BRIDGING THE DIGITAL TRADE DIVIDE
NAVIGATING CROSS-BORDER NON-TARIFF BARRIERS
1 Contents
EXECUTIVE SUMMARY 03
USC – ABAC Coordination 07 Acknowledgements 10 Approach and Methodology 12
BUILDING A DIGITAL ECONOMY 14
Overview of digital economy 15 Digital non-tariff barriers 16 Cross-border data flow barriers 19 Current initiatives for the digital economy 26 APEC’s future digital economy 28 Case for a digital ecosystem 32
TRANSFORMING INTO A DIGITAL ECOSYSTEM 34
The digital ecosystem 35 Overview of Digital Ecosystems 35 Development of Cross-border Digital Ecosystems 39 Partnering with Large Enterprises 39 Prioritize Narrowing the Multi-Stakeholder Knowledge Gaps 44 Build out the Physical Infrastructure 51
CONCLUSIONS 58
APPENDICES 59
2 Executive summary
The Digital Economy
The digital world is immensely different than it was Policymakers involved in designing frameworks to in the few years after the turn of the millennium and govern the digital economy and cross-border data continues to evolve very rapidly. The vast majority of flows have the challenging task of enabling the use of the Internet infrastructure, digital business models, Internet and encouraging digital trade and innovation and key business players such as Amazon, Google, while protecting domestic interests and the rights and and Facebook, are barely recognizable from what privacy of citizens. Given the diversity across the APEC they were in the early 2000s. Smartphones, artificial region, it is unsurprising that data flow regulations intelligence, blockchain, surveillance technologies, vary considerably between economies. These differ- the Internet of Things (“IoT”), and data science as a ences may be rooted in differences in cultures and subject were barely items of note for most businesses economic interests. Whereas some economies may and regulators a mere decade and a half ago. develop regulation from a human rights or citizen pro- Forums such as the APEC (“Asia-Pacific Economic tection lens, others see it as a method to spur e-com- Cooperation”) Business Advisory Council (“ABAC”), as merce and innovation. Other economies may take into well as many other stakeholders in the region, are well consideration items like national security, and shape aware of the vast contributions that the digital econ- their domestic laws accordingly. For the purpose of omy has already made to international trade. When our report, we refer to these regulations as non-tariff used effectively, digital trade and data can bridge measures (“NTMs”), which we define as follows: inequality gaps and enhance lives across economies. In the right environment, a wide assortment of groups NTMs are policy measures, excluding tradi- from micro, small and medium enterprises (“MSMEs”) tional tariffs, that may have an economic effect to large enterprises (“LEs”) stand to benefit from dig- on international digital trade. For example, a ital trade (APEC, 2019). For the purpose of our report, change in quantities of digital goods or ser- we define digital trade as: vices traded, prices, or a combination. NTMs Trade in goods and services which is digitally tend to be reliable and necessary, and serve an enabled and which can be delivered either important purpose in preserving the safety electronically or physically (including e-com- and integrity of individual economies. merce and trade in digital goods and services). In some cases, regulations may be discriminato- Underpinning digital trade is the movement of data. ry (e.g., discriminating against foreign services or Data not only facilitates design, development, pro- goods), or may not be based on sound science or duction and distribution of goods and services, , it is technological understanding. In these events, NTMs also an asset that can itself be traded. Data flows are can turn into non-tariff barriers (“NTBs”) – either be- determining how global value chains are organized cause the way that they are designed or implemented and services delivered. With the increasing impor- is more trade-restrictive than necessary to meet a tance of data as an asset, concerns about privacy and legitimate objective, because they are discriminatory, cybersecurity have driven policymakers to regulate or because they are in fact designed to keep imports the handling of data. Restrictions on cross-border out of a market: data flows are not new, yet they have drastically in- creased in the last decade.
3 NTBs can inhibit trade by adding costs and 2. Move to “Most Restrictive” Regulated making imports or exports more difficult. They Approach (i.e., GDPR) can be magnified along global value chains and GDPR is seen as a particularly heavy-handed ap- can inhibit participation in such value chains. proach to privacy laws. Yet, when one is compliant with GDPR, they are compliant with data regulations It is therefore important for policymakers to be able almost everywhere in the world. GDPR is effectively to differentiate between an NTB (i.e., a barrier to here to stay and might only be surpassed by a regu- broader economic benefits across the region) and an latory framework that was designed to be even more NTM (i.e., something that ought to be in place for le- restrictive. For many businesses, it may be easier to gitimate reasons such as national security or citizen’s just ‘buckle in’. individual security). Whether a binding regulated or middle-ground We learned from our field research that the key chal- approach is chosen, it is vital to avoid a future where lenge businesses face with respect to digital trade, is individual economies, or fragmented FTAs, create trying to adapt their business models to the different their own standalone frameworks. As such, education regulatory frameworks used in various economies. In for policymakers will be needed to design a pragmatic response to concerns about inconsistent regulations, framework, and businesses will need to understand several initiatives have attempted to harmonize differ- the incentives of adopting the new approach. It is also ent frameworks and enhance cross-border data flow. imperative that this interoperable system is kept up- To date however, there is no comprehensive multi- to-date with technological advances. laterally adopted set of rules to govern cross-border data flows. In creating a high-functioning APEC-wide digital economy, it is clear that having a consistent and As such, we determined to identify ways to overcome standardized framework is an important foundation. this “noodle bowl” of differing approaches to regu- However, during our interviews, one of the challenges lation standards, which appears to be the leading we heard with regulatory frameworks is that they tend NTB for businesses (World Economic Forum, 2015). to be ad-hoc and reactionary attempts to adapt to Developing a brand-new regulatory framework may the business and technological environment. Cer- be an unrealistic goal. Instead, our interview findings tainly, this has been the case with CBPR and GDPR, suggested that it would be prudent to try and find in- and will be the case with any future versions of them. teroperability between the top two existing regulatory Yet, one emergent concept we discovered during our frameworks for data flow: CBPR and GDPR. Conse- research may be a way to respond more proactively to quently, we propose two alternative approaches, each technological advances, while achieving organic and with their own pros and cons: multi-dimensional growth – transforming the digital 1. Enhance “Most Interoperable” Mid- economy into an ecosystem. dle-Ground Framework (i.e., CBPR) What are Digital Ecosystems? If the APEC community wishes to differentiate itself Digital ecosystems are understood as a collection of from the EU, then it may be worth pursuing a mid- companies, people, data, processes and “things” that dle ground ‘least-trade restrictive’ alternative that are connected by the shared use of digital platforms, encourages the free and secure flow of data, yet also empowering businesses to quickly apply and adapt builds trust and provide reasonable privacy protec- to the change within the technology landscape. They tions. However, more must be done to improve CBPR can either be understood vertically (within a supply and to incentivize widespread adoption. chain) or horizontally (across peer companies) for an industry, such as a “fintech ecosystem” or an “ecom-
4 merce ecosystem”. enterprise investment in infrastructure, can be enriching for an ecosystem. Why they matter to cross-border data • Incentivizing MSME entry into the formal sec- flow? tor: MSMEs in developing economies are incen- Cross-border data flow-oriented ecosystems en- tivized to enter the formal sector to fully realize courage stakeholders to grow the size of the pie (by the benefits of the ecosystem. aligning incentives) by creating interdependencies. 2. Prioritizing Narrowing of the Furthermore, ecosystems encourage the flexibility Multi-stakeholder knowledge gaps: of new plug-in solutions, businesses’ incentives shift from delivering products to outcome-as-a-service Participation in and regulation of the digital economy driven products which focus on integrating services and ensuing data flows requires new sets of knowl- and products into packages (bundled services) and edge and capabilities. Gaps in knowledge can result providing a better experience for customers. Finally, in sub-optimal regulations and prevent stakeholders ecosystems, when built on a common set of plat- from realizing the full potential. Thereby, limiting the forms, make it easier to design and implement regula- growth of a robust and homogenous ecosystem. tions that are consistent across economies. How do we create cross border data • Regulatory Knowledge Gap: In creating regulations, regulators face a two-fold flow-oriented ecosystems? challenge of understanding what must be regulated Developing the ecosystem requires (i) partnerships at present and understanding what must be reg- between regulators and large enterprises in the digital ulated down the line. To keep pace, regulators are economy, (ii) decrease in the knowledge gaps among challenged by the tasks of finding the bad actors, the stakeholders, and (iii) investment in the infra- monitoring compliance and speeding up the regula- structure. tory processes to better serve and protect the public. 1. Leveraging Large Players to create Hence, regulating data flows can be tough to time, messy (due to plenty of contingencies) and expensive rich ecosystems: to enforce. We recommend that regulators engage At present, large enterprises often set industry with “trusted partner” networks and large enterprises benchmarks, have a greater impact on setting regu- shaping the digital ecosystems to learn about current latory policy, and have easier access to both data and and emerging issues. capital. Economies can partner with large enterpris- es (who already benefit from preferential treatment • Consumer Knowledge Gap: oftentimes) to grow the size of their domestic (and Most consumers are not aware of the way their data is regional) digital trade ecosystems. Large players can being used, re-used, re-packaged and re-sold. Such develop the infrastructure and create frameworks that a knowledge gap breeds fear and lack of trust around facilitate design and implementation of regulations legitimate personal (and private) data usage. Con- that are consistent across economies and sectors sumers may favor overregulation and may demon- within economies. Specific measures to partner with strate a size-bias (penalizing bigger players while large enterprises are: simultaneously raising the cost of doing business for • Interoperable transactional infrastructures: the smaller ones). We propose a greater emphasis on NZEFTPoS is an example of large players collabo- building consumer trust through multi-stakeholder rating to create a transaction fee free e-payment collaboration and open dialogue. infrastructure that has been beneficial for all parties. • MSME Knowledge Gap: • Infrastructure Development: Increased access MSMEs either do not have enough data or do not to resources, especially in instances of large know how to best use it. Specifically, MSMEs have
5 poor availability and accuracy of the information • Increase Internet Speed & Access being collected and have difficulty in identifying High mobile device penetration paired with faster cross-border MSMEs trading partners. MSMEs inevi- internet connections has meant that consumers can tably de-risk (avoid riskier markets) or enter conser- perform data-flow oriented tasks on their mobile vatively (they will not offer their newest product). We devices and drive growth in digital trade. Yet, there is recommend upskilling MSMEs technologically, which considerable variation in internet access across the entails MSMEs gaining access to software that will APEC region – there are discrepancies across econ- allow them to monitor basic processes such as order- omies (due to variances in infrastructure) and within ing, inventory, SKUs, and basic predictive analytics. economies. Disparity within an economy may be due An ecosystem that links MSMEs to large enterprises to geography, as it is particularly challenging to im- with considerable presence in digital trade, particu- prove internet access in remote rural areas in certain larly cross-border trade can help in diminishing this APEC economies. gap. In conclusion, while it is generally understood that the • Talent Acquisition Knowledge Gap: Internet was designed to be open and borderless, we MSMEs and large enterprises need to foster and need to somehow reconcile with the various domestic acquire digitally skilled talent. However, the talent policies, hidden costs, and geopolitical complexity acquisition gap is perpetuated by underinvestment in across borders (IEEE Standards Association, 2012). STEM education. Local hiring rules add to the cost of As with non-digital trade, businesses will continue to entry (disincentivizing entry at scale). Economies can need an open, transparent, predictable, secure, and make a concerted effort to build entrepreneurial eco- relatively low-cost environment – both domestical- systems through national entrepreneurship policies ly and internationally. Finding an ideal way forward and programs and we recommend common certifi- requires understanding and being able to create the cates for digital skills to create pan-APEC standards right digital environment, or ecosystem. that allow for quality of talent markers. 3. Build out the physical infrastructure There is still a noticeable disparity among the APEC region in terms of electricity, internet access, internet speed and data storage. Physical infrastructure is critical to building out rich, digital ecosystems. Five common drivers (connectivity, growth, innovation, prevention, maintenance) shape the conversation around physical infrastructure for digital trade. To address this disparity, economies can follow a two- prong approach:
• Upgrade electricity grid: Major progress has been made in this area. Howev- er, electrification in rural areas remains a challenge. Moreover, power outage blackouts can be backbreak- ing for data centers, key cogs in the cross-border flow of data. Increased utility costs are a corollary of these blackouts. Finally, the unaffordability of electricity (up to 30% of cost of doing business) can be challenging for digital trade.
6 University of Southern California—ABAC Coordination Since 2003, the Asia-Pacific Economic Cooperation’s sizing the feedback from the interviews and finishing Business Advisory Council (“ABAC”) has engaged the a comprehensive report, the research team travels University of Southern California (“USC”) in an annual to the ABAC meeting and presents their findings. The research study on a topic of special interest to that research is included in the annual prioritized advice year. Twelve USC MBA students are selected to con- report that ABAC provides to the 21 APEC economies. duct the study under the guidance of ABAC leaders and faculty advisors. Topics that USC research teams have tackled in the past include foreign direct investment, the investment As part of the research, each MBA researcher travels landscape of sustainable energy, and trade in services on a fact-finding mission to APEC economies to meet across APEC. and interview business and policy leaders. Through these candid and sometimes anonymous interviews, Reports can be found at both the APEC Secretariat the research team gains a unique perspective to cap- and USC. ture and report the voice of business. After synthe-
7 8 9 Acknowledgements The University of Southern California Marshall ABAC- • Bryan Clark, Australian Chamber of Commerce MBA research team would like to begin our acknowl- and Industry edgements by expressing our deepest appreciation • Bryan Norton, T-Mark to the ABAC for the opportunity to engage in this field • Cai Heng, Star Station TV research project. This project afforded us the unique • Chen Zhao, Plug and Play opportunity to gain insights from leading business • Chris Millward executives, industry leaders, and policymakers across • Colin Coverdale, Small Business Association of all of the APEC economies. We are grateful to all 350+ Australia of our interviewees for graciously sharing their experi- • Collins Rex, Global Trade Professionals Alliance ences, knowledge, frustrations, and optimism with us. (GTPA) Their insights and recommendations are the founda- • Craig West, SME Association of Australia tion of this report. • Cyril Alfred Castro, Lazada Philippines • Dale Lee, CoffeeWORKS Limited In particular, our sincerest gratitude is given to project • Dingming Xu, The State Council, National Energy sponsor Phil O’Reilly, with great support from Steph- Expert Counsulting Committee People’s Republic anie Honey of ABAC New Zealand. Their tireless and of China continuous support is superbly commendable. • Dondi Mapa, National Privacy Commission • Douglas Hymas, American Chamber of Com- We also thank the ABAC Secretariats who were a merce in Japan tremendous help in coordinating interviews and • Dr. Nobuhiro Endo, NEC Corporation introductions. Moreover, we are grateful to the nu- • Eiichiro Otsuka merous business leaders, academics and regulatory • Faisal Ariff, Borderpass officials from every economy that provided us with • Fernanda Martinez, AT&T information. Some names of these individuals are not • Flor Paez mentioned due to confidentiality, however, many of • George Hartel the organizations and companies who assisted are • Harley Seyedin, American Chamber of Commerce acknowledged below. in South China • Hiroyuki Nadaguchi We would like to thank the following individuals for • Hong Xue their assistance with our research: • Hosman Rodriguez, OutKubus Cybersecurity and Compliance • Alex Chen, EZTABLE • Humphrey HO, Hylink Digital • Alex Georgiou, ShineHub • Ian Ko, Maeden Innovation Co., Ltd • Alex Liu, BMW Financial • Ian Lee (Sangwoo Lee), Cheil PengTai • Allan Guiloff, Shipit • Jane Drake-Brockman, Australian Services • Alma Hawk, AT&T Roundtable • Anne Nalder, Small Business Association of Aus- • Jianjun Wu, NZspring tralia • John Yu • Annelies Moens, Privcore • Jonathan de Luzuriaga, National ICT Confedera- • Annie Xue tion of the Philippines (NICP) • Anuchit Chitpirom • Jun Ying, ShangHai MeiHua System Co., Ltd • Benjamin Chang, Control Risks • Jun Zhang, Hylink Digital Solutions • Berenice Rodriguez • Ken Waller, Waller Consultancy • Bill Shieh, Beckie Technology Inc. • Kenta Goto, Kansai University
10 • Kiyotaka Tanabe • Wayne Chang, HouzSpecial Inc. • Lingbing Zong, Yunnan Wuzhou Cross-Border • Wenxi Liu, Blockchain Startup E-Commerce Co., Ltd • Xiangwen Hao, Genekang • Lisa Barker, ABAC Australia • Yohei Ishibashi • Lisa McAuley, Global Trade Professionals Alliance • Yu Yamada, Keidanren (Japan Business Federa- • Lito Villanueva, Rizal Commercial Banking Corpo- tion) ration (RCBC) • Yuhwen Foong, SushiVid • Lloyd Vatanakovarun • Zhenhua Sun • Louise McGrath, Australian Industry Group • Makoto Yokozawa, Nomura Research Institute / Additionally, we would like to thank the following Kyoto University companies for their assistance with our research: • Mario Jordan “Magellan” Fetalino III, Acudeen Technologies, Inc. • Angkas • Masahiro Takanohashi, Furusatohonpu, Inc. • ArpaChain • Masakazu Masujima, Mori Hamada & Matsumoto • Asia Pacific Institute of Research • Megan Mulia, PwC • Baidu • Metee Anivat, CSPM Thailand • Chamber of Commerce in Chile • Mi Zhou, Chinese Academy of International Trade • Chilean Ministry of Foreign Affairs and Economic Cooperation • coins.ph • Michael Fairbairn, RMIT University • COMEX PERU • Michael Waitze, Michael Waitze Media • eHunting LATAM • Motomu Takahashi, Mitsui & Co., Ltd • Embassy of Israel in Chile • Nobuhide Hayashi, Mizuho Bank • Equifax • Nurezali Osman, Malaysia Digital Economy Cor- • Farmacias Peruanas poration (MDEC) • Fubon Group • Peter Strong, Council of Small Business Organisa- • Fundación País Digital tions Australia • Jincheng Tongda & Neal Law Firm • Pieter-Jan Van Hecke, The Reading Room Co. Ltd. • Kalibrr • Richard Chien, CTE TECH. CORP. • MAGLIONA ABOGADOS • Rickson Goh, Tourplus Technology Sdn Bhd • Ministry of Foreign Trade and Tourism • Robb Stevens, Fonterra Brands (Malaysia) Sdn. • Mitcondoria Bhd. • Multicaja • Robert Hsieh, Long Chi Zen Industrial Corp. • Omnibank • Robert Milliner, ABAC Australia Member • Samishop • Rodolfo Lopez • Samsung Electronics • Roger Do, QSearch • Shipit • Sean Ding, GRisk • SONDA • Shenkuo Wu • Shingo Ehara, Plug and Play Tech Center • Shirah Segarra, AV Reality • Tom Harley, ABAC Australia, Dragoman • Tui McKeown, Small Enterprise Association of
Timur Tufail Amber Thuy Nguyen Sam Bergman Christopher Hamermesh Pablo Kao Armughan Syed Sherry Zhao Saori Nakayoshi Yuki Sakurai Australia & New Zealand Michael Nieman Christy Liu • Usman Malik • Vincent Chow, Bringbuys • Wan Mohd Aizuddin, ARBA Travel & Tours
11 Approach and Methodology The scope of this report is to identify NTBs, trends, consider to reflect some important concerns and and opportunities for LEs and MSMEs that are in- considerations for policymakers. We also supported volved in cross-border data flows. This study is our findings with comprehensive secondary research. intended to be a field research project predicated on interviews, and may be limited to conditions in the In addition, the validity and generalizability of any 2019 project period. As such, this report is not intend- and all findings and conclusions of this report is ed to substitute existing economic studies. Rather, it constrained by the quality and knowledge of the set is an exposé that illustrates the perspectives reported of business executives, regulatory officials, nonprofit by individuals, industries, and economies. and thought leaders available for interview. The team made every attempt to account for perspectives The research design and methodology were com- across all economies, as well as those of the ABAC prised of four key phases: and APEC Secretariats, and to interview a represen- 1. Review existing digital trade related research and tative sample of business stakeholders. However, the interview relevant thought leaders. findings of the report are directly limited to the quality and comprehensiveness of the information received 2. Develop interview protocols to identify the rela- from the interviews. tive importance of perceived NTBs to cross-bor- der data flows for businesses. After summarizing our interview research, we created an assessment of each of the 21 APEC economies (see 3. Conduct field research (in-person and virtual Appendix I for details). The tables below illustrate the interviews) with interviewees to determine real number of interviews that were conducted in each life impact of NTBs on businesses. Challenges, economy and industry. trends, and opportunities were catalogued for further review.
4. Validate interview findings with secondary re- search and attempt to quantify primary research data around consistent themes identified in each economy.
Twelve researchers and three USC faculty advisors conducted the research and analysis. In most cases, one interviewer conducted all or a majority of the interviews within each economy. Larger economies were assigned to multiple researchers. Interviewees were identified through APEC or USC contacts, cold outreach, and referrals. All interviewees were offered the option to remain anonymous in this report.
While our research was not (and did not attempt to be) fully comprehensive either within economies and across the region, the range of findings from our inter- views nevertheless provided us with repeated themes and consistent barriers and impediments, which we
12 Economy Interview Count Industry Interview Count
Economy Interviews Industry Interviews Australia 23 Academics 11 Brunei Darussalam 3 Business Association 48 Canada 5 Digital Product & Services 65 Chile 18 E-commerce 19 People’s Republic of China 36 Finance & Insurance 29 Hong Kong, China 19 Hardware 10 Indonesia 20 Healthcare 17 Japan 19 Logistics 16 Republic of Korea 16 Media 12 Malaysia 19 Professional Services 53 Mexico 10 (Consulting/Law) New Zealand 18 Regulatory 26 Papua New Guinea 3 Telecommunications 13 Peru 22 Travel & Hospitality 13 The Philippines 9 Total 332* Russia 5 Singapore 29 *Does not include thought leader interviews Chinese Taipei 14 Thailand 8 The United States 12 Viet Nam 24 Thought Leaders 21 Total 353
13 BUILDING A 1DIGITAL ECONOMY “The Internet is designed to be borderless, but that’s not how governments are treat- ing data flow.” CEO, Hi-Tech MSME in Japan
14 Overview of the Digital Economy 1Today’s world is immensely different than it was in the Policymakers involved in designing a framework to few years after the turn of the millennium. The vast govern data flow have the challenging balancing majority of the Internet infrastructure, digital business task of enabling the use of Internet and encouraging models, and key business players such as Amazon, digital trade and innovation while protecting domestic Google, and Facebook, are barely recognizable from interests and the rights and privacy of citizens. Given what they were in the early 2000s. Smartphones, the diversity across the APEC region, it is unsurprising artificial intelligence , internet of things, surveillance that data flow regulations vary considerably based technology, and data science as a subject were barely on cultures and domestic interests of each economy. items of note for most companies and regulators. Whereas some economies may adopt a data-related framework from a human rights lens (e.g., GDPR), Forums such as ABAC, as well as many of the vari- others see it as a goal to spur e-commerce and ous stakeholders in the region, are well aware of the innovation (e.g. CBPR). Other economies may take vast contributions that the digital economy has had into consideration domestic security, and shape on international trade. When used effectively, digital their domestic laws accordingly. As discussed in the trade and transformation can bridge inequality gaps next section, some of these measures can turn into and enhance lives across economies. In the right envi- barriers. ronment, a wide assortment of groups from MSMEs to LEs could stand to benefit (APEC, 2019). To date, there is no comprehensive multilaterally ad- opted set of rules to govern cross-border data flows. However, the challenge is understanding and being Instead, as discussed in subsequent sections, there able to create the right digital environment, or eco- are a variety of domestic and international regulations system. It is generally understood that the Internet that vary significantly from economy to economy. was designed to be open and borderless, yet we need According to our interviews, the number one pain to somehow reconcile with the various domestic poli- point businesses face is additional compliance costs cies, hidden costs, and geopolitical complexity across they incur when trying to adapt their business models borders (IEEE Standards Association, 2012). As with to accommodate regulatory frameworks used in vari- non-digital trade, businesses will continue to need an ous economies. open, transparent, predictable, secure, and relatively low-cost digital environment – both domestically and To enhance and build out our digital economy, it internationally. would be prudent to harmonize rules as practically as possible, while also ensuring that NTMs are designed with legitimate and reasonable policy and business goals, so as not to turn into NTBs. “The Internet is designed to be bor- derless, but that’s not how govern- ments are treating data flow.”
CEO, Hi-Tech MSME in Japan
15 Digital Non-Tariff Barriers (NTBs) 1.2 Overview With the increasing importance of data as an asset, Restrictions on cross-border data flows are not new, concerns about privacy and cybersecurity have raised yet they have drastically increased in the last decade questions on how to regulate the handling of data. (see chart below).
Exhibit 1 Growing Number of Data Regulations
250
200
150
Regulations 100
50
0 1972 1999 2000 2001 2007 2008 2011 2012 2015 2016 2018 2019
Source: OECD, 2019
The term NTB is commonly used by policymakers and to articulate what they perceived to be their primary has specific connotations. To simplify the discovery pain points or barriers with respect to digital trade. process during our interviews, we asked interviewees The chart below illustrates our findings:
Exhibit 2 Perceived Digital Trade Barriers
Inconsistent Regulations/Standards 76%
Data Privacy/Security Requirement 52%
Ambiguity of Regulations 46%
Data Flow Restrictions 33%
Others (e.g. IP protection, customs, etc.) 24%
0% 20% 40% 60% 80%
16 It became overwhelmingly clear from our interviews that inconsistency was the primary challenge. Incon- “There should be harmonization of rules for data pro- sistent regulations and standards consistently ranked tection and cybersecurity. Free data flow should not be a in the top 3 comments about digital trade barriers victim of politics.” University Professor and cyber law expert across the APEC region. Below is a list of the most prominent digital NTBs, organized by the categories we identified during our While onerous data privacy and security require- interviews: ments, as well as data localization, were items of con- • Inconsistent Regulations/Standards cern in some economies, it was the lack of consisten- “Noodle bowl” of divergent approaches to regulation cy in regulation standards that emerged as the core and standards (i.e., a misalignment of regulatory ap- problem. Consequently, we attempted to identify proaches and standards across markets). ways to overcome this “noodle bowl” of differing “FTAs try to deal with the issues, but so much changes approaches to regulations and standards. so quickly. Language that was written ten years ago Our findings were in line with similar research con- about digital trade is now basically extinct. There are ducted in 2015. USC Marshall’s study Driving Eco- no definitive international agreements to follow” nomic Growth Through Cross-Border E-Commerce Trade Association Director in Malaysia in APEC noted “the lack of comprehensiveness and • Data Privacy/Security Requirements compatibility of e-commerce laws and regulations Personal privacy or cybersecurity requirements that across economies remains a major impediment” are more burdensome than necessary to meet the (USC Marshall, 2015). Of over 500 businesses that stated goal. were surveyed across the APEC region, 67% identified “One possible barrier in going to a new market is inconsistency in standards and regulations as a key personal data. A new user base in new economy means barrier to cross-border e-commerce. “Poor coordina- ingesting a ton of new user data. Privacy laws feel very tion and harmonization” between the various econo- fragmented. It is tough to just try things out across bor- mies’ regulatory frameworks were cited as concerns ders because you immediately start ingesting user data.” during interviews. Manager, Hi-Tech Startup in Korea • Data Flow Restrictions (e.g., localization) Data flow restrictions, including forced data localiza- tion and data retention policies, which can impact direct services exports as well as the ability of goods exporters to access backbone services to support 67% their global value chains. “Data localization could potentially hinder sharing of data with overseas colleagues. Many of our clients find data localization very challenging and they can signifi- cantly increase operational costs.” Identified inconsistent standards and regulations Manager of Global Risk Control Company in China a major barrier to cross-border e-commerce (USC Marshall, 2015).
17 “Often, data localization regulations are introduced prospect of a digital tax as a potential barrier for based on the assumption that privacy is enhanced business, but will cautiously observe the effects. through the definition of where data is stored. This is “A common story across Asia is that you need a part- not necessarily true.” ner in each new location. But it needs to be a trusted Executive, Consulting Firm in Singapore partner. Otherwise they can potentially work with you • Other Restrictions (e.g., IP protection, customs, and then just end up locking you out once everything is etc.) in their name.” • Limited or nonexistent protections for intellectual CEO Entertainment MSME in Korea property rights. In some cases, the measures above may be discrim- • Procedural obstacles and ‘red tape’ that affect inatory (e.g., discriminating against foreign services cross-border e-commerce, including inadequate- or goods), or may not be based on sound science or ly resourced or onerous customs procedures, technological understanding. It is important for poli- which can be particularly burdensome e-com- cymakers to be able to differentiate between an NTB merce that involves the delivery of physical goods (i.e., a barrier to broader economic benefits across and services. the region) and an NTM (i.e., something that ought “My business does not take on projects where regulation to be in place for legitimate reasons such as national is even slightly onerous. Regulations feel lumpy and security or citizen’s individual security). there is no place to easily understand them all. I’d rather not fish in that pond.” Entire research studies could be conducted on any CEO, Marketing Agency in New Zealand single one of the above NTBs. However, for the pur- • Restrictions or prohibitions on the provision of poses of this study, the focus is on unwarranted or digital goods or services, such as e-payments. unjustified constraints that affect the volume or value Additionally, any discriminatory rules for the pro- of data flow, and whether – through design or intent – vision of online retailing, local presence require- restrict trade more than necessary to meet legitimate ments, as well as limitations on foreign owner- objectives on consumer protection, personal data ship, and licensing and registration requirements. privacy, or cybersecurity.
“There is almost no enforcement of the data protection “This is a problem for most policymakers – ‘data local- and privacy laws in Mexico. Many MSMEs do not ization’ and other restrictions assume a simple digital abide by the law because of this, in addition to having landscape, when the internet is far more complicated a lack of resources and knowledge about this law.” and interconnected.” Legal Counsel of Large Travel Agency in Mexico CEO, High-Tech Startup in Japan • Performance requirements including forced transfer of source code or technology. Some reg- ulations require disclosure of intellectual property including source code to give authorities access to encrypted user data. An emerging regulation that could become an NTB is the concept of digital taxation. Some of our interviewees see the
18 Cross-border Data Flow Barriers 1.3 Variance in Data Regulations As noted earlier, interviewees repeatedly expressed frustration with the lack of consistency in regulations Licenses and regulations can dif- across the region. Some of the variation appears to “ stem from the goals of data regulations. The goals can fer so much country-to-country. For include consumer protection, domestic security, law global regulation, there are so many enforcement capabilities, economic protectionism, people trying so many different and antitrust. There are also differences in how regu- things. Lack of standards can cre- lations are applied to the flow of cross border data. ate market fragmentation – every Many regulatory standards, including GDPR, have a region creates new, unique regula- focus on data privacy and security, while some reg- tions.” ulations regulate more broadly. For example, China’s Manager, Blockchain Startup in Malaysia Cybersecurity Law requires security measures to pro- tect “important data” as well as personal information.
China’s Cybersecurity Law Article 37 Personal information and important data collected assessment will be conducted in accordance with and generated by critical information infrastructure measures jointly defined by China’s cyberspace operators in the PRC must be stored domestical- administration bodies and the relevant departments ly. For information and data that is transferred under the State Council. Related provisions of other overseas due to business requirements, a security laws and administrative regulations shall apply.
The range in data regulations across APEC is illustrat- • China, Indonesia, and Vietnam require the ed by the following: location of data centers inside their respective economies. • Singapore allows organizations to transfer private data to other organizations provided they have • Vietnam published its Cybersecurity law in 2017 protection protocols comparable to the Personal but it has not yet provided any detailed guidance Data Protection Act (“PDPC”) to transfer private on how to implement it. data (DLA Piper, 2019). As many of our interviewees noted, the myriad of • The U.S. emphasizes free data flow, while some global data related regulations is challenging to com- industries have stricter data regulations (e.g., prehend and stay up to date with, resulting in compli- the Health Insurance Portability and Account- ance headaches for businesses. ability Act) and some individual states have more stringent data privacy laws (e.g., the California To better illustrate the variances in data regula- Consumer Privacy Act). tions, the European Centre for International Politi- cal Economy (“ECIPE”) developed the Digital Trade
19 As a benchmark reference, the EU’s score has been “Licenses and regulations can dif- included. fer so much from economy to econ- omy. For global regulation, there are so many people trying so many different things. Lack of standards can create market fragmentation – every region creates new, unique regulations.”
Manager, Blockchain startup in Korea Restrictiveness Index (“DTRI”), which comprehen- sively measures the impact of an economy’s digital trade policies across several areas. In determining the index values, ECIPE reviews national data protection regulations as well as legal analyses from high profile law firms.
For the purpose of our study, we focused on ECIPE’s Data Restrictions Index, a subset which assesses economies across the following items: • Cross-border flow restrictions, including: • Bans on the transfer of local processing equip- ment • Local storage requirements • Data retention requirements • Subject rights on data privacy (e.g. burdensome consent requirement) • Administrative requirements for data privacy • Sanctions for non-compliance • Other data policy related restrictive practices (e.g., cloud computing requirements)
A higher value denotes a more restrictive digital trade environment (i.e., 1 is virtually restricted), while a low- er value denotes a less restrictive environment (i.e., 0 is completely open). As the index value increases, so do the costs of conducting digital trade in that econo- my (ECIPE, 2018). The chart below presents the APEC economies by increasing level of data restrictiveness.
20 Exhibit 3 Digital Trade Restrictiveness Index - Data Restrictions Japan 0.04
Chile 0.04
The Phlippines 0.11
Chinese Taipei 0.12
The United States 0.15
Hong Kong, China 0.16
Peru 0.22
New Zealand 0.22
European Union 0.24
Singapore 0.25
Canada 0.25
Australia 0.25
Mexico 0.26
Thailand 0.29
Malaysia 0.35
Brunei Darussalam 0.38
Republic of Korea 0.39
Viet Nam 0.43
Indonesia 0.44
Russian Federation 0.63
China 0.82
0 0.25 0.5 0.75 1
Source: ECIPE, 2018. Data for Papa New Guinea was unavailable
21 Dichotomy Between Developed and Developing Economies
In addition to variation in regulations, our interviews about data regulations across economies and with-in also revealed a difference in awareness and concern economies.
“We lack even the most basic, necessary infrastructure to measure the impacts of e-commerce on the country. We’re essentially flying blind.” Manager, Bank of Indonesia “We see our environment as very business-friendly. The process to amend laws is transparent and regulations are well enforced.” Consultant in Singapore
USC Marshall uncovered a similar trend in 2015. As il- to digital growth (APEC, 2017). APEC developed a lustrated in the chart below, there was a major divide digital enabler ranking for each economy based on with how businesses in developed versus developing several indicators including: economies perceived the problem of quality and en- • Access (e.g., number of internet servers, internet forcement of e-commerce laws and regulations. bandwidth, electricity production and costs etc.) • Labor (e.g., math and science education, avail- During our interviews, we found that many business- ability of engineers etc.) es, particularly MSMEs were unaware of CBPR or the • Speed (e.g., internet connection speed) work APEC is doing to promote the interoperability • Price between the CBPR and EU’s GDPR • Capital (e.g., banking, loans etc.) • Economic environment (e.g., IP protection, con- We surmise that this divide is in large part related tract enforcement time etc.) to how ‘digitally enabled’ the economies are – or, a snapshot of how each economy stands with respect
Exhibit 4 Perceived Digital Trade Barriers
Developed economies 46% 41% 14%
Developing economies 20% 40% 39%
Not a problem Minor problem
Source: USC Marshall, 2015 Major problem
22 The chart below shows the overall rank index for each of the APEC economies.
Exhibit 5 Digital Enablement Ranking
United States
Korea
Singapore
New Zealand
Hong Kong, China
Australia
Japan
Chinese Taipei
Canada
Russia
Chile
China
Malaysia
Thailand
Brunei Darussalam
Mexico
Viet Nam
Peru
Indonesia
The Philippines
Papua New Guinea
0 5 10 15 20 25 Source: APEC, 2017
23 Challenges for Businesses As we learned during our research, a major challenge Even with robust regulations, there can be confusion for companies is adapting their business models when those regulations are not enforced. Interviewees for individual APEC economies because of differing in Chile and Peru for example, noted that businesses regulatory frameworks. For example, it may be nec- do not take privacy or security regulations seriously, essary to use multiple databases and possibly store as they believe enforcement agencies are too small data in different ways across economies. This often and lack the ability to completely enforce regulations. results in increased costs for businesses in the way of In some cases, we learned about ‘informal econo- compliance costs, technical complexities, difficulty in mies’ or black markets, where citizens are well aware hiring local talent to understand data regulations, and of digital trade occurring, but regulators are unable to stymied innovation because of inefficiencies manag- enforce laws. On the other hand, some interviewees ing data. in Asian economies noted that their domestic regula- tions are ambiguously written, yet regulators engage As illustrated in the chart below, increased compli- in heavy enforcement. In these cases, businesses ance costs were the top pain point for interviewees. become too self-restrictive and avoid risks to avoid MSMEs generally do not have the capacity to adjust legal problems. their business operations economy by economy. Moreover, many MSMEs are unaware of the costs they With respect to international regulatory frameworks, will need to incur when expanding globally, simply there was a universal consensus amongst interview- because the landscape is so fragmented. ees in all APEC economies that the EU’s GDPR is strict and costly to comply with. Many APEC businesses Another dimension that is impeding business invest- need to comply with GDPR because the rules are ments is uncertainty in the evolution of regulations. applied to any businesses providing goods or services Rapid changes in digital technology and business to European residents or monitoring the residents’ models is causing regulators to frequently tweak behavior. To give some perspective on the magni- regulations. tude of these costs, the International Association of
Exhibit 6 Impact of Inconsistent Regulations on Business Stymied Innovation 14% Increased Compliance Costs 40%
Local Talent Issues 17%
Technical Complexities 29%
24 Privacy Professionals (“IAPP”) estimated in 2017 that desire for greater consistency in regulations across the Global Fortune 500 alone would spend USD $7.8 the economies. In addition to the cost of working billion in compliance costs for the GDPR (IAPP, 2017). through a “noodle bowl”, the nature of the digital transactions and the flow of data in cross-border Most of our interviewees are aware that the APEC re- trade, as illustrated by the Rakuten case study below, gion has no unified set of rules yet – certainly nothing also argues for greater consistency in regulations. as robust as the EU. However, there appears to be a
Rakuten case study The misalignment between policymakers and the Sydney, Honolulu, Tijuana, and finally to a local actual workings of the internet is a common theme router in Mexico City. that was uncovered from interviews over a majority • The friend in Mexico City then receives the of APEC economies. data packet on their smartphone and views the message on their application. Although the Internet was designed to be border- less, policymakers around the world have attempt- Now, this was just one possible route the data ed to apply regulations as if it coexisted with tradi- packet could have taken. In reality, data packets will tional national borders. Data storage requirements travel across multiple combinations of routes, all are just an example of this regulatory reaction. over the world, to get to the same final destination.
It is tempting to imagine cross-border data flow While this example involved a simple message data occurring between two economies, though this is packet, how might the flow impact transfer of more not at all the case. In Japan, a CEO of a high-growth sensitive data? Moreover, what are the implications technology company shared an illustrative example for e-commerce and online payments? For exam- of data flow for a messaging app he had overseen: ple, if a customer purchased a digital good or ser- • A user in Tokyo sends a message on her smart- vice in one economy, but the final data transaction phone to send to a friend in Mexico City. occurred on a cloud server in a completely different • The initial message, in the form of a data pack- economy, where was the point of sale? What are the et, is routed through a local gateway or router tax implications for the buyer and seller? in Tokyo. • From Tokyo, the data packet makes its way It is clear then, that cross-border data flow is far to Minamiboso, to the Japan-Guam-Australia more intricate than might be imagined by many of (JGA) cable system. us. Traditional views on regulating data flow may • The data packet then travels across a giant net- result in unnecessary non-tariff barriers. work of submarine fiber optic cables: to Guam,
25 Current Initiatives for the Digital Economy In1.4 response to concerns about inconsistent regula- to promote “data free flow with trust” to harness the tions, several initiatives have attempted to harmonize opportunities of the digital economy, reaffirming the different frameworks and enhance cross-border data importance of the Work Programme on Electronic flow. There are three primary types of approaches: Commerce at the WTO (G20, 2019). binding regulations or treaties, “middle ground”, or Free Trade Agreements (“FTAs”) co-regulated, and self-regulated. FTAs have emerged as another venue for groups of 1. Binding Regulations or Treaties economies to develop regulatory frameworks for This approach involves enforceable and binding reg- cross-border digital trade. In March 2018, the Com- ulations such as GDPR (EU), PIPA (Japan), HIPAA and prehensive and Progressive Agreement for Trans-Pa- CCPA (U.S.) as well as economy-to-economy trade cific Partnership (“CPTPP”) was the first to set the agreements. This more traditional approach typically rules and the United States-Mexico-Canada Agree- has the strongest level of enforcement (and therefore, ment (“USMCA”) followed that trend in October 2018. adoption), but tends to take a longer time to negoti- ate or update. The following are the most prominent • CPTPP encourages the cross-border transfer of frameworks with respect to digital trade: data, including personal information, by elec- The World Trade Organization (“WTO”) tronic means when such activity is for the con- duct of business (Article 14.11), while prohibiting The WTO, formed in 1995, is the largest platform localization requirements of computing facilities intended to harmonize international trade rules. as a condition for conducting business in that WTO members have long since agreed not to impose territory (14.13); the disclosure of source codes customs duties on electronic transmissions. While as a condition for the import, distribution, sale digital trade is encompassed in one of the WTO’s key or use of mass-market software (Article 14.17); treaties, the General Agreement on Trade in Ser- and customs duties on electronic transmissions vices (“GATS”), specific digital issues such as data (Article 14.3). localization and forced technology transfer are not addressed. As one might expect, managing this treaty • USMCA, which was formerly known as the North is very cumbersome due to the involvement of many American Free Trade Agreement (“NAFTA”), economies with different interests. Thus, while the includes similar arrangements regarding e-com- WTO encompasses much of the world, its regulations merce, binding cross-border data flow obli- on digital trade are not as comprehensive. gations, and prohibiting data localization. Like CPTPP, there is also a requirement for the parties Recently, in January of 2019, 76 WTO members, to have a privacy system with “key principles” including China, the EU, and the U.S., announced for such systems specified for the first time in a their intention to launch negotiations on the trade-re- trade agreement. These principles are “limita- lated aspects of e-commerce. In June of 2019, G20 tion on collection; choice; data quality; purpose leaders agreed on the necessity of interoperability specification; use limitation; security safeguards; of different legal frameworks related to data at the transparency; individual participation; and, ac- G20 Osaka Summit. The members are attempting countability.” In addition, Article 19.8 (6) specif-
26 ically states that the parties “recognize that the Privacy Framework—a principles-based model for APEC Cross-Border Privacy Rules system is a valid national privacy laws that recognized the importance mechanism to facilitate cross-border information of “effective privacy protections that avoid barriers to transfers while protecting personal information.” information flows.” This document was followed by the creation of the CBPR, an aspirational opt-in form GDPR and Adequacy Status of cross-economy legislation that was designed to GDPR streamlines cross-border data transfers when protect personal data, while facilitating cross-border participating economies are accorded with an ade- trade to benefit consumers and businesses. quacy status (i.e., when two domestic regimes are deemed equivalent and no further regulatory approv- In 2011, this framework was developed by APEC als are needed). It should be acknowledged that an economies to promote the interoperability of privacy adequacy status is difficult to obtain. Only four APEC regulation through enforcement of minimum stan- member economies, Canada, Japan, New Zealand dards. There are currently eight participating APEC and U.S. (limited to the Privacy Shield framework) economies: U.S., Mexico, Japan, Canada, Singapore, have received an adequacy status for exemption. the Republic of Korea, Australia, and Chinese Taipei. The Philippines is currently seeking to join the system, As discovered in our interviews, some economies, as the ninth member. like the Russian Federation, have shown interest in changing domestic laws to be like EU’s GDPR, in In order for CBPR to be more effective, it is vital that order to harmonize regulations by imitating the most participation rates increase, and more companies restrictive one. In the U.S., federal legislation is also become certified.During our interviews, we found considering mirroring key provisions of GDPR, and that many businesses, particularly MSMEs were many large companies that already comply with GDPR unaware of CBPR or the work APEC is doing to are supportive. promote the interoperability between the CBPR and EU’s GDPR. 2. “Middle Ground” Industrial Standards (ISO27001, This approach is based on collaboration between BS10012) businesses and economies, as well as some form of Some of our interviewees shared that they adhere to NGO or international organization to help set and industrial standards such as ISO27001 and BS10012, maintain the rules, but is not necessarily binding or as to prove their excellence in managing data. easily enforced. Businesses tend to have more input with this approach, but need to be incentivized prop- • The ISO27001, developed by the International erly for adoption to occur. However, it is worth noting Organization for Standardization (“ISO”) is the in- that this approach is much less effective when there is ternational standard for information security and another, more strict, regulatory framework in place. provides the basis for achieving the technical and CBPR operational requirements necessary to comply with EU’s GDPR. The standard helps organizations CBPR is a leading framework for a digital ecosystem of all sizes and in all sectors to keep their infor- – a means to coordinate flows of data. In 2005, the mation assets secure. APEC member economies first endorsed the APEC
27 • BS10012 on the other hand, developed by British firms indicated that they apply sophisticated and Standards Institution (“BSI”) provides the core comprehensive in-house data governance frame- standards that firms need to comply when col- works and that it usually consists of classifying all lecting, storing, processing, retaining or disposing data according to sensitivity and restricting access to personal records related with any individuals. data within the firm based on sensitivity level. The ap- proach is the least costly to comply with for business- 3. Self-Regulated es, yet provides the least security to consumers, as there is no independent enforcement of the internally This approach leaves room for businesses to decide set regulations. which rules to follow based on guidelines from asso- ciations, trade bodies, or corporate policies. Some
APEC’s Future Digital Economy 1.5Given the interviewees’ desire for a consistent and latory frameworks and trade agreements that design- widespread regulatory framework and need to elim- ing a suitable framework is no small task. Ongoing inate the “noodle bowl” effect, clearly more must be geopolitical pressures make it difficult, if not impossi- done to establish a harmonized and interoperable ble, to objectively define how reasonable national or digital economy. economic security concerns may be. As such, obtain- If the resources were available, most stakeholders ing buy-in from the various economies and stakehold- would agree that an ideal framework would: ers involved on whether an NTM is an NTB or not is an • Support the secure and free flow of data. even greater challenge. • Consider legitimate objectives around privacy, Our interviews provided some helpful insight on the cybersecurity, and consumer protection. general perception of the current state. The chart be- • Account for reasonable national and economic low summarizes the preference interviewees had for security concerns. type of regulatory framework. While a co-regulated • Ensure all the above are addressed using a last approach was the most popular (over 52%), a signifi- trade restrictive approach. cant number of interviewees voiced a preference for a Yet, it is very apparent from the various existing regu- fully regulated approach such as GDPR.
Exhibit 7 Preferred Framework Approach Binding Regulation/Treaty (e.g. GDPR, CPTPP) 39%
“Middle Ground” (e.g. CBPR) 52%
Self-Regulated (e.g. Company policy) 9%
28 sers, and data protection authorities. It requires Even with the costs of switch- immediate notification of data breaches and has “ much stronger fines and punishments for the ing to something like GDPR, if there was a level playing field and entities involved. GDPR tends to take the stance all other companies had to do it, I that industry self-regulation of data security has think it would be much easier for us been tried and been unsuccessful. GDPR is a to follow the same rules everywhere legally binding framework, and it enforces itself our company operates.” anywhere in the world that an EU citizen’s data is being held or used. Executive, Digital Marketing LE in Japan For the reasons described above, developing a brand- new regulatory framework may be an unrealistic goal. “CBPR’s requirements are very Instead, it would be prudent to try and find interop- much aligned with other global erability between the top two existing regulatory frameworks such as the EU’s Bind- frameworks for data flow: CBPR and GDPR. ing Corporate Rules and Privacy Shield. Preparing the supporting A Comparison of CBPR and GDPR documentation for CBPR helped expedite the preparation for Shield CBPR and GDPR are both premised on consent and and BCR certification. However, notice, meaning that the consumer has consented to CBPR is still in its early stag- their data being controlled, and has adequate notice es and needs more companies and about how their data will be used. Both systems also economies to join for the network build off the original eight privacy principles devel- effect. It is too costly to comply for oped by the OECD (OECD, 2013). However, the two MSMEs because we need to renew frameworks differ in that CBPR is more hands-off, it annually. The fee to the account- while GDPR is much more hands-on: ability agent is quite high.” • CBPR allows for the data controller to “exercise Manager, Hi-Technology Company in Singapore due diligence and take reasonable steps” as an Given the state of the two market leading systems, we alternative to obtaining consent. Since CBPR is propose the following alternative paths to the APEC principles-based, it is not quite clear what legal community: standard a business must apply when determin- ing “due diligence” or “reasonable steps.” For Alternative 1: Enhance “Most Interoper- example, CBPR does not define “data breach” or able” Middle-Ground Framework establish notification requirements. The frame- If the APEC community wishes to differentiate itself work encourages data breach notifications but from the EU, then it may be worth pursuing a mid- does not require it. CBPR also takes a more dle ground alternative that encourages the free and lenient path in terms of punishment, including secure flow of data, yet also builds trust and provide involving accountability agents and engaging in reasonable privacy protections. dispute resolution. Bearing in mind that a significant stakeholder pop- • GDPR covers data subjects, controllers, proces- ulation expressed preference for a co-regulated
29 approach rather than being forced to comply with a the problem of certification compliance costs. legally binding set of requirements, the CBPR appears • A ‘cliff’ or ‘sliding scale’ set of requirements would to be a good starting point, or template, to work with. essentially require full compliance for businesses It certainly is the most developed and international that have exceeded a specified threshold (e.g., co-regulated framework in existence. annual revenues). LEs would need to be in full compliance, while smaller MSMEs ought to be Criticisms for CBPR included challenges in incentiviz- able to waive some of the more stringent data ing companies to become certified, as well as prin- standards. ciples that were not aligned with some economies’ • For developing economies, a sliding scale will domestic laws. For MSMEs in particular, the certifica- help support local businesses competing with tion costs can be burdensome. Moreover, the CBPR some of the larger multinational digital business- system was first endorsed in 2005, and last updated es. in 2015. The digital economy however, has evolved far more frequently, and quickly. • Living framework: To ensure that the framework remains relevant and We recommend a multi-pronged approach, with the not outdated, it must be continuously aligned with objective being to enhance the CBPR system using the technological trends. Thus, APEC should consider following guidelines: dedicating a working group (e.g., the Electronic Com- merce Steering Group) to monitor the framework’s • Interoperable basis: rules and maintain dialogue with businesses involved To address the concerns of the framework not being in digital trade. in line with other economies’ laws, CBPR could be • ABAC members, or a specific APEC working further enhanced. group, would likely lead the charge on better edu- • Using a phased approach, small groups of APEC cating businesses as well as policymakers on the economies could request that their respective intricacies of technology and cross-border data ABAC workgroups (e.g., ABAC ‘Pathfinders’) focus flows, as they pertain to CBPR. on reviewing and updating specific areas of CBPR • Several of our interviewees, particularly policy- (e.g., data security protocols, privacy standards, makers and academics, discussed the idea of etc.). regulatory ‘sandboxes’ to: • Each group is then able to provide input on 1. Encourage experimentation and safely moni a section of the framework, running parallel tor effects of regulations. workstreams, rather than having all 21 economies 2. Create ongoing dialogue between business attempt to tackle the system at once. es, policymakers, and regulators. 3. Offer guidance on how to better develop • Flexible design: and comply with regulatory requirements. Core to the adoption of any type of co-regulated • APEC as an organization, or specific economies, framework is the concept that it cannot be a ‘one-size may wish to offer or promote incentives to busi- fits all’ approach. One of the biggest challenges with nesses to encourage adoption. For example: incentivizing entire economies, let alone individual 1. Case studies demonstrating how busi MSMEs, to adopt a co-regulated set of guidelines is nesses following this harmonized and in
30 teroperable framework ultimately benefit work. from a more streamlined business model, It is worth noting that this alternative could initially be greater market access, and trust from customers. pursued by a few core APEC economies that have ex- 2. Implementing a form of digital development goals pressed a strong interest in a co-regulated approach (similar to the United Nations’ Sustainable Devel- such as CBPR. Once the cross-border digital trade opment Goals). benefits are observed, other APEC economies may 3. Economies could offer initial tax credits to com- wish to either adopt, or pursue mutual recognition in panies that become certified under the frame- order to participate.
• Provides MSMEs with greater flexibility • Harder to enforce relative to a fully-regu- to be compliant with data protection lated approach. principles. • Steep adoption curve that requires • Levels the playing field for emerging additional education and incentives for Pros economies and MSMEs by allowing ‘cliff’ Cons businesses. or ‘sliding scale’ style requirements. • Participants will still need to comply with much stricter GDPR requirements if they conduct business with EU citizens.
Alternative 2: Move to “Most Restrictive” Regulated Framework Businesses rarely welcome new regulations, and tively here to stay and might only be surpassed by a GDPR was seen as a particularly heavy-handed regulatory framework that was designed to be even approach to data laws. However, it is important to more restrictive. For many businesses, it may be recognize part of the world moving toward a GDPR easier to just ‘buckle in’. Moreover, as with any initially style framework in an arguably reasonable attempt to burdensome regulation, it will eventually become balance the protection of citizens’ individual rights, much easier to comply with the legislation due to the alignment with the growth of data and technology, introduction of numerous compliance related prod- and the legitimate concerns of harm to economic ucts and services. development through overly rigid data privacy and security regulation. In addition, a modest 40% of in- Some of the economic benefits of voluntary com- terviewees voiced a preference for GDPR as a regional pliance with GDPR would include an increase in the regulatory framework. ease of cross-border data flows, greater access to European markets, and the ability to preempt future We believe it should be stated that the GDPR is legislative changes. Canada, Japan, New Zealand, and unlikely to go away, even if APEC and its member the United States (under the Privacy Shield frame- economies were to design a new system. When one work only) have already attained adequacy status is compliant with GDPR, they are compliant almost with GDPR due to their stringent domestic data laws. everywhere in the world. Structurally, this means Other APEC economies could also work towards that even businesses operating outside of the EU still adequacy or mutual recognition with GDPR. As noted have to be compliant with GDPR requirements if they earlier, emerging regulations in some APEC econo- handle EU citizen data. Thus, there is a strong incen- mies appear to be designed with GDPR as a baseline. tive for businesses to endorse GDPR-like legislation, For example: as they would not have to frequently reconfigure their technology or internal controls. GDPR is effec- • China’s Personal Information Security Specifica-
31 tion, introduced in May 2018, is very comprehen- adjusted to be more harmonious with GDPR in sive and modeled similarly to GDPR. However, the terms of privacy protection. For example, there specification is not yet legally binding. is a push to align with the Council of Europe’s • In the Russian Federation, especially given its Convention 108+, a unified set of legally binding vicinity to the EU, domestic regulations are being requirements for privacy protection.
• Most comprehensive data privacy and • Less flexible with respect to interopera- security features. bility. • Level playing field for all member econo- • May initially be burdensome for smaller mies and businesses. MSMEs to comply. Pros Cons
Case for a Digital Ecosystem 1.6Interviewees across economies have made it abun- fragmented data regulatory frameworks will result dantly clear that an interoperable and consistent in ‘data islands’ of sorts, isolating certain econo- regulatory framework is greatly desired. In addition to mies and populations. This would effectively stifle taking on the burden of compliance costs, businesses innovation and sideline many MSMEs from digital face unnecessary technical complexities in the exist- trade due to the dramatic increases in compli- ing cross-border regulatory environment. ance costs.
• In addition, consideration should be given for the “The biggest hurdle for MSMEs various stakeholders (e.g., LEs vs. MSMEs or de- is understanding the international veloped vs. developing economies) that will play regulatory frameworks. Fortunately, a role in the selected framework. A level playing we have access to legal consulting field ought to be created using mechanisms such services for free.” as a ‘cliff’ or ‘sliding scale’ set of requirements.
Executive, Hi-Tech Startup in the Russian Federation Finally, it is imperative that this interoperable regula- tory framework is kept up-to-date with technological • Whether a binding regulated or middle-ground advances. In creating a high-functioning APEC-wide approach is chosen, it is vital to avoid a future digital economy, it is clear that having a consistent where individual economies, or fragmented FTAs, and standardized framework is an important foun- create their own versions of GDPR (or similar dation. However, one of the challenges with regula- frameworks). As such, education for policymak- tory frameworks is that they tend to be ad-hoc and ers will be needed to design a pragmatic frame- reactionary attempts to adapt to the business and work, and businesses will need to understand the technological environment. Certainly, this has been incentives of adopting the new approach. the case with CBPR and GDPR, and will be the case with any future versions of them. • There is a risk of a future state where so many
32 Moreover, a framework, as the name suggests, tends to place perspectives into a ‘box’ of sorts. Ideas and innovations can be limited, resulting in staggered “The strategy for Indonesia is to economic growth. Yet, digital technology continues to release regulation and see how hard grow at a rate that regulations cannot keep up with. the business community pushed back on it. This approach appears What if there was a way to organically create an envi- business-friendly, but it’s not the ronment for multi-dimensional growth for the digital best way for businesses or the larg- economy? We believe cross-border data flow-orient- er economy to operate in the long ed digital ecosystem is that solution. The next section term.” explains how such ecosystems can be built. Regulatory Official, Indonesia
“Among the 21 economies, we at least have clear consensus that we need to have something consistent so that we can trade more effectively.” Senior Executive, Industrials LE in Japan
33 TRANSFORMING INTO 2 A DIGITAL ECOSYSTEM
34 The Digital Ecosystem 2As discussed in the previous section, the challenges how cross-border data flow-oriented ecosystems of creating and implementing a top-down, frame- can be created, this section of the report will closely work-driven approach has the potential to set us on a consider the following three ingredients: path toward disjointed ‘digital islands’, where digital • Incentivizing large enterprises (to become better trade and regulations diverge across the APEC econo- actors and active participants in the digital eco- mies. We learned from our interviews that businesses system building process), feel burdened by the oppositional relationship with • Narrowing knowledge gaps (to enhance trust regulators. We posit that an ecosystems-based ap- amongst all stakeholders), and proach, where all stakeholders have the incentive to • Continued investment in physical infrastructure grow collaboratively the overall size of the pie, can en- (to lower the cost of entry and the cost of opera- hance cross-border digital trade and create a uniform tion for firms of all sizes). regulatory environment. To more fully understand We will begin by trying to understand ecosystems.
Overview of Digital Ecosystems 2.1To build richer ecosystems, we must take a closer connected in organic, symbiotic relationships. These look at digital ecosystems and how economies can relationships are enriched by open, multi-channel play a role in nurturing them. Harmonious digital communication across a mutually beneficial infra- ecosystems are understood as a collection of stake- structure, while lowering the cost of operating busi- holders (regulators, large enterprises, MSMEs, and nesses who can rapidly evolve to changes within the consumers), processes and “things” that are inter- technology landscape.
2.1.1 Types of Digital Ecosystems
Digital ecosystems can either be understood vertically According to McKinsey, existing digital ecosystem can (within a supply chain) or horizontally (across peer be divided into five main groups (McKinsey & Compa- companies) for an industry, such as a “fintech ecosys- ny, 2017): tem” or an “e-commerce ecosystem”. In a narrower context, ecosystems are also used to describe the products, services and components of comprehen- sive solutions.
35 Objectives Examples • Allow users to interact with one • Individual social platforms such as another socially; Facebook, Instagram, WeChat; • Attract as many customers and • Professional social platforms such social interactions as possible. as LinkedIn. Sales • Share data using standard data • Internet of Things (IoT) efforts by definitions; GE, Apple iHealth; • Provide additional data and analyt- • Property and casualty insurers ics-based services; (e.g., using weather data patterns • Capture and use external and pro- to assess fire risks). Data prietary data.
• Enabled through industry standard • Consumer mobile such as Apple software and hardware; iOS and Google Android; • Provide better/faster IT delivery • Enterprise-technology platforms through broad range of specialist IT such as Oracle ERP, SAP ERP; firms and technologies. • Visa/MasterCard’s payment pro- Technology cessing platforms.
• Leverage company’s core com- • Ridesharing platforms such as Lyft merce functionality and value and Uber; proposition to attract customers; • Shopping platforms such as Ama- • Add capabilities to complete the zon; Customer customer journey and create net- • Banks allying with fintech players in journeys work effect. value chain (e.g., SME app players linked via APIs into bank.) • Integrate multiple companies’ • Explicit services platforms such as services to holistically address cus- Salesforce.com and the Salesforce tomers’ pain points and make the ecosystem. initial product/services much more Services attractive.
Firms providing goods and services across borders that includes payments for online purchases for good can use one or more of the above ecosystems. Two and services through credit cards, debit cards, or other note-worthy eco-systems are the FinTech payments systems such as Paypal or Alipay. Mobile ecosystem and digital hubs. FinTech is an important wallet-based payments for purchases at point of sale driver in the online payment ecosystem that in turn are also considered digital payments. enables e-commerce and online digital services. A key component of the FinTech is digital payments A digital hub serves as a catalyst in promoting new
36 technologies, fostering innovations, nurturing entre- ucts like construction equipment, will require preneurship through incubators and accelerators, Internet of Things to support the transfer of all and knowledge sharing. This ecosystem supports the of the data the devices will collect around the development of new digital business and business world.” models. While most developing APEC economies are unable to tap into the potential of new and disruptive Machine Learning-as-a-Service (MLaaS) technologies, a few have succeeded in creating digital MLaaS is understood as services mostly offered by hubs in major cities. cloud service providers to offer built-in machine learning tools, in a subscription model. Leveraging Two emerging trends that are going to have significant pre-built algorithms and models in those services, impact on digital business and cross-border data developers can speed up their application develop- flows are the Internet of Things (IoT) and machine ment. While the supply of knowledgeable and skilled learning as a service (MlaaS). software engineers is still limited and costly, the ease, speed and availability of MLaaS solutions is trans- Internet of Things (“IoT”) Ecosystem forming the way businesses apply data to improve IoT is at the epicenter of digital transformation and their efficiency, enhance product capabilities, and is central to the concept known as ‘Industry 4.0’. De- customer engagement. Data is the driver behind vices embedded with electronics, software, sensors machine learning. and network connections with machine-to-machine capabilities span from smart phones, smart watches, Firms powering the above ecosystems provide ser- and smart televisions, to advanced industrial, ener- vices through the following types of services. gy and agriculture technologies. Tens of billions of devices will be expected to connect to the internet, 1. Infrastructure-as-a-service is the classic cloud empowering MSMEs and addressing social develop- idea which offers access to storage or compu- ment issues such as access to healthcare, water and tational resources (example: Amazon S3 cloud energy management. For example: service or Dropbox online file storage solution). Of the 166 interviewees who addressed data stor- • In Indonesia, smart cities are an integral part of age preferences for their business, 26% are using Indonesia’s Industry 4.0 initiative; consequently, cloud-based storage and 53% are using a hybrid the Indonesian economy’s demand for automa- of cloud and local servers. tion and IoT solutions is increasing significantly. 2. Platform-as-a-service offers users the whole • Singapore launched a USD $2.4 billion IT Invita- platform to build their products or launch their tion to Bid in 2017 and decided that technology services. A typical example is Shopify – an spending would be shifted from infrastructure to e-commerce platform that enables merchants’ digital, data analytics, and smart applications. access to a variety of ecommerce solutions, from setting up a website, managing content and • An interviewee at the Japan Economic Research product categories, to integrating with payment Institute noted: “Although Japan has historically system. been a manufacturing exporter, some of its prod- 3. Software-as-a-service is most popular amongst
37 Exhibit 8 Data Storage Types
Cloud 26%
Hybrid 53%
Local server 21%
0% 20% 40% 60%
MSMEs since businesses of that size are offered The existing ecosystems have already led to the cre- the flexible usage of the software that fits their ation of several new business models such as those needs without being locked into spending re- listed below. sources to build and administer in-house (exam- ple: Google’s email services). • Subscription/freemium business model used in media platforms such as Spotify and Netflix, so- 2.1.2 Digital Ecosystems and Cross-Bor- cial search platforms such as Bumble, or collabo- der Digital Trade: ration platforms such as Slack and Skype; Digital ecosystems enable data-focused businesses to be more agile and adaptive, reducing their burden of • Information business model used in review plat- infrastructure management and IT investment. There- forms such as Glassdoor and Yelp; fore, established businesses can lower their costs and focus on improving internal business processes. • Advertising business model used in search engine Newly founded businesses have lower barriers to platforms such as Google search, or social plat- enter new digital markets, especially outside their forms such as Facebook and LinkedIn, or knowl- domestic market. More importantly, with the flexibility edge platforms such as Lynda; of new plug-in solutions, businesses are shifting from delivering products to outcome-as-a-service driven • E-commerce business model used in e-com- products, which focus on integrating services and merce platforms such as Shopify, or online mar- products into packages (bundled services), providing ketplace such as Amazon marketplace a better experience for customers. • Pay-as-a-service business model used in service Finally, these resourceful and flexible ecosystems exchange platforms such as Uber and Airbnb; provide businesses (especially MSMEs) the opportu- or cloud platform-as-a-service, infrastruc- nities to create new sources of revenue, change their ture-as-a-service, and database-as-a-service business models and disrupt industries. Ecosystems (example: Amazon S3, Microsoft Azure) give access to resources at scale and cross-border trade will gain from ecosystems to increase access for players of all sizes.
38 Development of Cross-border Digital Ecosystems In2.2 addition to variations in regulatory regimes across problem but more importantly lead to growth in economies, there are a number of challenges to cross-border digital trade in the APEC region. creating cross-border digital ecosystems. We group We propose the following three them broadly into the following categories: • Incentivizing large enterprises (to become better • Variation across economies in the state of the actors and active participants in the digital eco- digital ecosystems, system building process), • Variation in the underlying infrastructure • Narrowing knowledge gaps (to enhance trust • Knowledge gaps among the stakeholders amongst all stakeholders), and • Continued investment in physical infrastructure These three factors are closely related and have a (to lower the cost of entry and the cost of opera- bearing on the variation in regulations. Addressing tion for firms of all sizes). these challenges can diminish the “noodle bowl”
Partnering with Large Enterprises 2.3Digital ecosystems require interoperable platforms from connected devices. This infrastructure has to be if they are to enjoy strong network economies. As a developed and supported by large private or public result, we have very large digital firms such as Aliba- entities. ba, Amazon, Ant Financials, Facebook, Google, J.D., Mercado Libre, Rakuten, and SoFi that have significant MLaaS solutions is transforming the way businesses presence in many APEC economies. Besides these apply data to improve their efficiency, enhance prod- digital giants, even within individual economies we uct capabilities, and customer engagement. While are witnessing a concentration of market shares. The MSMEs do not have comparable resources invested Herfindahl–Hirschman Index (“HHI”) is published in data gathering and data storage, large companies by the World Bank and it shows the market power of have access to warehouses, allowing them to lever- the largest corporations within a given economy. The age their strengths to build and train their machine HHI in all APEC economies has increased in the last learning models in-house and offer to external clients decade. The HHI of most APEC economies showed a as MLaaS. Without MLaaS, it would be very chal- downward trend since 1991 until 2011. lenging for MSMEs to develop their own machine learning algorithms and models. However, there are As stated earlier, two emerging trends that will have a some methods to promote MLaaS-driven, cross-bor- major impact on cross-border digital trade are Inter- der data flow as it pertains to MSMEs. Based on our net of Things (IoT) and machine learning as a service interviews, MSMEs are already working on building (MlaaS). machine learning models from public and niche data Internet of Things has tremendous potential for trans- for specific domains. They provide the machine learn- forming industries and society. IoT, however, requires ing models to their clients to plug in clients’ data and a very robust infrastructure to transport, analyze, explore business insights. and act on the enormous amount of data will flow
39 In this field, using big data precepts, Amazon, Google by larger players) within the MLaaS space that could and Microsoft offer a wide range of solutions. The fol- be valuable as recommendations for MSMEs operat- lowing table displays the product offerings (delivered ing within the APEC region:
Natural language AI platforms Speech recognition Computer vision processing
• Amazon Sagemaker • Amazon Polly • Amazon Transcribe • Amazon Rekognition • Azure Machine • Amazon Lex • Azure Bing Speech • Azure Computer Learning Studio • Amazon Translate API Vision API • Google Cloud • Amazon Compre- • Azure Speaker Rec- • Azure Content Mod- Machine Learning hend: NLP ognition API erator Engine • Azure Language Un- • Azure Translator • Azure Custom Vision • Amazon Machine derstanding (LUIS) Speech API Service Learning • Azure Bing Spell • Azure Custom • Azure Face API Check API Speech Service • Azure Emotion API • Azure Web Language • Google Cloud Speech • Azure Video Indexer Model API API • Google Cloud Vision • Azure Text Analytics • Google Dialogflow API API Enterprise Edition • Google Cloud Video • Azure Linguistic Intelligence Analysis API • Azure Linguistic Analysis API • Google Cloud Trans- lation API • Google Cloud Natu- ral Language API
2.3.1 Role for Large Enterprises Large digital firms have an incentive due to networks efforts to support the growth of digital ecosystems in Platforms by definition support interactions among the following ways: large number of enterprises and customers. Thus, 1. Build interoperable transactional infrastruc- platform owners have a natural incentive to improve ture: interoperability and thereby reduce the friction in Transactional infrastructure requires scale and favors cross-border trade. Platforms also benefit by stan- the larger (oftentimes publicly-owned) players. dardizing data flows across economies. In short, Absence of this infrastructure impedes digital trade network economics that results in market concentra- between MSMEs across economies. tion also incents platforms to standardize and make it easier for MSMEs to participate in cross-border digital 2. Create greater access to finance: trade. Lack of access to finances often keeps firms trapped
40 in informal and overcrowded markets. Furthermore, environment. We learned of a great example from the cross-border data flows are impeded by the lack of Australian Securities and Investments Commission’s financial resources for businesses that are attempt- initiative, which established a regulatory sandbox ing to digitize their operations. These conditions are allowing eligible fintech companies to test certain especially true for primary-sector dependent econ- products and services for up to 12 months without an omies that have yet to make the leap into prioritize Australian financial services license or credit license. the digital economy. In our interviews, MSMEs shared their concerns around the lack of capital being de- In addition, some economies have leveraged ‘e-gov- voted to the ecosystem that allows them to thrive. ernment’ to facilitate digital payments and services. In economies with a significant informal sector, the For example, in 2018, Thailand’s Electronic Transac- lack of funding was even more acute. Cross-border tions Development Agency partnered with Omise, a FinTech platforms offer much promise. Japanese blockchain-based start-up, to initiate the National Digital ID project, with the aim to build a na- 3. Incentivizing entry into the formal sector for tional electronic Know Your Customer (eKYC) portal to MSMEs: offer a standardized process to verify users. With that Many MSMEs in developing and emerging markets try initiative, instead of having users physically coming to stay ‘under the radar’ in the informal sector (pri- to e-wallet or e-payment service providers’ offices to marily due to taxation and corruption issues). Incen- verify their identities, e-wallet and e-payment service tives to transition to the formal sector can be made providers can access a shared and trusted database more attractive through large enterprise – economy to verify users. For cross-border partnership, during partnerships, by offering the ability to reach broader ASEAN Finance Ministers and Central Bank Governors product, labor, and financial markets. held in April 2019 in Thailand, eight out of ten ASEAN members agreed on ASEAN Payment Connectivity. 4. Collaborate in creating regulations that are The initiative aims to cut cross-border transaction consistent across economies fees for migrants, tourists and businesses. Krungthai Platforms that lie at the core of ecosystems create Bank of Thailand and Shwe Bank of Myanmar have new business models that transform the nature of also developed a secure, convenient and instant re- digital trade and create new challenges for regulators. mittance service using blockchain platforms. Scale of these firms incents them to shape and abide by regulations. 2.3.2 Mechanisms for Engagement
In this section we briefly comment on some mecha- nisms we observed that facilitate the development of the ecosystems and engage multiple stakeholders.
To facilitate the growth of the FinTech ecosystem, some APEC economies have developed regulatory sandboxes allowing fintech companies to test their products and services in a supportive regulation
41 New Zealand’s Electronic Funds Transfer at Point of Sales: Lessons for large player collaboration
New Zealand’s EFTPos (Electronic Funds Transfer frictionless system that was given away for free to at Point Of Sale) has led to a cashless economy. retailers. Banks clear and settle hourly, which allows Retail banks were able to come together to cre- for real-time banking in New Zealand. EFTPoS’ ate the infrastructure necessary for reducing fees adoption sits at 100% today, with New Zealand for customers, thereby lessening the friction felt emerging as a cashless society (for the most part), in conducting day-to-day transactions. As one with the lowest incidence of cash in circulation per executive from a shipping company in New Zealand capita in the OECD. The executive recommended explained: “In shipping, we have to understand that learning the lessons of EFTPoS to apply to his own we are in the technology business and that we are industry (shipping). To get started, he explained: moving containers around.” When asked further “You’re trying to build a Rolls Royce, when a skate- how data standards affecting his business, he board would do.” He emphasizes the use of elegant explained: “Our master data optimization algo- degradation: “start off with a few variables to get rithms work well for us but a lot of our competitors going.” Our sense in this interview was that for have labor intensive-practices in data gathering.” cross-border data flow-oriented systems to live and He cited the EFTPoS model as the way forward for breathe, larger players can jointly partner to create shipping. infrastructure that reduces their costs and that of the customer. New Zealand’s EFTPoS fits cleanly In EFTPoS’ case, five domestic banks in New into that line of thinking. Zealand came together and took ownership of a
Conversely, in some economies, restrictions or ogies of sensors to address challenges of urbaniza- reservations on foreign payment services have been tion. China also created economic and technological increased. For example, the Financial Supervisory development zones for the digital sector. These zones Services in Korea has advised card issuers to charge encourage both domestic and foreign firms to set up lower annual fees than international card providers, and start operations in the easiest way, overcoming and to give preference to local brands for customers the bureaucratic hassles. Special economic regu- not using international transactions. In 2017, Malay- lations including tax incentives are leading to the sia’s Bank Negara created an Interoperable Credit growth of digital hubs in China’s important cities. Transfer Framework, which required credit transfers These hubs create an opportunity for proactively between banks, other banks, and e-wallet holders to shaping the evolution of ecosystems. be processed in Malaysia via a single payment opera- tor. Similarly, Indonesia, Thailand, and Vietnam have a draft revision to the Tax Administration Law requiring cross-border services providers to process payment through the NAPASS domestic payment gateway in order to enable tax authorities to control the reve- nues. In September 2017, Hong Kong unveiled the first smart city digital hub to leverage the new technol-
42 A World First - Malaysia’s Digital Free Trade Zone Responding to the rise of the digital economy, in ity and reach of Malaysia’s MSMEs, which account a world first, Malaysia has launched a Digital Free for a disproportionately low 37% GDP contribution Trade Zone (“DFTZ”) to capitalize on the vitality despite representing 97% of all businesses. The of its USD $1 billion e-commerce market and to DFTZ will be rolled out in stages commencing in late provide seamless support for MSMEs and innovative 2017 and finalization is expected by 2019. A part of enterprises engaging in cross-border trade. The Alibaba’s Electronic World Trade Platform—which joint initiative with Alibaba Group aims to accelerate will provide SMEs with the commercial infrastruc- e-commerce growth rates from 10.8% to 20.8% by ture for cloud computing, mobile payment, and 2020, and achieve a USD $8 billion e-commerce training—the zone includes a high-tech fulfillment valuation by 2025, leading to the creation of 60,000 warehouse near Kuala Lumpur’s international air- new jobs. The zone focuses on building the capabil- port.
The above examples illustrate the active engagement this index has increased in almost all APEC econo- of governments and regulators in the development of mies. Meanwhile, though the trust in business in- ecosystems. Our interviewees also referred to other creased in 8 out of the surveyed 14 APEC economies, Private Public Partnerships (PPP) in APEC economies. the global public confidence in the big corporations While PPP hold much promise there are also some decreased 16% between 1985 to 2018. What is more, cautionary notes. Some interviewee opined that 69 percent of our interviewees expressed concerns PPPs lead to digital MSMEs being crowded out of the over the preferential treatment received by the large market, innovation being stagnated by public sector enterprises. Large enterprises have an opportunity red tape and specific market actors being favored due to reshape this narrative by engaging with the APEC to stronger ties within the public sector (as compared economies to help build the ecosystems necessary to the best company being picked for a partnership). for greater cross-border data flows that are mutually PPPs favor larger data-oriented businesses that have beneficial. the relationships to leverage their relationships to gain favorable regulatory treatment. In our interviews, we learned of MSME concerns around PPPs becoming the band-aid fix for economies that are under pres- sure to modernize but less willing to make the deep investment into their innovation ecosystem. MSMEs aspiring to transact based on cross-border data flows are being left behind as a result.
In short there appear to be a number of mechanisms already available and in use for engaging large players and shaping ecosystems.
Why act now? The HHI of most APEC economies showed a down- ward trend since 1991 until 2011. In the last decade
43 2.4 Prioritize Narrowing the Multi-Stakeholder Knowledge Gaps In building cross-border data flow-oriented ecosys- lenge in creating regulations: tems, economies must address knowledge gaps, • Understanding what must be regulated at which exist at the regulatory level, the consumer lev- present: el, the MSME level and at the talent acquisition level. The challenge here is to fully understand the impact The following sections outline what our research was of the technology being regulated. This challenge is able to point to with respect to the aforementioned compounded by the differing standards of regulation levels. based on the industry that technology operator is operating in. Furthermore, limited interoperability 2.4.1 Regulatory Knowledge Gap (especially in the physical trade of goods) muddies Challenges: digital transactions because entire supply chains are During our interviews, 80% of interviewees who dis- partially digital. As one MSME CEO of a crowdsource cussed entering new markets noted that the biggest delivery platform explained to us: “Digital seamless- challenge is understanding regulations of other coun- ness does not exist in the physical trade of goods tries. Also, 63% felt MSMEs did not fully recognize since there is not a sophisticated digital supply chain. regulatory requirements to access markets. In fact, It is merely digital in certain parts.” In fact, a FinTech of the 201 interviewees who addressed the regulato- entrepreneur from a smaller APEC economy be- ry knowledge gaps in our interviews, 48% rated the moaned the lack of emphasis on the digital economy: knowledge gap of regulators as high (43% rated it “We have not moved from physical goods paradigm to medium and 9% rated it low). services paradigm.”
In the struggle to regulate technology at the pace at • Predicting what may need to be regulated which it is developing, regulators face a two-fold chal- down the line Technology evolves based on the needs of the market. Exhibit 9 Knowledge Gap (Regulators) Regulators must keep pace with the rate of technol- Low ogy change in order to regulate appropriately. As one 9% APEC regulator claimed: “We lack even the most ba- sic, necessary infrastructure to measure the impacts of e-commerce on the country. We’re essentially fly- ing blind.” This sentiment was widely shared in devel- oping APEC economies where the rate of technology change can be overwhelming and poorly understood. Furthermore, regulators are reacting under time pres- sure and with limited resources at their disposal. High Medium 48% 43% In building cross-border data flow-oriented eco- systems, regulators are challenged especially by platform-based businesses that offer a plethora of
44 services and a rapidly evolving portfolio of products. • Tough to time it In fact, platform-based businesses have economies Technology regulation must be timed for when it is of scale and the nimbleness to compete at different most relevant. Implementation can take a long time levels, in different markets at the same time. Such to institute, by which time it may be obsolete and lead “jurisdictional blurring” creates conundrums such to sub-optimal cross-border data flows; as the challenge in regulating Uber. “Is it a technol- ogy platform that connects users with drivers? Is it • Messy: Plenty of contingencies a car-sharing platform? Is it a cab? Is it a restaurant In order to fully capture the repercussions of a given business, because it delivers food? Oftentimes, the technology on the consumer, regulation must account explicit focus is to find the niche that is not being ex- for the various contingencies that can make it hy- ploited but has the potential for economic profit. The per-specific and general enough at the same time. “niche-entry” strategy becomes the basis for a larger entry strategy once the foothold has been established • Expensive: How best to enforce it such as the case of Netflix providing only DVD rentals Technology regulation mechanisms can prove to be by mail. costly and difficult to enforce. . Business and regula- tors can partner and allow self enforcement in some To keep pace, regulators are experiencing three spe- instance and in other cases if the regulating body has cific challenges: the knowledge and the capabilities they can regulate cross-border data flows directly. 1. How to find the bad actors 2. Monitoring compliance To address these challenges, economies can pro- 3. Speeding up the regulatory processes to better mote legitimate data sharing endeavors. In fact, open serve and protect the public data policies can help create an ecosystem of trust and build on the educational competencies of all the In addition, regulators are increasingly becoming stakeholders involved (a net positive effect seen with responsible for international capacity building as well digital commons). as external capacity building, specifically in educating consumers in instances where their digital rights are What can be done: being infringed upon. To address these challenges, The discussion highlights the importance of regulators there needs to by systematic dialogue between the understanding emerging technologies and business public and private sectors. models. Regulators have the challenge of keeping abreast of these developments while balancing the Consequences: specific interest of their economies. A cross economy The consequences of regulatory knowledge gaps are coordination can mitigate some of the challenges of oftentimes tied to a regulatory overreaction, with a staying abreast. This discussion once again under- single (usually large) company rather than a broader scores the role and importance of proactively engag- application. The focus on data regulation is to open ing with existing platforms and emerging businesses. up competition for early stage, smaller tech compa- nies and yet, we face the following challenges:
45 2.4.2 Consumer Knowledge Gap same survey, 37% of respondents were “concerned that people may end up isolated from one another.” Challenges: In fact, respondents were split over the emergence Consumers tend to fear what they do not know. The of 5G i.e. whether it would improve our lives or create current technology landscape is tethered to implic- just as many problems. Moving on from general con- it opt-ins i.e. you have opted in to your data being cerns about technology, to cross-border data flows, used by the product as part of the terms of service. consumers undervalued the value of their own data Most consumers are not aware of the way their data (approximately USD $250) in a survey conducted by is being used, re-used, re-packaged and re-sold. LoopMe, an advertising agency. Such a knowledge gap breeds fear around personal (and private) data usage, especially when it comes to It should be noted that consumer concerns about pri- identity theft. As one hi-tech entrepreneur explained: vacy and personal data usage vary significantly across “Our consumers are not fully aware of the benefits of economies in the APEC region. There are also differ- cross-border trade. I think that more efforts should ence in financial literacy levels (OECD/INFE Report on be made to educate the principle of this mechanism Financial Education in APEC Economies 2019). These operation to consumers here.” differences also contribute the differences in knowl- edge gaps across the economies. To that end, 161 of our interviewees addressed con- sumer knowledge gaps, with 49% rating these gaps Consequences: as high and 37% rating them as moderate. A consumer knowledge gap feeds into a push to over-regulate cross-border data flows i.e. “It is better Knowledge gaps around cross-border data flows to overregulate than to under-regulate” according permeate how technology in general is perceived by to one of the thought leaders we spoke with. Fur- the general public. In Intel’s “Next 50”, 40% of re- thermore, consumers can sometimes demonstrate spondents expressed fear that “new technologies will a size-bias, pushing for greater regulation towards introduce as many new problems as solutions”. In the digital platforms and letting smaller players get away with less scrutiny. In obverse scenario, data-driven Exhibit 10 Knowledge Gap (Consumers) businesses of all sizes are penalized because the Low regulation is an orphaned measure: it neither serves 14% companies of a large size or of a smaller size. More- over, unsized regulation yields negative outcomes for upstream and downstream partners of the firm being regulated, thereby adding to the cost of doing busi- ness (which is oftentimes passed on to the end-con- sumer). In fact, consumer overreaction can be best described as a desire to tolerate what is peripherally understood until it comes knocking on your door (for High Medium example in the instance digital privacy breaches such 49% 37% as identity theft or the misuse of personal data).
46 What can be done: Of the 221 interviewees who addressed MSME knowl- Building consumer trust through education, collab- edge gaps, 70% perceived these gaps to be high, oration, and open dialogue – APEC economies have highlighting the perils of navigating NTBs as a small several efforts under way to increase financial literacy. player within the digital economy. These efforts in principle can increase knowledge about digital data and business models. Legislative With such challenges in mind, MSMEs are discour- trends in some economies (California Consumer aged from engaging in cross-border data flow in the Privacy Act) to increase customer control of personal following ways: data also presents a non-market threat to larger glob- al platforms. This in turn creates an incentive for the • Poor availability and accuracy of the informa- larger digital platforms to proactively educate their tion being collected. customers. The “absence of digitized public information and 2.4.3 MSME Knowledge Gap digital footprint of MSME transactions, unavailability of data, or poor data quality” makes it difficult for Challenges: MSMEs to engage in cross-border transactions (there- MSMEs face the daunting task of either not having by curtailing the flow of data across borders). As a enough data (given the scale of their business opera- director of a trade association explained to us: “[Our] tions) or collecting data but not knowing how to best MSMEs don’t necessarily realize the importance of use it. The knowledge gap, as it pertains to MSMEs, digital trade. They know the world is changing, but directly impacts MSME participation in building don’t know what it means.” cross-border data flow-oriented ecosystems. As one academic interviewee explained: “Last year, [our] • Difficulty in identifying MSMEs across borders economy tried to educate [our citizens] on GDPR but Inconsistent and non-standardized identification sys- MSMEs do not really have time for knowledge gain.” tems exist in each jurisdiction. For MSMEs to trans- act across borders (especially for APEC economies composed almost entirely of MSMEs), a mismatch of Exhibit 11 Knowledge Gap (MSME) size impedes cross-border data flows. MSMEs must Low be competitive from the get-go as a CEO of a data 9% infrastructure company explained to us: “With small economies, MSMEs need to be born great.” Medium 21% Such challenges inevitably lead data flow-oriented MSMEs to pursue strategies tied to de-risking and conservative entry, which are explained as follows;
• De-risking MSMEs are better served to either walk away from High entering the market (and pick particular markets 70% to focus on) or to offer a lesser developed product within that market. As one Healthcare technology
47 company CEO explained to us: “There is a disincentive data standards across borders favors larger compa- to sell leading edge technology in certain markets. nies. These larger players can use data as a tool for You’re better off selling 2-3 year old commoditized anti-competitive practices, hurting the players within technology.” their own economy and the economy they wish to enter. • Conservative Entry MSMEs will oftentimes enter a market with strictest of Of the 209 interviewees who addressed the un- interpretations of the regulations in place. The down- derstanding of legal requirements for MSMEs, 63% side of the “overly-compliant” entry is that MSMEs will believed that MSMEs did not have the capacity to fully have to devote even more resources to make sure that understand the digital noodle bowl of regulations. they are truly by the book at all times, which adds to the costliness of transacting within that economy. To combat these challenges, MSMEs follow heuris- tics such as the one explained by one MSME-focused Of the 151 interviewees who addressed the logistical investor we interviewed: “It is better to go to same challenges around entering new economies, 47% felt size economy than to go to a bigger economy...it is an that it was difficult to enter new markets as a digital apples to apples jump”. business (30% felt it was somewhat difficult). What can be done: Consequences: • Accelerating to leverage single window for MSMEs are less likely to engage in cross-border data APEC economies flow due to their scale and their own non-digital busi- A good example of this is ASEAN Single Window. ness practices. Their knowledge gap directly feeds Single Window provides the secure IT architecture into MSMEs being “entrapped in smallness”, thereby and legal framework that will allow trade, transport, curtailing cross-border data flows. Moreover, the and commercial data to be exchanged electronically lack of interoperability hits MSMEs hard. Difference in among economies agencies or the trading commu-
Exhibit 12 Logistics Challenges Exhibit 13 MSME Legal Requirement Under- standing Low Low 23% High 63% 19%
Medium 18% High Medium 47% 30%
48 nity. This will expedite the cargo clearance process, talent can short circuit attempts to create cross-bor- reduce cost and time of doing business, and enhance der data flow-oriented ecosystems. A lack of local ca- trade efficiency and competitiveness (APEC, 2018). pacity slots the market entrant into the foreign player role, which can be especially challenging given the • Upskilling MSMEs technologically “penalty of foreignness” that the entrant has to incur. Ensure firms are not disadvantaged in the business Such a penalty is further compounded in areas where environment based on their size (and recognize that there are local hiring rules (“You must hire one local while a law, regulation or procedure may appear neu- manager”) and the entrant is forced to provide older tral, it can have very different effects on firms of -dif technology in order to meet the high cost of entry. As ferent sizes). The vast majority of the MSMEs that we one entertainment-focused startup CEO explained: interviewed use at least one major platform for selling “[Our] biggest challenge in setting up in developing their goods and services. These platforms provide a countries is finding talent, specifically well-educat- multitude of services from web hosting to pricing to ed, experienced people that you can trust.” In fact, advertising and are integral to their success. A lack of a recent survey for Southeast Asia MSMEs by Ernst & clarity regarding advertising benefit relative to cost, Young shows that among the top five hindrances to the need to pay for advertising to move even minimal impact digital successes are the lack of access to dig- product due to algorithmic prioritization, and a lack ital experts (64.7%) and difficulties for existing staff of business data can hamstring these businesses and to reskill and transition toward a digital-first culture lock them into the tech platforms. Economies can aid (62.5%). MSMEs gain access software that will allow them to monitor basic processes such as ordering, inventory, Of the 187 interviewees who addressed the economy SKUs, and basic predictive analytics so that these level support for technical education, 60% felt that businesses are able to compete with entirely online support was low in terms of accessing a digitally-sav- businesses. This incentivizes MSMEs to partner with vy talent pool (with 31% stating that the economy was larger platforms in order to drive analytics, without somewhat supportive). locking MSMEs into their smaller size. 2.4.4 Talent Acquisition Knowledge Exhibit 14 Gap Digital Talent Shortage Challenges: Not Agree Enterprises need to foster and acquire digitally skilled 14% Agree 86% talent and economies ought to support them by creating special programs. Of the 133 interviewees queried regarding digital talent shortage, 86% re- sponded that digital talent shortage discouraged the cross-border data flow of their business.
The talent acquisition gap has been perpetuated by decades of underinvestment in STEM programs within certain economies. Such a shortage of tech-savvy
49 lead economies to push for “local manager” rules in Exhibit 15 Government Support for Education an attempt to upskill the local workforce. However, High these measures end up serving as NTBs since interop- 9% Low 60% erability issues emerge: Standardization of data prac- tices between the home country unit and the foreign venture unit require significant capacity-building at the local level. If the local workforce is not trained on how data-driven a given business unit must be, more cost is incurred to set up oversight and to be compli- ant with hiring quotas. In the absence of such oner- ous investments, especially for MSMEs, sub-optimal cross-border data flows are the resultant effect. Medium 31% What can be done: Consequences: • Entrepreneurship A shortage of local talent discourages business- The talent acquisition gap can be narrowed by de- es (especially MSMEs) from entry in certain APEC signing and implementing national entrepreneurship economies, where the necessary capacity-building policies and programs, which include support for investments have not been made for businesses to entrepreneurship education, finance, innovation, and enter and scale. Specifically, low investments in STI culture, and are mostly focused on entrepreneurial (Science, technology and innovation) focused educa- start-ups. Based on our interview data, of 132 inter- tional infrastructure has led to low enrolment rates in viewees who spoke about entrepreneurship within higher education within the STI field. Such conditions their respective economies, 43% felt that it was dif- have yielded an inadequate pool of skilled labor that ficult to start a digital business within their economy can staff data-oriented enterprises, especially for (with 31% believe that it was somewhat difficult). MSMEs looking to hire locally.
Moreover, understaffing by foreign entrants can also Exhibit 16 Entrepreneur Friendly lead economies to push for “local manager” rules in Difficult an attempt to upskill the local workforce. However, Straightforward 43% 26% these measures end up serving as NTBs since interop- erability issues emerge: Standardization of data prac- tices between the home country unit and the foreign venture unit require significant capacity-building at the local level. If the local workforce is not trained on how data-driven a given business unit must be, more cost is incurred to set up oversight and to be compli- Somewhat ant with hiring quotas. In the absence of such oner- Difficult ous investments, especially for MSMEs, sub-optimal 31% cross-border data flows are the resultant effect.
50 • Digital Skills Common Certificate lack of training regarding basic financial education, Although some certificates are operated by private data analytics, stock managements, and logistics, as enterprises, there is no internationally common well as compliance best practices. Economies need public certification for digital skills. It is apparent for to spend more time focusing on empowering their future economy to depend on technologies further, smallest businesses to succeed for the future if the so this certificate will give people motivation to learn goal is to create real, lasting economic development digital skills. Interviewees consistently mentioned the going forward
Build Out the Physical Infrastructure 2.5Through almost 300 interviews conducted, 21% of strong network for delivering goods in addition to the respondents identified infrastructure as their top connecting people among the regions. In addition, pain point. As identified by a Korean Professor who is energy connectivity is the foundation for internet a researcher in economic policy, “One issue for free access and establishes the backbone for digital trade data flow for some developing countries is physical both domestically and cross border. infrastructure. [We] have to invest a huge amount of money to create [it]. So free isn’t ‘free’ – [we] have 2. Growth to have infrastructure.” The Vice President of a large Investment in physical infrastructure leads to eco- technology company in China expressed that “the nomic growth that creates jobs, enables households infrastructure in China is developing very quick and, to access economic opportunities, and allows econ- in fact, rather advanced even compared to developed omies as well as the private sector to provide essen- countries.” tial services, which all contribute to improved living standards. Edquist’s study suggests a 10% increase There is still a noticeable disparity among the APEC in mobile broadband penetration may lead to a 0.6 – region in terms of electricity, internet access, internet 2.8% increase in GDP, but not vice versa. speed and data storage. Physical infrastructure is critical to building out rich, digital ecosystems. 3. Innovation In competitive markets, private companies contin- Some of the more obvious reasons would be that the uously introduce innovation to outperform peers. In extent of digital economy is very much reliant on the non-competitive markets, disruptive technologies availability of physical infrastructure. Below are five such as next- generation broadband or alternative additional drivers tied to a well-established physi- transmission can reduce the historical high fixed cost cal infrastructure needed to facilitate the creation and therefore deliver better quality services at an of thriving ecosystems that encourage cross-border affordable price. digital trade (APEC Economic Committee, 2018): 4. Prevention 1. Connectivity Physical infrastructure needs to be able to survive Traditional transportation infrastructure such as natural disasters, minimizing the interruption to highway, rail and airports are essential, particularly connectivity. Depending on the unique geographic lo- for e-commerce which needs to be supported by a cation, economies have taken different approaches to
51 be crisis ready, such as Brunei Darussalam for floods, Peru) have yet to achieve 100% electricity access. The Japan for tsunamis, Canada for climate change, and challenge for bringing electricity to the rural areas is New Zealand for earthquakes. often correlated with low population concentration in villages, therefore the high cost per capita for installa- tion, and justification for commercialization. 5. Maintenance The ability to avoid deterioration of existing physical However, such initiatives have precedents. In No- infrastructure is just as important as building new vember 2018, a joint effort to aid Papua New Guin- infrastructure. Developed economies such as Canada ea’s electrification was led by Australia, Japan, New plan to harmonize asset management standards, and Zealand and the US. Set in 2010, the goal focused on Japan is developing maintenance cycles to reduce delivering reliable electricity access to 70% of Papua New Guinea’s population by 2030 (White House, costs. 2018). Based on a 2016 figure, Papua New Guinea’s electrification sat at 13%. Having considered these factors, let us take a closer look at how greater investment in electricity, inter- Blackouts: net access and speed can enable the creation of rich Along with achieving 100% access to electricity, cross-border data flow-oriented ecosystems. ensuring reliable access is another critical priority. The Vice President of a listed Chinese data storage 2.5.1 Upgrade Electricity Grid company shared during our conversation that “2% of Of the interviewees that addressed electricity, only the national electricity was consumed by data cen- 5% view electricity as a barrier for doing business. ters. One of the biggest challenges to data centers are power outage. Utility expenses is the single biggest Such responses might speak to major progresses that operating costs. We have multiple backup generators have been made to ensure access to electricity. on site. In one incident, the backup generators were operating for a month due to power shortage.” Such Except for Papua New Guinea and the Philippines, shortages impede cross-border data flow because all APEC economies have 100% electricity access they raise the cost of service for data storage. for urban population. However, for rural population, three additional economies (China, Indonesia and Two key indexes that measure electricity blackouts Exhibit 17 are the system average interruption duration index Electricity availability (SAIDI) and the system average interruption frequen- cy index (SAIFI). SAIDI measures the duration of an Moderate concern High concern outage while SAIFI records the frequency during the 3% 4% year. Across APEC, end-users experienced an aver- age interruption of 4.7 hours, and 3 interruptions to their electricity service in 2018. Papua New Guinea experienced the longest electricity interruption of 83.7 hours and 54 occurrences (World Bank Doing Busi- ness, 2019).
Electricity outage is certainly not unique to only one economy and it can be caused by a variety of reasons: outdated facilities, human error, natural disasters Low concern and etc. In a conversation with a technology consul- 93% tant in Mexico, the interviewee noted that “internet
52 % Access to Electricity % Urban Population % Rural Population World Bank Data 2013 2017 2013 2017 2013 2017 China 100.00 100.00 100.00 100.00 99.97 99.97
Chile 99.60 100.00 99.80 100.00 100.00 100.00
Indonesia 96.46 98.14 99.67 100.00 93.06 95.66
Malaysia 99.94 100.00 100.00 100.00 99.79 100.00
Papua 34.90 54.43 75.49 81.03 28.84 50.42
New Guinea
Peru 92.14 96.36 98.78 100.00 69.91 83.68
Philippines 87.50 93.00 94.10 96.40 81.90 90.02
Thailand 99.88 100.00 99.70 100.00 100.00 100.00
Vietnam 99.87 100.00 100.00 100.00 99.81 100.00
Mexico 99.51 100.00 99.74 100.00 98.64 100.00
access and electricity are unreliable in some areas in Mexico. Some companies open servers or offices in different locations to mitigate this risk. For example, sometimes a storm may cause a blackout, so servers become inoperable.”
53 Mexican Technology and Travel Services Case Study Firms in Mexico face challenges with internet ac- tially increasing their operational costs and dimin- cess because the infrastructure in some regions are ishing their ability to compete in the market.” susceptible to blackouts or lack adequate infra- structure to reliably provide internet access. For Although their operations did not heavily rely on instance, a cybersecurity executive of a technology cross-border data transfers, this case study illus- and travel services firm in Mexico shared challenges trates the challenges some firms in APEC face in or risks they have faced and how the mitigation to terms of reliable internet access. What are the im- these risks have increased their operational costs: plications for data centers that transfer cross-bor- der data? How can MSMEs focus on innovation “To meet the needs of their customers, they are when much of their efforts are invested in mitigating required to provide consistent and reliable custom- infrastructure risks? er service in terms of call centers and local server storage. However, they have experienced blackouts Thus, it is critical to have funding dedicated to en- or inability to access the internet to provide such suring physical infrastructures are well-maintained services especially during periods of excessive heat and up-to-date. Meanwhile, economies also need or subsequent to natural events, such as storms, to diversify the sources of electricity to strengthen earthquakes, and hurricanes. Consequently, to mit- cross-border data flow by ensuring minimum inter- igate this risk, they had to open multiple server and ruption and improved reliability. call center locations throughout Mexico, substan-
Affordability parison to electricity, access to internet is even more Economies need to ensure the affordability of elec- widely spread across the APEC region. According to tricity to households and businesses since on aver- the World Bank’s DataBank, in 2017, South Korea has age, electricity cost can make up about 30% of the the highest number of internet users with 95% of cost of doing business. Making electricity affordable its total population having used internet in the last would empower data-driven MSMEs to actively en- 3 months, and the lowest is Papua New Guinea with gage as participants of cross-border data flow-orient- 11% of its total population having access to internet ed ecosystems. Exhibit 18 Internet Access Within the APEC economies, however, there is a huge High concern difference in terms of affordability. While the real 8% dollar paid for electricity range only from USD $0.08 to USD $0.30, economies such as China and Japan Moderate have the lowest cost of electricity, when calculated as concern 18% a percentage of income per capita, reporting close to 0%. 2.5.2 Increased Internet Access
From the interviews conducted, only 26% of the respondents view access to internet as a barrier for doing business. 8% of the respondents reflected that Low concern it is burdensome to obtain access to internet and it is 74% a detriment to the growth of their business. In com-
54 (World Bank DataBank, 2019). speed of cross-border data flow within the APEC region. At present, these subscriptions remain low We see that developing economies has significant- in comparison to mobile subscriptions. For develop- ly lower internet users in comparison to developed ing economies, infrastructure for fixed broadband is economies. A Peruvian official shared their struggle yet to be delivered to expand the coverage, and the with us during the interview, “There is huge gap be- monthly fee is yet to become more affordable. Access tween cities, highland and jungle. Internet infrastruc- remains varied across the region: South Korea being tures are not good enough in highland and jungle, the highest (42 fixed broadband subscriptions per while people in Lima don’t see that is a problem. Lima 100 people) and Papua New Guinea being the lowest has 1/3 of the population, seaports and international (0.22 fixed broadband subscriptions per 100 people) airports are only located near Lima.” An executive of (World Economic Forum, 2016). a Chilean consulting firm echoed the same concern that “internet connectivity is also the barrier for Chile. Nevertheless, a well-developed broadband is the Internet highway cable concentrate on the northern backbone of building cross-border data flow-oriented part of the hemisphere. Large companies invest main- ecosystems. Since there is no one-size fits all, each ly in these areas.” 50% of the APEC economies have economy must account for economy-specific barriers less than 80% of total population using the internet. for establishing physical infrastructure. In economies However, just within the last five years, with policy such as Peru, the inaccessibility of physical geograph- initiatives, Indonesia and Papua New Guinea both ic location and the low population in rural areas can have experienced the greatest percentage change of be a barrier to the commercial expansion of broad- 116% and 120% respectively. Yet, due to the nature of band services (ABAC, 2018). Indonesia’s geographic location with 17,000 islands, providing internet access to the entire population However, these challenges can be surmountable with remains a challenge. a sustained commitment to improving cross-border data flows. For example, Singapore came up with a Mobile model that worked for its geographically compact, Cross-border data flow within the APEC region is also low-lying high-income economy. Singapore under- deeply affected by the usage of mobile devices. The stood that in order to sustain multiple wholesale percentage increase for individuals using the internet carriers, the high capital costs of building fixed-lined has contributed to the increased cost of mobile cel- broadband networks needed to be split. To devel- lular subscriptions. Among all the modes of internet op physical infrastructure, rights were awarded to a access, mobile has undoubtedly the highest penetra- Passive Infrastructure Company, and an Active Infra- tion. The highest mobile cellular subscriptions among structure Company handled the bandwidth services. the APEC region are in Hong Kong (250 subscriptions By ensuring these two types of companies operate per 100 people). Even the lowest, Papua New Guinea, separately, Singapore has positioned itself to benefit has 48 subscriptions per 100 people. from increased cross-border data flows (ABAC, 2018).
Looking at network coverage and the affordability of In addition, internet tariffs also affect the creation of mobile services, measured with purchasing power cross-border data flow-oriented ecosystems when it parity (PPP) for each economy, we notice that Hong comes to broadband access. Fixed broadband inter- Kong has the lowest prepaid mobile cellular tariffs, at net tariffs are much higher in comparison with Prepaid USD $0.02/min. In contrast, Philippines has the high- mobile cellular tariffs. With a greater range within the est at USD $0.40/min (World Economic Forum, 2016). APEC region, Malaysia has the highest of USD $60.97 per month, where Vietnam has the lowest of only USD Broadband $2.59 per month (World Economic Forum, 2016). Fixed broadband subscriptions directly affect the
55 Individuals using the Mobile cellular sub- Fixed broadband Economy Internet scriptions subscriptions (% of population) (per 100 people) (per 100 people)
2013 2017 % 2013 2017 % 2013 2017 % Korea, Rep. 84.77 95.10 12.18% 108.99 124.86 14.56% 37.35 41.58 11.32% Brunei Darussalam 64.50 94.87 47.08% 115.55 127.07 9.96% 6.79 9.61 41.52% Canada 85.80 92.70 8.04% 80.44 86.54 7.58% 34.31 38.02 10.82% Japan 88.22 90.87 3.01% 115.26 135.54 17.60% 28.77 31.79 10.50% New Zealand 82.78 90.81 9.70% 105.50 136.00 28.91% 29.13 33.64 15.48% Hong Kong SAR, China 74.20 89.42 20.51% 237.43 249.76 5.19% 31.27 36.09 15.42% Australia 83.45 86.54 3.70% 107.73 112.69 4.60% 25.84 32.40 25.41% Singapore 80.90 84.45 4.38% 157.40 146.82 -6.72% 27.86 25.85 -7.21% Chile 58.00 82.33 41.94% 135.49 127.46 -5.93% 13.14 16.94 28.91%
Malaysia 57.06 80.14 40.46% 144.77 133.88 -7.52% 9.89 8.50 -14.09% Russian Federation 67.97 76.01 11.83% 152.02 157.86 3.84% 16.54 21.60 30.63% United States 71.40 75.23 5.37% 98.47 120.69 22.57% 30.43 33.85 11.23% Mexico 43.46 63.85 46.92% 87.12 88.52 1.61% 10.40 13.28 27.64% Philippines 48.10 60.05 24.86% 104.41 110.40 5.73% 2.61 3.24 24.02%
China 45.80 54.30 18.56% 88.89 104.28 17.32% 13.66 27.97 104.71% Thailand 28.94 52.89 82.76% 137.72 176.03 27.82% 7.62 11.89 56.04%
Vietnam 38.50 49.57 28.75% 135.23 125.62 -7.11% 5.63 11.80 109.47% Peru 39.20 48.73 24.31% 97.47 120.98 24.12% 5.28 7.18 36.12%
Indonesia 14.94 32.29 116.15% 124.28 164.85 32.64% 1.29 2.35 82.49% Papua New
Guinea 5.10 11.21 119.79% 39.51 48.70 23.25% 0.15 0.22 46.58%
56 Secure Internet Servers sum of the capacity of all Internet exchanges offering Another aspect of internet access would be to have international bandwidth, for the APEC economies. The access to a secure internet server. Secured serv- spread among economies is noticeably wide. ers are critical when there is an increasing trend of e-commerce and transactions done online. Secured The table below shows the difference between mobile servers use additional protocols for data encryption and fixed broadband internet speed, as well as the and decryption to protect data from unauthorized difference between download and upload. The global interceptions such as cyber-attacks and identify average for mobile download is 27.69 mbps, and thieves. fixed broadband download is 63.85 mbps. Within APEC regions, Korea has the fasted mobile download Considering each of the APEC economy’s number with 97.33 mbps, and Singapore has the fastest fixed of internet servers, research of World Bank shows broadband download with 191.93 mbps. that even though the US has the greatest number of secure internet servers, with over 21 million serv- Understandably, the majority of the internet speed ers, Singapore has the most servers per one million increases are occurring within the developed econo- people, with almost 85,000 (World Bank DataBank, mies, where physical infrastructure for internet access 2019). Part of the reason being that Singapore is the is less of an issue. top destination for data storage for many developing economies. 2.5.3 Enhance internet speed
From the interviews conducted, 28% of the respon- dents view internet speed as a barrier for doing busi- ness. Moreover, 8% of the respondents reflected that it is burdensome to get fast internet connection and it is detriment to the growth of their business.
The World Economic Forum’s 2016 report outlines the international Internet bandwidth, which is the
Exhibit 19 Internet Speed High concern 8%
Moderate concern 20%
Low con- cern 72%
57 Conclusions The3 digital world is evolving extremely rapidly. Forums works. As such, education for policymakers will such as the APEC Business Advisory Council, as well be needed to design a pragmatic framework, and as many other stakeholders in the region, are well businesses will need to understand the incentives aware of the vast contributions that the digital econ- of adopting the new approach. It is also imperative omy has already made to international trade. When that this interoperable system is kept up-to-date with used effectively, digital trade and data can bridge technological advances. inequality gaps and enhance lives across economies. In the right environment, a wide assortment of groups In creating a high-functioning APEC-wide digital econ- from MSMEs to large enterprises stand to benefit from omy, it is clear that having a consistent and standard- digital trade (APEC, 2019). The primary goal of this re- ized framework is an important foundation. However, search was to learn about non-tariff barriers impeding one of the challenges with regulatory frameworks is cross-border digital trade and data flows. Towards that they tend to be ad-hoc and reactionary attempts this end, we conducted 353 interviews with execu- to adapt to the business and technological environ- tives, regulators, academics, and thought leaders in 21 ment. Certainly, this has been the case with CBPR and APEC economies. GDPR, and will be the case with any future versions of them. Yet, one emergent concept we discovered A majority of the interviewees identified variations in during our research may be a way to respond more regulations between economies, or the “noodle bowl” proactively to technological advances, while achieving effect, as a major impediment to cross-border data organic and multi-dimensional growth – transforming flows. Addressing this problem requires a coordinated the digital economy into an ecosystem. effort across economies. Harmonizing regulation will require carefully navigating differences in cultures, We identified key elements of a cross-border digital political philosophies, and economic priorities among ecosystem and its benefits. We see an ecosystem has the APEC economies. Coordination will also have to potential to align incentives of multiple stakeholders take into account differences in infrastructure. and lead to growth and consistency in regulatory regimes across the APEC region. Developing this Developing a brand-new regulatory framework for ecosystem will require collaborating with large global the APEC region appears to be an unrealistic goal. and domestic firms that are developing and growing Instead, our interview findings suggested that it would digital platforms. In parallel, there is a need to fill be prudent to try and find interoperability between knowledge gaps among regulators, MSMEs, and con- the top two existing regulatory frameworks for data sumers. A final critical piece to growing the ecosys- flow: CBPR and GDPR. Consequently, we propose two tem is investments in infrastructure. alternative approaches, each with their own pros and cons. In the first approach, CPBR would be enhanced to create a regulatory regime that reduces trade fric- tion. The second approach would be to move towards GDPR, a more restrictive framework, but one that several enterprises across APEC are already conform- ing to.
Whether a binding regulated (GDPR-like) or mid- dle-ground approach (CBPR) is chosen, it is vital we avoid a future where individual economies, or frag- mented FTAs, create their own standalone frame-
58 Appendices Appendix I: Economy Summaries 60
Appendix II: Glossary 81
Appendix III: Bibliography 82
59 60 60 61 61 62 62 63 63 64 64 65 65 66 66 67 67 68 68 69 69 70 70 71 71 72 72 73 73 74 74 75 75 76 76 77 77 78 78 79 79 80 80 Appendix II: Glossary
ABAC APEC Business Advisory Council APEC Asian-Pacific Economic Cooperation CBPR Cross-Border Privacy Rules CCPA California Consumer Privacy Act CPTPP Comprehensive and Progressive Agreement for Trans-Pacific Partnership Digital Tax Taxation of digital goods FTA Free Trade Agreements FTC Federal Trade Commission G20 International forum for the governments and central bank governors from 19 countries and the European Union GATS General Agreement on Trade in Services GDPR General Data Protection Regulation HIPPA Health Insurance Portability and Accountability Act ISO International Organization for Standardization LE Large Enterprise MSME Micro, Small and Medium Enterprise NAFTA North American Free Trade Agreement NGO Non-Governmental Organization NTB Non-Tariff Barrier NTM Non-Tariff Measure PIPA Personal Information Privacy Act Privacy Shield Framework for regulating transatlantic exchanges of personal data for commercial pur- poses between the European Union and the United States USMCA United States-Mexico-Canada Agreement WTO World Trade Organization
81 81 Appendix III: Bibliography
APEC (2018). GDPR and CBPR: Reconciling Personal Data Protection and Trade. Retrieved from https://www. apec.org/Publications/2018/10/GDPR-and-CBPR---Reconciling-Personal-Data-Protection-and-Trade
APEC (2018). Study on Single Window Systems’ International Interoperability. Retrieved from https://apec.org/ Publications/2018/08/Study-on-Single-Window-Systems-International-Interoperability
APEC (2019). APEC at 30: A Region in Constant Change. Retrieved from https://www.apec.org/Publica- tions/2019/05/APEC-Regional-Trends-Analysis---APEC-at-30
APEC (2019). Fostering an Enabling Policy and Regulatory Environment in APEC for Data-Utilizing Businesses. Retrieved from https://www.apec.org/Publications/2019/07/Fostering-an-Enabling-Policy-and-Regulatory-En- vironment-in-APEC-for-Data-Utilizing-Businesses
APEC (2017). Facilitating Digital Trade for Inclusive Growth. Retrieved from https://www.apec.org/Publica- tions/2017/04/Facilitating-Digital-Trade-for-Inclusive-Growth-Key-Issues-in-Promoting-Digital-Trade-in-APEC
ASEAN (2012). Framework on Digital Data Governance. Retrieved from https://asean.org/stor- age/2012/05/6B-ASEAN-Framework-on-Digital-Data-Governance_Endorsed.pdf
Asia Cloud Computing Association (2018). Cross-border Data Flows: A Review of the Regulatory Enablers, Blockers, and Key Sectoral Opportunities in Five Asian Economies: India, Indonesia, Japan, the Philippines, and Vietnam. Retrieved from https://www.asiacloudcomputing.org/research/2018-research/2018-the-economics- of-data-flows-in-asia-pacific
BSA (2018). 2018 BSA Global Cloud Computing Scorecard. Retrieved from https://cloudscorecard.bsa. org/2018/
BSA (2019). Advancing Digital Trade – An Agenda for Accelerating Economic Growth and Innovation. Retrieved from https://www.bsa.org/files/policy-filings/05072019bsa_advancingdigitaltradeagenda.pdf
Castro, D. & McQuinn, A. (2019). The Costs of an Unnecessarily Stringent Federal Data Privacy Law. Retrieved from https://itif.org/publications/2019/08/05/costs-unnecessarily-stringent-federal-data-privacy-law
Centre for Information Policy Leadership (2017). Japan’s New Data Privacy Regime and How it Will Enable
82 Cross-Border Data Flows, Innovation and Privacy Protections in the Modern Information Age. Retrieved from https://www.informationpolicycentre.com/uploads/5/7/1/0/57104281/final_cipl_japan_workshop_slide_ deck_10_may_2017-cc.pdf
CIPE (2018). How can Southeast Asia Galvanize E-commerce? Retrieved from https://www.cipe.org/ blog/2018/06/01/how-can-southeast-asia-galvanize-e-commerce/
Congressional Research Service (2019). Digital Trade and U.S. Trade Policy. Retrieved from https://fas.org/sgp/ crs/misc/R44565.pdf
Congressional Research Services (2019). Data Flows, Online Privacy, and Trade Policy. Retrieved from https:// fas.org/sgp/crs/row/R45584.pdf
Corey, N. (2017). Cross-Border Data Flows: Where Are the Barriers, and What Do They Cost?. Retrieved from http://www2.itif.org/2017-cross-border-data-flows.pdf
Crowell & Moring LLP (2018). Benefits of the APEC Cross-Border Privacy Rules. Retrieved from https://www. crowell.com/files/20181001-Benefits-of-CBPR-System%20Guide_Oct%202018_final.pdf
DLA Piper (2019). Data Protection Laws of the World. Retrieved from https://www.dlapiperdataprotection.com
ECIPE (2014). The Costs of Data Localisation: A Friendly Fire on Economic Recovery. Retrieved from https://eci- pe.org/publications/dataloc/
ECIPE (2017). China’s technology protectionism and its non-negotiable rationales. Retrieved from https://ecipe. org/wp-content/uploads/2017/06/DTE_China_TWP_REVIEWED.pdf
ECIPE (2018). Digital Trade Restrictiveness Index. Retrieved from https://ecipe.org/dte/dte-report/
ECIPE (2018). The Geopolitics of Online Taxation in Asia-Pacific – Digitalisation, Corporate Tax Base and The Role of Governments. Retrieved from https://ecipe.org/publications/the-geopolitics-of-online-taxa- tion-in-asia-pacific/
Ferencz, J. (2019). The OECD Digital Services Trade Restrictiveness Index. Retrieved from https://doi. org/10.1787/16ed2d78-en
83 G20 (2019). G20 Osaka Leaders’ Declaration. Retrieved from https://g20.org/en/documents/final_g20_osa- ka_leaders_declaration.html
Harris, J. (2018). Why CBPR recognition in the USMCA is a significant development for privacy. Retrieved from https://iapp.org/news/a/why-cbpr-recognition-in-the-usmca-is-a-significant-development-for-privacy/
IAPP (2017). Global 500 companies to spend $7.8B on GDPR compliance. Retrieved from https://iapp.org/ news/a/survey-fortune-500-companies-to-spend-7-8b-on-gdpr-compliance/
KMPG (2017). Retail payments in Indonesia. Retrieved from https://assets.kpmg/content/dam/kpmg/id/ pdf/2017/01/id-retail-payments-in-indonesia.pdf
Kuner, C. (2011). Regulation of Transborder Data Flows under Data Protection and Privacy Law: Past, Present and Future. Publishing. Retrieved from http://dx.doi.org/10.1787/5kg0s2fk315f-en
Lovelock, P. (2018). Digital Trade: A Review of Trade Policy Dialogues and an Assessment of Where We Stand. Retrieved from http://mddb.apec.org/Pages/search.aspx?setting=ListMeeting&Dat- eRange=2018/05/01%2C2018/05/end&Name=Trade%20Policy%20Dialogue%20on%20Digital%20Trade%20 2018
Lund & Manyika (2016). How Digital Trade is Transforming Globalisation. Retrieved from http://e15initiative.org/ wp-content/uploads/2015/09/E15-Digital-Lund-and-Manyika.pdf
McKinsey Global Institute (2016). Digital Globalization: The New Era of Global Flows. Retrieved from https:// www.mckinsey.com/business-functions/digital-mckinsey/our-insights/digital-globalization-the-new-era-of- global-flows
McKinsey & Company (2017). Reinvention through digital. Retrieved from https://www.mckinsey.com/~/media/ McKinsey/Business%20Functions/McKinsey%20Digital/Our%20Insights/Digital%20McKinsey%20Insights%20 Number%201/Digital%20McKinsey%20Insights_Issue%201.ashx
Meltzer (2015). A New Digital Trade Agenda. Retrieved from http://e15initiative.org/wp-content/up- loads/2015/09/E15_ICTSD_Main_Report_Policy_Options_Sustainable_Global_Trade_Investment_System_re- port_2016_light.pdf
Meltzer, Joshua & Peter Lovelock (2018). Regulating for a Digital Economy: Understanding the importance of
84 cross-border data flows in Asia. Retrieved from https://www.brookings.edu/research/regulating-for-a-digi- tal-economy-understanding-the-importance-of-cross-border-data-flows-in-asia/
METI (2018). White Paper on International Economy and Trade 2018. Retrieved from https://www.meti.go.jp/ english/report/data/gIT2018maine.html
NZIBF (2019). Submission to the Ministry of Foreign Affairs and Trade Consultations on E-Commerce. Re- trieved from http://www.tradeworks.org.nz/wp-content/uploads/2019/04/Submission-to-MFAT-E-commerce- March-2019.pdf
OECD (2018). Digital Trade and Market Openness. Retrieved from http://www.oecd.org/officialdocuments/pub- licdisplaydocumentpdf/?cote=TAD/TC/WP(2018)3/FINAL&docLanguage=En
OECD (2019). Programme of Work to Develop a Consensus Solution to the Tax Challenges Arising from the Dig- italisation of the Economy. Retrieved from https://www.oecd.org/tax/beps/programme-of-work-to-develop-a- consensus-solution-to-the-tax-challenges-arising-from-the-digitalisation-of-the-economy.pdf
OECD (2019). Trade and Cross-Border Data Flows. Retrieved from http://www.oecd.org/officialdocuments/ publicdisplaydocumentpdf/?cote=TAD/TC/WP(2018)19/FINAL&docLanguage=En
SIIA (2018). Data Flow Promotion In International Agreements and National Laws. Retrieved from http://www. siia.net/Press/SIIA-Data-Flows-Paper
United States International Trade Commission (2017). Global Digital Trade 1: Market Opportunities and Key For- eign Trade Restrictions. Retrieved from https://www.usitc.gov/publications/industry_econ_analysis_332/2017/ global_digital_trade_1_market_opportunities_and.htm
USC Marshall (2008). Non-Tariff Barriers to Trade in the APEC Region. Retrieved from https://www2.abaconline. org//content-type/browse-docs/1017
USC Marshall (2015). Driving Economic Growth Through Cross-Border E-Commerce in APEC: Empowering MS- MEs and Eliminating Barriers. Retrieved from https://www2.abaconline.org//content-type/browse-docs/1017
The World Bank (2017). Helping small businesses handle insolvency. Retrieved from https://www.worldbank. org/en/news/feature/2017/06/28/helping-small-businesses-handle-insolvency-world-bank-group-report-in- solvency-treatment
85 World Economic Forum (2015). Why global trade laws need to catch up with digital commerce. Retrieved from https://www.weforum.org/agenda/2015/10/why-global-trade-laws-need-to-catch-up-with-digital-commerce/
World Trade Organisation (2018). World Trade Report 2018: The Future of World Trade: How digital technol- ogies are transforming global commerce. Retrieved from https://www.wto.org/english/res_e/publications_e/ wtr18_e.htm
86 87 APEC Business Advisory Council University of Southern California, Marshall School of Business February 2020
88