The WTO law consistency of the data localisation requirements in section 72 of POPIA

Abstract

South Africa's Protection of Personal Information Act ('POPI'), officially promulgated on 1 July 2020, was enacted to legislatively ameliorate South Africans' constitutional rights to not have their privacy infringed. POPI generally establishes a mechanism to ensure that persons have a say in the collection, processing and storage of their personal information. This is done through a regulatory mechanism which prescribes the limits and compliance requirements for the aforementioned activities. As part of its suite of protections, POPI in section 72 thereof, prescribes limits and conditions for the cross-border transfer of personal information collected in South Africa. Section 72 of POPI is a conditional data localisation provision because it prescribes the circumstances under which personal information collected in South Africa may be transferred extraterritorially. On the assumption that unhindered flow of data is required for the enablement of digital trade, I ascertain whether section 72 of POPI is consistent with the laws of the World Trade Organisation. In particular, I ascertain whether section 72 of POPI is consistent with the relevant provisions in the General Agreement on Trade in Services ('GATS'). To the extent that section 72 of POPI is inconsistent with the relevant provisions in GATS, I conclude that section 72 of POPI is justified pursuant to the exceptions in GATS.