Washington puts Korea's public-sector cloud program on its list of trade demands

Two of the four Korean rules on the U.S. demand list govern where data is physically allowed to sit. They are the requirements for transferring location data and personal information overseas, and the Cloud Security Assurance Program for public-sector cloud ^[11]. The other two, legislation on network usage fees and the rules on online platform monopolies, change what a vendor pays and how it is allowed to rank and behave ^[1].

Korea's transfer restrictions sit in the Personal Information Protection Act. The Seoul Economic Daily column describes that as a legitimate exercise of sovereignty over an individual's right to control their own information. For U.S. companies running globally distributed data centres, the same rules mean excessive compliance costs and service constraints ^[3].

The deeper mismatch is about timing. The U.S. prefers after-the-fact monopoly enforcement built on antitrust suits and court rulings, while Korea has adopted a European-style model of prior regulation, which the column says makes conflict difficult to avoid ^[4]. A vendor feels that difference as a clearance step before launch instead of a lawsuit years later.

The discrimination, on the column's account, arrives through the numbers. Rules keyed to quantitative thresholds such as revenue or user counts end up concentrating U.S. big tech companies such as Google and Meta among the targets even where domestic and foreign firms are not formally distinguished ^[12].

The enforcement example is a large domestic e-commerce platform owned by a U.S. parent. The Fair Trade Commission and the Personal Information Protection Commission referred it to prosecutors in succession over alleged manipulation of product search rankings and a massive leak of personal data, and it was then fined heavily ^[5]. The company goes unnamed in the column, as do the fine amounts. U.S. investors and lawmakers treated the action as discriminatory regulation of a foreign-owned company ^[6]. The U.S. side turned due-process complaints into trade issues, citing simultaneous administrative investigations by multiple agencies, the absence of attorney-client privilege, and a lack of proportionality in calculating fines ^[7].

I would expect the procedural items to move before the substantive ones, because a drafting checklist costs a government less than unwinding a cloud certification program. The column's own reform list includes making trade impact assessments a mandatory part of regulatory impact analysis. A draft bill would then be checked for de facto discrimination against foreign-owned companies, for consistency with the Korea-U.S. free trade agreement, and for its effect on cross-border data flows ^[9].

The column warns that new digital rules can be hard to enforce against overseas operators, leaving domestic operators alone to carry the burden, a form of reverse discrimination ^[8]. If that is the outcome, the rules bind Korean firms harder than the American firms objecting to them. And this is a commentary arguing for institutional reform, published under the headline "Korea and U.S. Need Common Digital Rules to Defuse Clash" ^[10]. It does not report that Seoul has agreed to change CSAP, the transfer requirements, or the platform rules.

The residency thesis fails if CSAP comes out of a negotiation untouched and the network usage fee bill is what gets traded.