to establish mechanisms that ensure reliable and efficient data transfer that does not impose excessive burdens on companies.

From the perspective of companies and industries, the cross-border transfer of industrial data should generally remain unobstructed compared to personal data. Where exceptions are permitted on national security or related grounds, the restrictions or certain requirements should be clearly defined, strictly limited and carefully regulated. Even where country- or region-specific rules differ, interoperability should be maximally secured so that companies do not bear excessive burdens in responding to requirements.

Japan in particular should focus on establishing rules that facilitate effective supply chain management and higher-value-added value chains, especially for those extending across ASEAN.

Fourth, to advance rulemaking from the above perspectives, public-private dialogues and cooperation are necessary at both the global and regional levels, and Japan should further strengthen its own domestic public-private dialogue and cooperation.

The workshop was an effective forum for such dialogue. Participants from industry included representatives from the Japan Electronics and Information Technology Industries Association (JEITA) in Japan, the Business Software Alliance (BSA), which is a global software industry organization, and the APEC Business Advisory Council (ABAC), who provided valuable input from a business perspective and attracted the interest of government officials from various economies. Domestically as well, the preparatory process involved extensive consultation among public and private sector representatives organized by the Ministry of Foreign Affairs, helping to align their views and raise awareness.

Opportunities for public-private dialogue exist not only within APEC but also through various other forums. Governments are generally receptive to private-sector opinions, and the fact is that governments simply cannot keep up with the rapidly evolving digital technologies and business models. In addition, any country or region is sensitive to the possibility that international rulemaking could weaken the international competitiveness of domestic industries.

The recent situation in the EU is particularly interesting. While the EU has pursued stronger regulation in environmental protection, safety and privacy, the second term Von der Leyen Commission, which was inaugurated at the end of 2025, has announced a number of "regulatory simplification" policies that reflect the interests of industry. Regarding the GDPR as well, the fourth Omnibus Package, published in May 2025, proposed rationalization of obligations to reduce the excessive administrative burden on industry (particularly small and medium-sized enterprises and tech companies). This is a useful example of effective public-private dialogue in the EU.

It is often said that Japan is lagging in the digital transformation of its economy. However, as interest grows in terms of the significance of physical AI, the strength of Japanese industry, which excels in tangible fields, is likely to remain a significant asset even amid this digital transformation. Furthermore, Japan’s process of catching up could serve as a global model for inclusive initiatives toward emerging and developing economies, both in terms of rulemaking and practical implementation.

As the digitalization of the economy and trade progresses, countries that fail to maintain competitiveness in these areas will see their economic standing decline. Therefore, to enhance its digital competitiveness, Japan needs to further strengthen public-private partnerships domestically. Moreover, in order to lead and contribute to global rulemaking, Japan’s public and private sectors should actively participate in opportunities to collaborate with their counterparts around the world.

Personally, this workshop was a highly educational experience. I would like to express my respect and gratitude to MOFA, Nishimura & Asahi, Nomura Research Institute, and other relevant parties for providing this opportunity.

May 22, 2026
>> Original text in Japanese