Confidentiality and privacy of arbitration in the digital era: pies in the sky?

Abstract

Confidentiality and privacy are essential components of arbitration, preceding the digital data era. This article discusses how arbitration stakeholders—arbitration institutions and associations, arbitrators, attorneys, and commercial users—have increasingly lost control over confidentiality and privacy in international commercial arbitration by adopting digital technologies provided by Internet giants, such as Microsoft, Google, Dropbox, and Zoom. Arbitration institutions and users have, often unconsciously, defined confidentiality and privacy expansively to promote the wider use of email, cloud storage, and video conferencing platforms in conducting arbitration proceedings. However, they have overlooked the extent to which the use of digital technologies exposes private and confidential information to third parties, including but not limited to Big Data. They have also placed undue faith in the capacity of Internet giants that dominate the Internet to protect highly sensitive arbitration proceedings which those giants commercialize to garner public attention including in arbitration disputes. In responding to this troubling reality, the article examines how to better protect confidentiality and privacy in arbitration, by refining existing protections embodied in international rules and guidelines and choosing domestic forums that favour such protections. It also encourages arbitration stakeholders to update the rules and their application to arbitral proceedings to respond to both intended and unintended violations of commercial and personal data. That strategy includes redressing the downstream disclosure of injurious data, including by choosing legal forums that protect against the use of intelligence to violate private and confidential data.

1. Introduction

Privacy and confidentiality are inherent in the very nature and operation of international commercial arbitration without which the very purpose of the private dispute resolution process would be lost.¹ Protecting them is a distinguishing feature of commercial dispute resolution upon which parties to the process depend. International commercial arbitration is the means of shielding their dealings from actual or potential competitors, media, or other observers ready to expose their business deficiencies, along with the invasiveness of public scrutiny at large. In fact, privacy and confidentiality protections become ever more important as parties face ever greater risks of losing those protections. Those risks are especially greater in the current era of mass data collection, storage, processing, transmission, and expansive use, which are the direct product of developments in information and communications technologies (ICTs) brought about by Internet giants like Microsoft, Google, Dropbox, and Zoom. These developments have extended the scope of mass communication, while regrettably also extending the redirection, misuse, and abuse of that communication. These threats are becoming more protracted in the face of ever more complex digital technologies using artificial intelligence (AI) beyond traditional machine learning and applying them to smart and automated programs.² Those challenges have expanded further during the COVID-19 era in which dispute resolution, once characterized by in-person hearings and proceedings, has been undermined by lockdowns and travel restrictions.³ The automated response to this dilemma is to resort to dispute communication dominated, not by telephones and airmail, but by highly sophisticated AI including reliance on smart codes that drive blockchain intelligence and smart computing.⁴ One feature of these technological developments is growing reliance on ‘remote international arbitration’, a practice that is likely to remain in place well beyond the Pandemic.⁵

A particular challenge for international commercial arbitration stakeholders is to protect themselves against growing technological threats to the confidentiality and privacy of their operations, especially in the resolution of disputes. As the European Parliament and Council have articulated, there is a need for ‘a new breed of legal professional who can adapt to this new paradigm and understand the application of technology and the impact it has in the legal sphere. To succeed, they must be customer-oriented, well-versed in management and strategy, tech-savvy, and be innovative’.⁶ The EU’s proposed legislation does not mention arbitration, but it does mention dispute resolution, stressing that ‘AI systems … should be considered high risk… but should not replace … the final decision … [which] must remain a human-driven activity and decision’.⁷ Including arbitration institutions and other stakeholders within this ‘new breed’ of professionals is an important aspiration in limiting the risks of the loss of confidentiality and privacy in the movement away from ‘a brick-and-mortar world’.⁸

A primary challenge for arbitration stakeholders is to sustain a viable regime of data regulation and cybersecurity in the face of persistent and growing threats to commercial in-confidence and personal privacy in dispute resolution. This challenge extends beyond responding to the misuse of early technologies, such as emails, podcasts, and video recordings, to include AI that thinks. However, international commercial arbitration users cannot realistically be expected to forego the commercial benefits of advances in technology in the conduct of their business and in the resolution of disputes, even in the face of defects and abuse in the use of those technologies. Arbitration institutions understandably strive for quick and efficient methods of dispute resolution facilitated by arbitration. They appreciate the virtue of user-friendliness in increasing client satisfaction with their services and increasing market impact. Arbitration users are also incentivized to use digital technologies in resolving disputes, to speed up the collection, storing, and communication of data, both inside and outside of formal arbitral proceedings, and to reduce the cost of disputes. Arbitration users are unlikely to imagine participating in arbitration proceedings without using the Internet in this mega-data age. Arbitrators, arbitration administrators, attorneys and clients exchange communications, and send documents containing confidential and private information, in the hope that they are able to keep secret that information sent, processed, and stored. However, this new digital era is marred by cybersecurity challenges that come with the unrestricted transfer of personal data to Internet giants and, conceivably, to downstream users seeking competitive advantage, and can include cyberstalking, mischief, or malice. It has also raised serious questions for arbitration users, including large corporations that rely on arbitration to resolve their cross-border disputes. Are they able to protect sensitive personal data and important trade secrets in the age of information technology and at the level we perceive as normal, in using international commercial arbitration that is acutely sensitive to data abuse? How can they prohibit the misappropriation of hearing transcripts, written pleadings, submissions adduced in arbitration, materials, produced during disclosure before tribunals, and ensuing awards?⁹

This article expounds upon the nature of these risks and their distinctive threats to confidentiality and privacy in international commercial arbitration arising, inter alia, from data error and deliberate misuse of information technologies. It examines how Big Tech has protected its contractual and other rights to use such confidential and personal data as well as business secrets for profit, including by directly exploiting them, downstreaming them or otherwise permitting third-party access to them. It also explores measures for reducing the ensuing threats to data privacy and confidentiality to arbitration stakeholders, while retaining the commercial efficiency of ever-advancing technologies. Parties should also consider the importance of distance communication as a medium of human safety and security in performing cross-border contracts and in resolving disputes arising from natural disruptions and governmental impositions broadly identified with the COVID-19 Pandemic.¹⁰

Accordingly, this article focuses on the lack of protection of privacy and confidentiality in international commercial arbitration because of the absence of effective rules governing the collection, processing, and transmission of personal and commercial data. It addresses how ICT service providers have exacerbated those consequences in the storage, conveyance, and conduct of arbitration proceedings. It discusses whether and how other arbitration stakeholders—arbitration institutions, arbitration associations, arbitrators, practitioners, and parties—can fill the gap to protect against threats arising from both traditional threats to confidentiality and privacy and those arising from new technologies. The article proposes that arbitration rules and guidelines be updated in order to be more practical and pragmatic as regulatory controls over data in the advancing digital era.

Section 2 overviews relatively recent challenges posed by digital technologies to the confidentiality and privacy of international commercial arbitration. Section 3 demonstrates how arbitration institutions have continuously adopted complex and sometimes conflicting conceptions of arbitral confidentiality and privacy, without addressing the impact of ICT services upon those conceptions. Section 4 evaluates the key tensions between confidentiality/privacy and digital technologies in international commercial arbitration. Section 5 proposes new definitions, guidelines, and rules governing confidentiality and privacy in international commercial arbitration, reflecting the inevitable involvement of ICT service providers in arbitral proceedings and unrealistic expectations to control their access to confidential and private data during the proceedings. The Section highlights the benefit of these pragmatic innovations in securing procedural efficiency and cost-effectiveness as interim solutions. It also calls for further collaborative actions by arbitration stakeholders and ICT service providers to protect confidentiality and privacy in the highly vulnerable sector of international commercial arbitration. Section 6 concludes the article by highlighting the importance of adopting a practical pathway to functional results in response to radical technological inventiveness and inevitably, risk in its application.

2. Confidentiality, privacy, and digital technologies

The importance of confidentiality and privacy is widely recognized by arbitration stakeholders and emphasized by arbitration scholars.¹¹ Moreover, concern over the failure to protect confidences and privacy specifically in relation to technology is widely acknowledged in principle. Regulations have stressed the value of providing guidance in redressing the importance of cybersecurity in the avoiding and resolution of arbitration disputes. Noteworthy is the adoption of the ICCA-NYC Bar-CPR Protocol on Cybersecurity in International Arbitration [ICCA-NYC Bar-CPR Protocol] under the auspices of the International Council for Commercial Arbitration (ICCA), the New York City Bar Association (NYC Bar), and the International Institute for Conflict Prevention and Resolution (CPR) with the mandate of devising the establishment and application of reasonable cybersecurity measures to avoid cyber misuse and abuse in arbitration.¹² In addition, the 2018 International Arbitration Survey stressed the value of protecting confidentiality; 36 per cent of respondents claimed that the combination of confidentiality and privacy is one of the three most valuable characteristics of international arbitration.¹³ In total, 87 per cent of respondents found that confidentiality in international commercial arbitration is ‘very’ or ‘somewhat’ important.¹⁴ The Survey also stressed that the rules of a number of arbitration institutions imposed the default duty of confidentiality and privacy on those involved in arbitration proceedings.¹⁵ It highlighted that confidentiality and privacy have continued to be regarded as essential advantages of international arbitral proceedings that require preservation.¹⁶

However, these valued features of arbitration proceedings are being eroded just as they are being championed. This erosion is largely due to the increased resort to innovative technologies, coupled with the wider use and accompanying misuse of Internet technologies in the epoch of the COVID-19 Pandemic. In a pre-COVID survey on the use of ICT in international arbitration, most participants (i.e., a group of 103 members of the Belgian Centre for Arbitration and Mediation (CEPANI) and/or the Vienna International Arbitration Centre (VIAC) answered that they had made use of common technologies such as email (99.07 per cent).¹⁷ A large minority of participants reported that they had stored information on arbitral proceedings in the cloud (43.93 per cent).¹⁸ The survey further found that 56.34 per cent of participants had used, in a quarter of their arbitrations, video conferences to examine witnesses that were considered as being beyond their feasible travel distance.¹⁹ The COVID-19 Pandemic also made the use of ICT more common in arbitration proceedings. In the 2021 International Arbitration Survey, 63 per cent of respondents answered that they always or frequently used video conferencing technologies, while 56 per cent of them always or frequently took advantage of cloud-based storage.²⁰

ICT systems and services are offered by Internet companies that are not parties to arbitral proceedings. They are therefore not entitled to access the confidential information as parties to such proceedings. Adding the prospect of greater public access to such information, large tech companies have developed popular ICT software and services, such as Microsoft Outlook, Gmail, Google Cloud, Dropbox, Zoom, and Microsoft Teams, that have expanded the potential scope for the misuse of arbitration data in pursuit of wider use of their services.²¹ In enlarging their collection, processing, and downstreaming of data,²² they have enabled greater user access to private and confidential information about arbitration parties, documentation, proceedings, and awards. The compounding threat to privacy and confidentiality extends to third-party data collectors and processors who have transmitted such data to yet further parties downstream.²³ The threats to private and confidential information in the age of mass data abuse have reached an alarming level, posing a serious risk to the safe and reliable operation of multiple institutions and practices, including those involved in international commercial arbitration.

This is not the first challenge to arbitral confidentiality and privacy. Commentators have proposed greater transparency in international commercial arbitration for decades.²⁴ Some have complained that confidentiality has increased the cost of arbitration. They have stressed the lack of information accessible to users about the nature and content of private decision-making in both commercial and investment arbitration.²⁵ That paucity has led to misinformation about the process of arbitration.²⁶ Others have argued that the current trend of international commercial arbitration is to diminish or question the value of confidentiality in arbitral proceedings, particularly when arbitration involves a public interest.²⁷ Thus, the confidentiality and privacy of arbitral proceedings have been under pressure for some years; but it has remained largely resistant to that pressure.²⁸

Among more recent challenges to arbitral confidentiality/privacy is that the arbitration industry has promoted the use of Internet technologies in dispute resolution that have, intentionally or otherwise, provided little guidance on the consequences of their usage.²⁹ For example, the ICC’s Checklist for a Protocol on Virtual Hearings stipulates in section C whether the duty of confidentiality, privacy, and security applies to participants.³⁰ The Checklist defines ‘participants’ as ‘arbitrators, parties, counsel, witnesses, experts, administrative secretaries, interpreters, stenographers, technicians, etc’.³¹ However, the non-exclusive list does not clarify whether providers of video conferencing systems are participants in online arbitration. Likewise, clause (iii) of section C encourages the tribunal and the parties to consult over threats such as hacking and illicit access to the integrity and security of virtual hearings. However, it does not mention whether and how these participants should decide on the service providers’ ability to access the information exposed in the virtual hearing. As a result, the Checklist does not address how the inevitable involvement of video conferencing service providers is likely to affect the confidentiality and privacy of international commercial arbitration. This failure to clarify the relationship between ICT service providers and confidentiality/privacy is evident in other rules and guidelines on the adoption of Internet technologies in international commercial arbitration, and is not limited to virtual hearings.³²

This trend is alarming because mega-data service providers are interested in expanding access to their services by their users generally, beyond participants in arbitration proceedings.³³ They are also well positioned technologically to take advantage of the public interest in corporate and client finances, mergers, acquisitions, bankruptcy, and insolvency proceedings. They are also well equipped to do so by their access to arbitration proceedings at the expense of privacy and confidentiality sought by international commercial arbitration stakeholders.³⁴ These risks extend to traditional publishers such as newspapers seeking ‘newsy’ stories about disputes pertaining to intricate confidences which they help to transform into media sensationalism. The result is a frenzy to feed an ever-wider audience of sensationalized supplicants. The result of such compounded data transmission can be costly to arbitration stakeholders whose privacy and confidentiality and business interests are compromised.

Violating the expectation of confidentiality in arbitration introduces a serious dilemma for ICT service providers.³⁵ They have significant economic incentives to downstream confidential information, to widen their user networks for marketing and related purposes.³⁶ This highlights their claimed practice of weighing the cost of protecting personal and confidential data against the benefit of providing access to it in the alleged public interest.³⁷ They are also incentivized to use their contracts with arbitration service providers strategically to reduce the prospect of being held in breach of their contractual duties to maintain the privacy and confidentiality of their arbitration clients. As a result, they frequently subject their contractual duties to qualifications and exceptions, notably through disclaimer and exclusion of liability clauses in their contracts of service.³⁸

These risks are not peculiar to international commercial arbitration stakeholders. Nor is the difficulty of resolving them distinctive to such stakeholders. The prospect of public regulators agreeing to limit the application of such contractual exclusions and limitations in liability is shared by users across virtual space. The resistance to such limits is also formidable, but still plausible, as is demonstrated in Sections 5 and 6. What is more plausible, at least in the first instance, is for arbitration stakeholders to establish functional incentives and practical means of protecting private and confidential information from being exposed to such data intrusions. One means is by arbitration institutions expressly recognizing in their rules and guidelines the threat that ICT service providers, among other interested third parties, pose to privacy and confidentiality, and to operationalize ways of responding to those threats.³⁹ As the ensuing section demonstrates, arbitration institutions have not yet devised significant operational offsets and practical responses to the misuse of confidential arbitration information by tech companies.

3. Defining confidentiality and privacy

Confidentiality and privacy are intertwined in their operation, but differ conceptually and functionally from each other. Viewed strictly and conceptually, confidentiality entails the prohibition of disclosing arbitration-related information to third parties who are not parties to the arbitration. Privacy denies third parties access to and attendance at arbitral hearings.⁴⁰ Viewing privacy and confidentiality in combination, ‘the level of privacy over personal information accorded to a party during arbitration proceedings is encompassed within the confidentiality of those proceedings and the ensuing award’.⁴¹ The subsections that follow identify further divergence over the meaning and scope of confidentiality and privacy, although conceptions of arbitral privacy are generally uniform across national laws and institutional rules. What is common among the laws and rules governing the confidentiality and privacy of arbitral proceedings is the functional failure of both to address adequately the widespread use of ICT services in international commercial arbitration and the functional consequences of that use upon arbitral confidentiality and privacy.

3.1. Confidentiality

The divergence over the meaning and scope of confidentiality is evident in legal instruments issued by the United Nations Commission on International Trade Law (UNCITRAL). Though its mission is to harmonize and modernize the law of international trade, neither the UNCITRAL Model Law on International Commercial Arbitration (Model Law) nor the UNCITRAL Arbitration Rules specifically mention confidentiality.⁴² However, the UNCITRAL Notes on Organising Arbitral Proceedings highlight confidentiality among the list of matters that are central to proceedings.⁴³ Those Notes elaborate that ‘there is no uniform approach in domestic laws or arbitration rules regarding the extent to which the participants in an arbitration are under a duty to maintain the confidentiality of information relating to the arbitral proceedings’.⁴⁴ The UNCITRAL’s failure to define confidentiality has likely resulted in the corresponding failure of many state signatories to clarify and harmonize the scope and limits of confidentiality because they closely follow the Model Law and other UNCITRAL legal documents in developing their arbitration laws,⁴⁵ although article 34.5 of the UNCITRAL Arbitration Rules does attribute some value to confidentiality by specifying that both parties must consent to an arbitral award being made public.⁴⁶

International arbitration institutions generally refer to confidentiality in their rules, although those rules diverge from one institution to another. According to the 2021 Arbitration Survey, the five most preferred arbitral institutions to which respondent organizations resort are the International Chamber of Commerce (ICC) (57 per cent), Singapore International Arbitration Centre (SIAC) (49 per cent), Hong Kong International Arbitration Centre (HKIAC) (44 per cent), London Court of International Arbitration (LCIA) (39 per cent), and China International Economic and Trade Arbitration Commission (CIETAC) (17 per cent).⁴⁷ Annex 1 demonstrates how the arbitration rules of these institutions diverge/converge in (i) delineating what information and materials fall within the scope of confidentiality; (ii) who owes a duty of confidentiality; and (iii) whether an explicit agreement is required to effectuate the obligation of confidentiality. Significantly, it is only the ICC that does not subject the participants to default obligations of confidentiality in relation to arbitral proceedings. The other arbitration institutions impose a broad default duty of confidentiality on a wide range of individuals involved in international commercial arbitration. The duty is extensive in providing that all matters and information relating to the arbitration shall be kept confidential, whereas anyone involved in the arbitration shall observe this duty of confidentiality unless the parties agree otherwise.

The common approach adopted by those arbitration institutions is to impose comprehensive duties of confidentiality, but without referring to the risk of ICT service providers breaching those duties. Although their institutional rules are comprehensive and they adopt non-exclusive definitions of arbitral confidentiality, they do not impose binding obligations on such service providers.⁴⁸ Indeed, the rules that provide exceptions to confidentiality (see  Annex 2) are imprecise, leading to uncertainty on the applicability of those exceptions. Furthermore, they do not clarify whether the scope of those exceptions extends to information that relates to the arbitral proceedings that ICT service providers acquire in the course of their business operation.⁴⁹ More fundamentally, those rules and exceptions are unclear about their applicability to confidentiality in relation to digital technologies.⁵⁰

3.2. Privacy

As in the case of confidentiality, the privacy of arbitral proceedings is not defined in national legislation but is contained instead in institutional rules. In fact, national laws are generally silent on the involvement of third parties in arbitral proceedings primarily because the UNCITRAL Model Law does not provide for the privacy of international commercial arbitration.⁵¹ In contrast, the rules of arbitration institutions provide expressly for the presumptive privacy of arbitral hearings. For instance, article 26(3) of the ICC Rules provides that: ‘[t]he arbitral tribunal shall be in full charge of the hearings, at which all the parties shall be entitled to be present. Save with the approval of the arbitral tribunal and the parties, persons not involved in the proceedings shall not be admitted’.⁵² SIAC, HKIAC, LCIA, and CIETAC also verify in their rules the default private nature of arbitral hearings.⁵³

Nonetheless, ICT service providers may have access to information relating to arbitral hearings without explicit permission of the parties and without requiring them to attend hearings. According to a pre-COVID survey on written communication in arbitration, such communication occurs primarily through email ‘between the members of the arbitral tribunal (92.14 per cent), between counsel and client (81.93 per cent), and between the arbitral tribunal and the arbitration institution (66.54 per cent)’.⁵⁴

Arbitration institutions also regard email as the dominant mode of communication in arbitration proceedings. For instance, the 2021 edition of the ICC Note to Parties and Arbitral Tribunals mandates the ICC Secretariat to communicate via email, requiring the parties, counsel, and (prospective) arbitrators to provide her/him with their email addresses.⁵⁵ Thus, arbitration institutions and practitioners have had integrated email service providers in arbitral proceedings for many years,⁵⁶ although those providers are often third parties to those proceedings. Such third parties are unlikely to attend arbitral hearings physically but are likely to be involved in arbitration proceedings by providing arbitration institutions, arbitrators, parties and their representatives with means of communication relating to the hearings.

In a similar manner to other third-party service providers, those who provide video conferencing platforms take part in virtual hearings and online arbitration, even though they seldom are present at hearings, other than in setting up their facilities. Arbitration parties also do not anticipate that such participation by those service providers conflicts with the doctrine of privacy.⁵⁷

What arbitration institutions also share is their reluctance to provide in their rules for the standing of ICT service providers in arbitral proceedings, for various reasons and with distinct consequences.⁵⁸ The deficiency arising from this reluctance underscores the need for updating those rules and guidelines. These matters are discussed further below.

4. Digital technologies in international commercial arbitration

As discussed in the last section, there are tensions between digital technologies used in international commercial arbitration and conceptions of arbitral confidentiality and privacy that are provided for arbitration rules and guidelines. This section discusses the limited awareness and preparedness of arbitration stakeholders—arbitration institutions, associations, practitioners, and users—to address those tensions. The section focuses on the use of email, cloud storage, and video conferencing platforms in arbitral proceedings. It also considers the extent to which various default rules and guidelines on the use of digital technologies assist arbitration stakeholders in becoming more aware of the risks of confidentiality/privacy breaches by ICT service providers in international commercial arbitration. The section considers the extent to which the exposure of confidential and private arbitration data potentially extends to third parties who have access to such ICT service providers, in response to the need to avoid over-extending or over-complicating the rules governing arbitral proceedings.⁵⁹

4.1. Emails

No discernible research suggests which email service is the most popular among arbitration practitioners. However, 47 per cent of the respondents in the 2021 Arbitration Survey recommended the use of secure or professional email addresses for arbitrators, instead of web-based (free) email providers like Gmail and Hotmail (now Outlook.com).⁶⁰ This result implies that both secure and web-based email services are used in the practice of international commercial arbitration. Thus, we consider these two types of email communications in this subsection. The discussion is followed by the examination of rules and guidelines on the usage of email in arbitral proceedings.

4.1.1. Secure email services

The 2021 Arbitration Survey does not clarify which email services are secure. However, several commentators suggest that encryption systems improve the security of email communications,⁶¹ and that such systems are available on Microsoft Outlook (Outlook).⁶² In simple terms, encrypting an email in Outlook is converting the message from readable plain text into a scrambled cypher message, which can only be deciphered and read by the recipient who has the private key that matches the public key encoding the email.⁶³ Outlook protects such security by encrypting the privacy of email communication between the sender and receiver.

Free web-based email services do offer encryption tools. However, those tools are unlikely to be more reliable than the one provided by Outlook. For example, Gmail—a free email service provided by Google—encrypts messages at rest and while in transit between data centres within Google’s infrastructure; but it does so on a more limited basis for messages transiting to third-party providers with Transport Layer Security (TLS) ‘when possible or required by configuration’.⁶⁴ In contrast, subscribers to the Office 365 Enterprise E3 license, comprising Outlook and other Microsoft programmes who use Microsoft 365 Message Encryption, can send encoded messages to users of non-Microsoft email services.⁶⁵ This renders free web-based email services more vulnerable to hacking than Outlook. By exposing private or confidential data about an international commercial arbitration to this vulnerability, a user is more likely to be held responsible for a violation of privacy or confidentiality.

However, email communications on Outlook are unlikely to be fully restricted to the sender and receiver engaged in arbitral proceedings because Microsoft as a service provider may access confidential and private information without obtaining permission from those two parties. Microsoft’s Privacy Statement—applicable to Outlook and other (premium) Microsoft services and applications—is indicative of this point.⁶⁶ It states that:

Microsoft collects data from you, through our interactions with you and through our products for a variety of purposes …. We rely on a variety of legal reasons and permissions (sometimes called “legal bases”) to process data, including with your consent, a balancing of legitimate interests, necessity to enter into and perform contracts, and compliance with legal obligations, for a variety of purposes ….⁶⁷

In other words, Microsoft collects data from the users of its products and services and is free, subject to the applicable law, to use the data for its business operation without consent from customers. The data include files and communications that users input, upload, receive, create, and control, such as ‘audio, video, text (typed, inked, dictated, or otherwise), in a message, email, call, meeting request, or chat’.⁶⁸ Therefore, email communications through Outlook are under the control of Microsoft.

Microsoft emphasizes that users have the option to decline its provision applicable to the protection of their personal data, but to do so prevents them from utilizing that product or feature. For instance, the Privacy Statement points out that: ‘[i]f you choose not to provide data required to operate and provide you with a product or feature, you cannot use that product or feature. Likewise, where we need to collect personal data by law or to enter into or carry out a contract with you, and you do not provide the data, we will not be able to enter into the contract; or if this relates to an existing product you’re using, we may have to suspend or cancel it’.⁶⁹ The connotation in this specification is clear. Those who use Outlook must agree to Microsoft collecting information contained in their email exchanges (including information related to arbitral proceedings). Otherwise, Microsoft is likely to invoke its contractual right to terminate the operation of the service. Hence, to use Outlook is to provide Microsoft with information on the communication taking place on the program.

4.1.2. Web-based email services

Legal experts using Gmail are required to share with Google their email communications on the platform. In fact, Google’s Privacy Policy states that the company collects the content, including emails that users create, upload, or receive from others when utilizing its services.⁷⁰ The information is available to be used by Google for various purposes, such as: to provide, maintain, and improve its services; to develop new services; to provide personalized services; to measure the performance of its services; to communicate with users; and to protect Google, its users, and the public.⁷¹ Google suggests that users have control over how the company uses the collected information.⁷² Nonetheless, it declares that Google will share personal information (i.e., information stored with Google account, like usernames, email addresses, and passwords) with third parties it considers in good faith that: ‘disclosure of the information is reasonably necessary to …[p]rotect against harm to the rights, property or safety of Google, our users, or the public’.⁷³ Thus, Google may prioritize its interests over the confidentiality and privacy of communications on Gmail.

Outlook.com is a web-based suite of email and other personal information management services that replaced Hotmail. It is offered by Microsoft as a webmail service which is subject to the Microsoft Privacy Statement.⁷⁴ The Privacy Statement refers to the broad authority of Microsoft to use the content of emails on Outlook.com. For example, it maintains that ‘[Microsoft] will retain, access, transfer, disclose, and preserve personal data, including [the users’] content … such as the content of your emails in Outlook.com’.⁷⁵ Microsoft may take such actions if it believes in good faith that the actions are necessary for compliance with the applicable law or valid legal procedures, protection of its customers and operation and maintenance of its products, as well as protection of Microsoft’s rights or property.⁷⁶ Thus, as in the case of Gmail and Google, Microsoft may take advantage of emails in Outlook.com for the protection of its interests and the provision of its services.

4.1.3. Arbitration rules and guidelines on the use of emails

Email is the norm in communications for international commercial arbitration, partly because arbitration institutions prompt their clients to contact them by email.⁷⁷ However, arbitration associations have made efforts to raise awareness among arbitration users of the vulnerability of emails to third-party data breaches. For example, the Chartered Institute of Arbitrators (CIArb) discourages the communication of sensitive data by email, emphasizing its insecurity and vulnerability to cyberattacks.⁷⁸ On the inevitable risk of email exchanging such data, CIArb recommends protecting the transmitted information by using passwords and encryption.⁷⁹ Likewise, ICCA, NYC Bar and CPR suggest the following security measure:

Restricting the use of email files or attachments to transmit confidential or sensitive information, unless such email is end-to-end encrypted and the attachments are password-protected, with passwords to be transmitted by a separate means of communication such as text message or voicemail.⁸⁰

Those recommendations by arbitration organizations aim at addressing potential security breaches of email communications, and to maintain the confidentiality of the dispute resolution process.⁸¹ However, they do not consider whether and how such communications may unintentionally compromise the confidentiality and privacy of international commercial arbitration by providing email service providers with access to messages related to arbitral proceedings in the users’ mailboxes. End-to-end encryption and encryption of email in transit certainly prevent any third parties, including email service providers like Google and Microsoft, from reading eligible messages as they travel between devices, but it does not encrypt messages that are not in transit.⁸² Thus, the service providers can read those arbitration-related messages in their users’ mailboxes. The fact that the service providers have the contractual rights to utilize the content of emails exchanged on their platforms⁸³ might cause unintended consequences for the parties later. For instance, if there is a dispute between an email service provider and one of its users, the former is likely to be able to use the latter’s messages as evidence supporting its claims in arbitral proceedings. The evidential threshold for invoking such legally obtained materials before arbitral tribunals is unlikely to be high because some tribunals even recognize the admissibility of hacked emails as evidence.⁸⁴ Such consequences are unlikely to be covered by the traditional conceptions of confidentiality and privacy and are therefore unpredictable for ordinal arbitration users using email services as part of their daily operations.

4.2. Cloud storage

As arbitration is document-intensive, arbitration institutions are encouraged to offer document repositories as backbones for filing and servicing documents and evidence.⁸⁵ Several institutions offer digital case and document management systems which are tailor-made for their arbitration-related businesses and services.⁸⁶ The SCC has a secure digital platform, the SCC Platform, for communication and file sharing among the SCC, disputing and other parties, and the tribunal. These arbitration participants also ordinarily file all case materials for the arbitration on this platform.⁸⁷ However, it is not discernible if this tool was wholly insourced.

However, some leading arbitration institutions—ICC, SIAC, HKIAC, LCIA, and CIETAC—seem disinclined to develop or promote equivalent systems. For instance, a senior international arbitrator who has conducted arbitration proceedings with these institutions responded to a question in an interview conducted by the first author that he had never been reminded by the organizations of the availability of such systems.⁸⁸ This is despite the fact that the LCIA developed several years ago a centralized online filing portal system—LCIA Online Filing.⁸⁹ Moreover, the ICC launched in 2005 an electronic document management platform, NetCase, but the ICC ceased to operate this program due to its unpopularity among legal practitioners.⁹⁰ Thus, it remains to be seen whether these arbitration institutions intend to increase investment in in-house online document management systems to replace external service providers.

In light of the underdevelopment of online platforms by arbitration institutions at this time, it is anticipated that participants in arbitration proceedings will continue to rely on cloud-based document management services provided by third-party developers.⁹¹ As mentioned above, the majority (56 per cent) of those who were involved in the 2021 Arbitration Survey reported their frequent or consistent use of cloud-based storage.⁹² In the same survey, 80 per cent of respondents stated that they had used or should use cloud-based platforms ‘to protect the confidentiality and security of electronic or electronically submitted data in international arbitration’.⁹³ Moreover, 84.78 per cent of participants in a pre-COVID survey opined that they would use ‘Dropbox or other secured cloud-based file-sharing services’ for arbitral proceedings, if offered by arbitration institutions.⁹⁴ Furthermore, the ICCA, NYC Bar, and CPR suggest that ‘[t]hird party cloud storage can provide better security than an individual practitioner or small organization can reasonably provide on its own’.⁹⁵ Thus, the following subsections consider third-party cloud storage services like Dropbox, OneDrive, and Google Drive, taking into account relevant arbitration rules and guidelines.

4.2.1. Third-party cloud storage

Dropbox—operated by the US company Dropbox, Inc.—stipulates in its Privacy Policy how the company collects, uses, and handles the personal data of customers stored in the file hosting service.⁹⁶ Dropbox points out elsewhere that it has the flexibility to utilize and share the data for its business management.⁹⁷ For instance, its Privacy Policy states that: ‘[w]e … collect and use personal data for our legitimate business needs. To the extent that we process your personal data for other purposes, we ask for your consent in advance or require our partners to obtain such consent’. Phrased differently, Dropbox may use personal data for business purposes without permission from the users. Moreover, Dropbox may share that personal information with other third parties, such as ‘others working for and with Dropbox’, ‘other Dropbox Companies’, ‘other users’, and any other third parties, as required by the applicable law or for the protection of Dropbox’s rights.⁹⁸ In particular, in extending its services to Dropbox Business customers subscribing to its premium plan, Dropbox states that ‘[a] [p]arty may disclose [c]onfidential [i]nformation to its employees, advisors and consultants who have a need to know the [c]onfidential [i]nformation, if that employee, advisor or consultant is bound to restrictions at least as protective of the other [p]arty’s [c]onfidential [i]nformation’.⁹⁹ Therefore, storing the private and confidential data of arbitration parties or proceedings in Dropbox, in the worst-case scenario, enables the service provider and its stakeholders to exploit the electronic information.¹⁰⁰

Other cloud storage services take similar approaches to the control of personal data. The Microsoft Privacy Statement applies to OneDrive, which means that, in order for customers to use the service, they agree to Microsoft determining when to share their private information in accordance with its Privacy Policy.¹⁰¹ Google Drive Terms of Service (TOS) states that Google will not share clients’ files and data with third parties ‘except as described in [its] Privacy Policy’,¹⁰² although this Policy allows Google to share personal information with outside agencies, for the protection of its rights and property.¹⁰³ Therefore, arbitration participants cannot enjoy the convenience of third-party cloud storage without enabling the provider of the service, its employees, and business affiliates to benefit from confidential and private data kept in that storage.

4.2.2. Arbitration rules and guidelines on the use of cloud storage

It is uncertain how arbitration institutions and associations perceive third-party cloud service providers’ involvement in arbitration proceedings. No discernible arbitration rules of the ICC, SIAC, HKIAC, LCIA, and CIETAC address this issue. The guidelines of arbitration associations urge arbitration practitioners to be wary of the security of cloud storage against hacking. However, they do not touch upon the implication of such service providers abusing their access to confidential and private information disclosed in arbitration proceedings.¹⁰⁴ What has likely triggered this paucity of discussion among arbitration institutions/associations is the extensive debate on the use of cloud storage by law societies around the world.¹⁰⁵ Cohen and Morril point out that:

Numerous lawyer ethics opinions have considered whether the use of cloud services is compatible with an attorney’s obligation to maintain confidentiality. The decisions generally have concluded that lawyers may use the services, provided that they take reasonable steps to select a reliable vendor, implement available security and address the potential risks.¹⁰⁶

However, not all individuals involved in arbitration proceedings comply with such ethics statements. Even though lawyers dominate key groups and publication outlets for international commercial arbitration,¹⁰⁷ other professionals who lack legal backgrounds serve as arbitrators, witnesses, experts, and interpreters.¹⁰⁸ Moreover, dominant vendors—Dropbox, Microsoft, and Google¹⁰⁹—have declared in their privacy statements that space in their cloud storage is the quid pro quo for permitting those vendors to access and share the stored data and relevant personal information for their business operations.¹¹⁰ Therefore, the tension between cloud services and confidentiality/privacy operates largely outside the radar of arbitration stakeholders.

4.3. Video conferencing platforms

To regulate the transmission of COVID-19, national governments created social distancing barriers and closed national borders. As a result, face-to-face arbitration proceedings were forced to shift to online mode,¹¹¹ and virtual/remote hearings became the norm in arbitral proceedings.¹¹² According to the survey conducted by Born, Day, and Virjee on user preferences for video conferencing tools in conducting arbitration hearing, the most popular platforms were (in order) Zoom, Microsoft Teams, and Cisco WebEx.¹¹³ Hence, the following subsections examine how the providers of these services process personal data and consult relevant arbitration rules and guidelines.

4.3.1. Zoom

According to its Privacy Statement, Zoom collects/processes personal data consisting of its users’ account information, profile information and meeting, webinar, and messaging content, among others.¹¹⁴ Thus, the content of virtual hearings in arbitration proceedings conducted on Zoom can be classified as including such personal data. Zoom employees may access such personal data without the consent of the subject of that data when they undertake activities to comply with the applicable law, respond to a lawsuit, or investigate potential violations of Zoom’s TOS or policies. Zoom may also share that personal data with third parties without the consent of the data subject, provided that it is required to do so for legal reasons, including compliance with its corporate and social responsibilities and the protection of its own and its customers’ rights and property. Hence, the Privacy Statement allows Zoom to use its customer’s personal data to maintain its market interests.

Zoom is likely to keep the content of online hearings confidential, as per its TOS.¹¹⁵ Those TOS provide in s 17.3 that:

[The customer] and Zoom shall take reasonable steps to maintain the confidentiality of each other’s Confidential Information using measures that are at least as protective as those taken to protect its own information of a similar sensitivity, but in no event using less than a reasonable standard of care.¹¹⁶

However, the TOS (which incorporates the Privacy Statement) does not prohibit Zoom from sharing personal information with other third parties. In fact, section 17.3 further stipulates that:

Neither [the customer] nor Zoom will disclose the other party’s Confidential Information to any person or entity except to its employees, advisors, and attorneys who have a strict need to know the information in connection with this [TOS] and who are bound by confidentiality obligations at least as protective as the provisions herein. … Zoom also may disclose Customer Confidential Information to its consultants, contractors, service providers, subprocessors, and other third parties who are bound by confidentiality obligations at least as protective as the confidentiality provisions herein.

The TOS is further limited in scope because the obligation of confidentiality is subject to broad exceptions.¹¹⁷

Still largely untested is whether and to what extent the TOS will be subject to the domestic privacy law in the place at which Zoom provides its services to arbitration stakeholders. However, Zoom normally limits or excludes the application of the local privacy law through the governing law, forum selection clauses, and other provisions in the TOS.¹¹⁸ Indeed, the exception to the requirements of confidentiality identified above may not apply to an arbitration institution or a law firm if it is a holder of a business or enterprise account with Zoom and its use of Zoom’s services requires Zoom to process its end users’ personal data under a data processing agreement.¹¹⁹ However, Zoom does not provide that it will follow a stricter duty of confidentiality and privacy for its premium users. First, such data processing by Zoom is subject to Zoom’s Global Data Processing Addendum, in which Zoom is authorized to engage authorized sub-processors,¹²⁰ such as Amazon Web Services, Apple, Google, and Microsoft.¹²¹ Second, as per its governing law—the law of California—the TOS poses stringent confidentiality requirement on Zoom’s use of private data on behalf of a business, subject to the following significant exceptions.¹²² The TOS incorporates the Zoom US State Law Privacy Addendum, provided that (i) the arbitration institution or law firm is a ‘business’ and Zoom processes ‘personal information’ (in light of the California Consumer Privacy Act of 2018, as amended) on the institution’s or firm’s behalf, and/or (ii) the institution or firm is a ‘controller of personal data’ and Zoom processes such data (in light of applicable US state data privacy laws) on the institution’s or firm’s behalf.¹²³ The Addendum requires that Zoom delete or return its customer’s data after completing its provision of services to the customer,¹²⁴ but it does not prohibit Zoom from sharing the customer’s confidential data with third parties before deleting or returning it. Regarding (ii) above, the Addendum mandates the customer to generally authorize Zoom to engage subcontractors and sub-processors, to the extent that Zoom is a processor of the personal information of its customer.¹²⁵ In essence, the Addendum allows Zoom to share with third parties the personal data and information of its business users, including but not limited to arbitration institutions and law firms.

4.3.2. Microsoft Teams and Cisco WebEx

The other popular virtual hearing platforms take or have taken a similar approach to collecting and using personal data. For instance, until 2023, Microsoft Teams could accumulate personal data such as profile data and content that included users’ meetings and conversation chats, voicemail, shared files, recordings, and transcriptions.¹²⁶ Its cloud-based service also enabled Microsoft to process personal data to engage in its legitimate business operations that comprise (i) billing and account management, (ii) compensation for its employees and partners, among others, (iii) internal management, (iv) combatting fraud and cybercrimes, (v) improving its products and services, and (vi) financial reporting and compliance with legal duties.¹²⁷ Furthermore, Microsoft’s virtual hearing platform allowed it to disclose personal data as per the customer’s requests, the applicable law, and the Online Service Terms that have been revised, renamed, and restructured by the company¹²⁸ (However, these permissions were removed from the Team's website in 2024, and it is not very clear what terms currently apply). Likewise, Cisco collects personal data through Cisco WebEx, maintaining in its privacy statement that ‘[Cisco] will retain and use [users’] [p]ersonal [d]ata as necessary to comply with our business requirements, legal obligations, resolve disputes, protect our assets, and enforce our rights and agreements’.¹²⁹

Hence, both Microsoft and Cisco prioritize their business operations over the confidentiality/privacy of online hearings in a case of conflict between the two interests. Their business interests also potentially diverge from the protection of confidential/private data insofar as major sources of their cash flow are transactions that include accumulated personal data which they share with their business partners—usually other Internet service providers.¹³⁰

In essence and based on the foregoing, in using Microsoft Teams and Cisco WebEx (as well as Zoom and other video conferencing platforms), arbitration stakeholders give service providers permission to commodify confidential and private information on arbitral proceedings.

4.3.3. Arbitration rules and guidelines

Accentuated by the COVID-19 Pandemic is the growth of guidelines and rules on remote/virtual hearings in arbitral proceedings. Arbitration institutions and associations have also published protocols to assist arbitration practitioners in pursuing efficiency and in dealing with logistical challenges in online arbitral proceedings.¹³¹ Their guidelines and protocols propose ways in which arbitration users should deal with issues of confidentiality and data security, but their focus is to protect online hearings from unauthorized access by third parties. They are less focused on protecting confidentiality and privacy in arbitration outside the scope of formal hearings. Accordingly, they recommend that tribunals and parties agree on access to arbitration communications, subject to confidential undertakings that bind all participants to arbitral hearings. These undertakings include, among others, protecting video conferences with a password, preparing the approved list of participants to join the hearing, and eliminating the possibility of the presence of undisclosed non-participants in physical rooms occupied by participants in a remote hearing.¹³²

However, these guidelines do not highlight the risks of providers of video conference platforms commercializing the exchange of confidential/private online hearings. Some commentators are aware of this problem. For example, Scherer points out that:

[T]he question [is] whether the remote hearing provider or any other involved third party that stores, transmits or otherwise has access to data during the remote hearing might (mis)use it outside the arbitral proceedings. Some videoconferencing platforms’ general terms and conditions grant the provider ownership rights over the data transmitted during the videoconference. The provider may therefore sell or otherwise use the data, which for confidential arbitration proceedings is problematic, of course.¹³³

The discussion in Subsections 4.3.1 and 4.3.2 justify Scherer’s assertions. Zoom, Microsoft, and Cisco all stipulate in their privacy statements that they have the authority to use and share the content of video conferences in operating their businesses or protecting their rights. Nonetheless, the new guidelines and/or protocols governing virtual hearings of arbitration institutions do not directly address these challenges to preserving confidentiality.¹³⁴ This is probably because arbitration institutions are likely to have limited ability to alert arbitration users about such risks to confidentiality, given the perceived difficulty in protecting information conveyed in virtual proceedings; the dominant power of Internet giants; and the fact that parties ordinarily agree to the use of such digital technologies. That incentive is offset by the need for arbitration stakeholders to fully apprise arbitration participants of the gap between Internet giants and arbitration stakeholders in their control and authority over the confidentiality and privacy of arbitral proceedings in order to maintain confidence in arbitration. That need for arbitration stakeholders’ action should outweigh the incentives for their inaction. Otherwise, international commercial arbitration will become an economic panacea for Internet giants with a commercial interest in accessing private and confidential information about disputes in order to increase their business profits.

To date, not much has been reported on data abuse by the providers of online meeting platforms for commercial purposes. In 2020, a group of Zoom users filed a class action against Zoom before the US Northern District Court of California, alleging, among other things, that Zoom shared their personally identifiable information with third parties, such as Facebook, Google, and LinkedIn, without their permission, and enabled hackers to disrupt Zoom meetings in a practice called Zoombombing.¹³⁵ According to the users, the personally identifiable information accessed by third parties consisted of ‘device carrier, iOS Advertiser ID, iOS Device CPU Cores, iOS Device Display Dimension, iOS Device Model, iOS Language, iOS Time zone, [and] iOS Version’. The Plaintiffs argued that this information enabled third parties ‘to identify users and track their behaviour across multiple digital services … when combined with information regarding other apps used on the same device’.¹³⁶ However, the Court found that the Plaintiffs’ allegation about Zoom’s unauthorized personal data sharing was inadequate, suggesting in principle that they had not clarified what information was obtained by the third parties.¹³⁷ Whether and how the Plaintiffs modified the allegations later is not fully discernible from the settlement agreement between them and Zoom,¹³⁸ in which the latter reportedly agreed to pay USD 85 million as compensation and implement reforms to its business practices, including notifying users of when meeting hosts or other participants use third-party applications in meetings and providing special training to employees on privacy data handling.¹³⁹ In total, 85 million dollars in compensation is substantial, but it is not exceptional, given that Zoom reportedly earned 1.3 billion USD in Zoom meetings subscriptions from the class members.¹⁴⁰ It is an overstatement to suggest that video conference platformers, in general, are likely to be disincentivized to monetize personally identifiable data about arbitration participants by selling it to third parties, given the enormous profits such service providers earn from such sales. This class action against Zoom at least demonstrates their economic incentives for not sharing such data with third parties in the face of the negative publicity arising from such an action and the risk of it leading to regulatory constraints on selling personal data to third parties. However, monetary damages or money paid in a settlement with plaintiffs in a case involving such an action is unlikely to serve as an effective deterrent to mega-data corporations conveying private and confidential data to third parties.

More concerning is the service providers’ potential misuse of trade or technical secrets for their product development. For instance, some Internet giants today are influential in the field of Internet, software, and hardware development. Microsoft sells personal computers like Surface and home video game consoles like Xbox. Thus, if there is a technological dispute between computer manufacturers, say Dell and Acer, and if they opt for an online arbitration using Microsoft Teams, Microsoft will be able to utilize their discussion and display of confidential technical data in that arbitration for its future product development. Likewise, an online arbitration between Sony and Nintendo on Teams could unexpectedly contribute to the advancement of Xbox. In each case, Microsoft could monetize the confidential data without selling it to third parties. These examples are speculative, and no accessible evidence suggests that similar incidents had happened in relation to Microsoft and other tech companies by the time Microsoft revised its privacy policy on Teams in early 2024.¹⁴¹ Nonetheless, Internet giants have the means and ability to access confidential and private technical information discussed by the parties to arbitration on their video communication platforms, as demonstrated by the fact that mass surveillance by governments using software developed by tech giants is reportedly happening elsewhere in the world.¹⁴² Whether or not they have engaged or will engage in such profit-generating tactics is nevertheless within the scope of their technological capability.

Internet giants are also able to exclude or limit their liability for such data misuse for several reasons. They have sufficient resources to pay fines for violating arbitral privacy and confidentiality. They enjoy more bargaining power than arbitration stakeholders. The reputational harm to them for doing so, according to a cost-benefit calculus, is likely to be less than their prospective profits from engaging in such action. Arbitration stakeholders are not incentivized to accept such practices. But they ordinarily cannot avoid them if they wish to continue using such data storage, transmission, and digital services when other ICT providers adopt comparable practices.¹⁴³

5. Re-defining confidentiality and privacy for the increased use of digital technologies

As discussed above, arbitration institutions and associations have largely maintained their traditional rules governing confidentiality and privacy that preceded the advent of modern data technologies. These established rules were, arguably, effective in controlling traditional third-party access to data.

Established before the advent of modern data technologies or the Internet of Things, third parties were indeed potential sources of violations of privacy and confidentiality. Postal companies misdirected or misappropriated mail correspondence. Telecommunications companies recorded, re-transmitted, and listened to secret conversations on phones. Private individuals (including ICT providers) were able to breach the confidentiality/privacy of arbitral proceedings in various ways, such as by misusing mail, bugging telephones, and face-to-face communications, and misleading arbitration participants in-person or over the phone. Traditional arbitration rules and guidelines encouraged those involved in arbitral proceedings to be wary of traditional third-party violations of their confidentiality and privacy.¹⁴⁴

That era of reliance on traditional modes of communication has now passed. Nonetheless, arbitration institutions and associations have largely overlooked more recent threats posed by digital technologies to the classic confidentiality/privacy of arbitral proceedings. In particular, they have not guided arbitration stakeholders on threats to privacy and confidentiality stemming from the ever-expanding influence of tech giants upon virtual communications for arbitral proceedings. Their rules and guidelines have not directly addressed the (mis)use of secret information by the tech giants that extend beyond classic breaches of confidentiality/privacy in key respects.¹⁴⁵

First, as Trakman, Walters, and Zeller suggest, ‘a privacy violation … over the Internet may take weeks, months or years to identify’, unlike traditional notions of torts in privacy protection.¹⁴⁶ This is exemplified by the ‘right to be forgotten’ in the EU and the right ‘to be left alone’ in the US, two conflicting concepts demonstrating that traditional commercial and legal measures directed at protecting privacy/confidentiality are often inadequate and insufficient to deter data abuse.¹⁴⁷ Thus, the unchecked use of data by Internet giants is likely to trammel the expectations of arbitration stakeholders in an industry in which the largely unchanged rules governing arbitral confidentiality and privacy were formulated well before the Internet Revolution.

Second, the transmission of personal data on the Internet is borderless. There are no physical borders that prevent data from being transferred from one state to another in a virtual instant.¹⁴⁸ Emails containing sensitive information reach people living on the other side of the earth virtually instantly. Cloud storage containing personal data is accessible from almost anywhere. Thus, the breach of arbitral confidentiality and privacy by modern data technologies may be far more widespread and easier to transmit than the traditional violation of personal information through mails, telephones, and face-to-face conversations.

Third, and most importantly, Internet users, including arbitration stakeholders, are unlikely to have an adequate understanding of, or ability to avoid, the misuse of their personal data by Internet service providers that use advanced ICT technologies. As discussed above, those who intend to subscribe to digital services—email, cloud storage, and video conferencing platforms—are required to agree to the boilerplate terms and conditions drafted by those service providers. Such terms and conditions contain umbrella clauses that not only allow the service providers to use accumulated data for their business objectives but also offer them immunity or mitigation from liability for data breaches.¹⁴⁹ Indeed, the central controversy is whether service subscribers have fully understood and actually consented to the contents of those umbrella provisions.¹⁵⁰ The obstacle is that a user who ticks the consent box in a subscription agreement remains bound to that agreement unless it is nullified on grounds of a lack of informed consent to it, or because material clauses in the agreement are deemed to be unreasonable. Nevertheless, the majority of users would not be able to detect and/or establish the Internet giants’ data breaches because ‘data subjects are unlikely to know about the use of their data and are not dutifully informed about the conduct actually or potentially leading to abuse of that data’.¹⁵¹ The same goes for professionals in the arbitration industry, most of whom are lawyers with no distinctive expertise in Internet programming.¹⁵² The knowledge of digital technologies of some arbitration professionals may be greater than that of average Internet consumers. However, that knowledge is unlikely to persuade ICT service providers to confer the arbitration professionals special data transparency rights that they do not provide for other users of their services.

Most pertinently, the potential (ab)use or misuse of confidential/private information by ICT service providers in virtual space remains outside the regulatory scope of traditional confidentiality/privacy provisions contained in arbitration laws, even though the providers’ acquisition of such information conflicts with the doctrine of confidentiality and privacy. Arbitration rules and guidelines governing the use of digital technologies do not fill this legal gap.¹⁵³ By replicating somewhat the traditional notions of confidentiality and privacy, they largely presuppose that arbitration stakeholders—especially arbitration institutions, case administrators, arbitrators, attorneys, and users—have the means to prepare for and avoid potential data breaches. This presupposition is justified, but only in part. For instance, the ICCA-NYC Bar-CPR Cybersecurity Protocol for International Arbitration provides tribunals, parties, and administering institutions with a recommended framework for information security measures. These measures consist of access controls, encryption, communications security, and physical and environment security, among others.¹⁵⁴ The measures are effective in protecting arbitration from security incidents, such as malware infections, loss or theft of equipment, denial of service attack, and phishing attempts. However, the Protocol does not apply specifically to digital service providers, although sensitive data in arbitral proceedings are already under their control. Nor does it recognize that institutional arbitration stakeholders who drafted arbitration rules and guidelines on cybersecurity voluntarily provided tech companies with access to such sensitive data, despite the confidential/private nature of arbitral proceedings.

What remains inadequately addressed today is that traditional conceptions of confidentiality/privacy do not recognize that arbitration stakeholders who crafted security rules and guidelines understandably based them on traditional modes of protecting personal information. They did not adequately reflect at that time the current reality and practice of virtual data collection, storage, and transmission in international arbitration proceedings. The result is an ever more pressing need to update those traditional protections to maintain confidence in arbitration practice in an era marked by the widespread commercialization of privacy invasion in cyberspace. Given this situation, arbitration stakeholders should avoid using ‘party autonomy’ as an excuse for inaction to avoid the loss of credibility for failing to promote measures to protect sensitive personal information.

We do not suggest that arbitration stakeholders undertake a drastic overhaul of their arbitration rules and guidelines. Nor do we propose that they devise a new default legal instrument that comprehensively addresses the tension between confidentiality/privacy and data access by tech service providers. Such an overhaul, and its dependence on new soft-law instruments, would only exacerbate the formalization and fossilization of arbitral proceedings.¹⁵⁵ Indeed, ‘[t]he more rules or guidelines that are established, the more are the practical restrictions for and complications imposed on arbitral proceedings’.¹⁵⁶ Such restrictions and complications are also likely to undermine the efficiency and convenience brought about through the use of these new digital technologies.

We also do not claim that arbitration stakeholders should ignore the value of new technologies or over-emphasize their threat to cybersecurity. Nor should international commercial arbitration retreat to the age in which an arbitration involved the exchange of thousands of letters and documents across national borders. The contributions of tech giants to arbitration in this respect should be recognized as a valuable service which arbitration stakeholders demonstrate by voluntarily subscribing to their ICT services.

What is not advised, either, is that arbitration stakeholders draft harmonized rules on the (mis)use of confidential/private information by entities that store, process, and transmit arbitration information. Attempting to do so would be to fly in the face of legal divergence over fundamental components of data protection such as consent, over which legal convergence and harmonization remain contested.¹⁵⁷ Material is the need to acknowledge the power imbalance between arbitration stakeholders and Internet giants, including the capacity of the giants to undermine stakeholders’ attempts to regulate the use of personal data in relation to arbitral proceedings.

What is proposed is the recognition that advancing information technology poses threats as much as it provides benefits. Measures designed to protect personal and commercial data from misuse are themselves penetrated by technologies designed to bypass those protections. At risk are passwords, access codes, algorithmic buffers, and firewalls. Laws, rules, and guidelines can address these threats. Arbitrators can apply procedures and rules of evidence to identify them. However, they cannot readily avoid or remedy technology threats that are undetected or cannot be effectively redressed at a time when technological innovation outstrips regulation. This is not a new obstacle faced by legal and arbitration regulators attempting to catch up with the regulatory target. It does require that they adopt a function, albeit incremental pathway to establish a viable response.

Hence, the pragmatic approach is for arbitration stakeholders to add key provisions in their rules and guidelines to fill the gap between traditional and modern concepts of confidential and private data. One option is to adopt international guidelines to constrain the transmission of data relating to stakeholders, such as the UNCITRAL’s Legislative Guide on Insolvency Law and the World Bank’s Principles for Effective Insolvency and Creditor/Debtor Regimes.¹⁵⁸ Another is to opt for the seat of arbitration in jurisdictions in which privacy and confidentiality are extensively protected, including through proceedings against Big Data for their violation. The capacity to seek punitive damages against Big Data, beyond general damages, represents a further benefit in deterring such abuse. The most formidable threat to Big Data is nevertheless likely to reside in reputational damage to a closely owned data industry that is sensitive to adverse publicity and is keen to avoid recurrent legal claims against it.¹⁵⁹

A more direct means of protection from abuse by Big Data is to modify traditional rules governing confidentiality and privacy in response to the widespread reliance on virtual data collection, storage, processing, and transmission beyond arbitration stakeholders’ access and control.

A related choice is to pursue a contextual interpretation of and an amendment to the UNCITRAL Model Law on International Commercial Arbitration to encompass technologies more directly than was envisaged at the inception of the legal instrument. For example, article 19(1) of the UNCITRAL Model Law states that ‘subject to the provisions of this Law, the parties are free to agree on the procedure to be followed by the arbitral tribunal in conducting the proceedings’. This provision is likely to encompass speech processing by expert systems, robotics, and machine vision. What is uncertain is whether blockchain vision is included in machine vision under the Model Law.¹⁶⁰ An argument against including blockchain as machine learning is that such chains, consisting of automated technology in which a smart code directs the operation of the chain’s repetitive operation, use encryption to safeguard data. As such, the smart code itself dubbed a contract to regulate a block of contracts, arguably extending beyond machine learning envisaged under the Model Law.¹⁶¹ Arbitration stakeholders, especially large-scale institutions, regulators, and corporate clients, could formulate a formidable case for extending the scope of the UNCITRAL Model Law through the contextual interpretation of article 19. Failing that, the article could be revised to include smart codes and their blockchain learning within machine vision. Should the Model Law be so extended by interpretation or revision, it would provide significant support for arbitral tribunals to regulate the collection, storage, transmission, and use of confidential and personal data by Big Data, as well as by downstream collectors and users.¹⁶² These approaches are likely to be more efficient than drafting new guidelines from scratch.

Arbitration institutions and party stakeholders are also incentivized to adopt the UNCITRAL Model Law because article 19(1) recognizes the developing scope of AI as discussed above, albeit without expressly defining AI. However, article 19(2) does grant arbitral tribunals ‘the power to determine the admissibility, relevance, materiality, and weight of any evidence’. By inference, that wide power could be construed as including determination by AI that is used or misused by Big Data. It could also extend potential arbitral regulation to downstream cyber-operators collecting data for sale to competitors of arbitration stakeholders, or to third parties who exploit such data through cyberstalking and related civil and criminal action.

A further choice is for arbitration institutions to encourage the adoption of the seat of arbitration in forums in which the significance of AI and machine learning, broadly construed, and their legal implications arising in disputes, is well understood in law. For example, 15 U.S. Code § 9401 provides a comprehensive definition of AI as ‘a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments’.¹⁶³ 10 U.S. Code § 2358 adds: ‘An artificial system designed to think or act like a human, including cognitive architectures and neural networks. A set of techniques, including machine learning, that is designed to approximate a cognitive task’.¹⁶⁴ Armed with these definitions, arbitrators applying the U.S. Code are better able to identify the abuse of AI as an instrument of market dominance and control, or the disruption of both. What regulators are still unable to regulate effectively are sophisticated smart codes that are the sources of potential abuse.¹⁶⁵ However, the prospect of arbitrators becoming empowered to deter and punish such abuses is greater in a forum in which regulators provide a viable framework that enables arbitrators to redress such technological intrusions timeously and effectively. As a precautionary measure, arbitration institutions and associations could include their advisory rules in their protocols to identify prospective risks of ICT service providers misusing the private and confidential information of arbitration stakeholders, intentionally or otherwise; and to propose methods of avoiding such risks leading to breaches. The protocols could include stakeholders adopting mediatory measures, conceivably through the good offices of the arbitration institution responsible for the advising arbitration stakeholders. The protocol could also provide cautionary advice on the cost and delay in arbitration parties suing an ICT service provider; and interruptions on ongoing arbitration proceedings in so doing.

Adopting such advisory measures is more realistic in practice than arbitration stakeholders seeking to direct mega-data ICT providers to create exceptions to their rules governing consent to the use of the data subjects’ personal data, for the benefit of arbitration stakeholders. Purporting to require provisions for such exceptions is also unrealistic, given the omnipresence of global Internet service providers, like Microsoft, operating well beyond arbitration servicing. A practical aim is also to avoid drawing arbitration institutions, arbitrators, attorneys, and parties into endless blame-allocating and shifting games directed at determining whether, when, or how to render arbitration stakeholders and/or virtual service providers liable for breaches of confidentiality/privacy. Engaging in such action is most likely to increase significantly both institutional and arbitration costs, and, most often, be ineffective as a remedy. Reframing arbitration rules and guidelines to enable arbitration parties to comprehend better the risk of service providers misusing or abusing their personal information is also important as it is more straightforward and reliable to maintain data security than attempting to redress technology giants’ violations of arbitral confidentiality and privacy ex post facto.

Note, however, that these proposals may offer tentative solutions at best and inevitable compromise with significant concessions at worst. A more drastic and permanent reform can be achieved through direct negotiations between arbitration stakeholders and ICT service providers on the latter’s use and retention of arbitration-related information. The stakeholders are encouraged to participate in the negotiations collectively because the negotiation power of each arbitration institution or association is minimal compared with that of the tech giants who have far greater capital and influence than most nation states. Arbitration stakeholders and ICT service providers are encouraged to agree, in advance of such negotiations, upon a protocol or declaration that ICT service providers refrain from monetizing confidential information on arbitration directly or indirectly. Arbitration stakeholders acting collectively should also reach advanced agreement on the desired limits of ICT service providers’ data retention policy related to arbitration proceedings. That agreement should provide that arbitration stakeholders be given the option to request ICT service providers to permanently delete arbitration-related confidential information to prevent the latter from abusing or misusing it in the future. In any event, these negotiations cannot be concluded in a year or two due to the large number of parties involved,¹⁶⁶ so minimal but continuing revisions of the arbitration rules suggested above are more practical and efficient. Alternatively, arbitration stakeholders may force arbitration users to detach themselves from ICT service providers’ ecosystems by making their communication take place only in custom-built institutional case management systems like the SCC Platform. However, this option is unrealistic because third-party ICT services are inseparable from the saliency of technology in modern life and business.

6. Conclusion

Digital technologies have changed not only our daily lives but also the practice of international commercial arbitration. By exchanging emails, arbitration stakeholders no longer wait for weeks for the arrival of posted letters. Cloud storage allows them to reduce the physical space needed to store hundreds of case bundles encompassing thousands of pages. Video conferencing platforms enable them to reduce the number of international flights involved in organizing, attending, and running face-to-face arbitral proceedings, thereby reduce their carbon footprints.

The side effects of these advantages of virtual communication are complications in identifying alleged violations of confidentiality and privacy of arbitral proceedings through the collection, storage, and transmission of data by a small number of tech giants that dominate data collection, storage, processing, and distribution. Unlike violations of confidentiality and privacy prior to the development of the Internet, the (mis)use of personal data by tech companies has become ever more expansive and often not readily discernible. A negative consequence is that arbitration stakeholders often cannot identify or appreciate the scope of breaches of their sensitive data and the harm caused by those breaches. Moreover, such stakeholders often unintentionally consent to ICT service providers potentially misusing their personal data when they enter into subscription agreements with those providers.

However, it is unreasonable to blame arbitration stakeholders en masse for failing to protect arbitration users from new technologies that potentially violate their confidentiality and privacy. It is also unreasonable to place exclusive blame on tech giants who offer great convenience to arbitration stakeholders seeking to take advantage of new technology-driven world order. Abuse of confidentiality and privacy extends beyond arbitration stakeholders and tech giants, to multiple data collectors and processors who downstream such information for commercial or personal use. Still, the problem is that arbitration institutions and associations have not yet modified their pre-Internet rules and guidelines in response to such ever-expanding threats to the confidentiality and privacy of personal data.

There are realistic and efficient ways in which to redress these deficiencies. Arbitration stakeholders can modify their rules and guidelines to exclude their liability for potential data misuse by ICT service providers. They can devise advisory protocols to alert arbitration users about the risks of consenting to the use of both their personal and commercial data. They can also provide arbitration users with functional means of avoiding such misuse, through the choice of service provider and the manner and extent to which they engage in more secure data transmission and safer sharing in virtual space. That advice is still constrained by the market dominance of certain service providers that are difficult to avoid en masse. Arbitration stakeholders can identify the benefits of self-storage of personal data and limit its virtual transmission, although these benefits are offset by the document-intensive arbitration today in which arbitrators and parties exchange hundreds of emails containing critical and sensitive information. In the end, we need policy dialogues between arbitration stakeholders and ICT service providers on the protection of arbitral confidentiality and privacy.

Embarking on such initiatives on a global scale will raise costs. They will also entail ongoing collaboration among arbitration stakeholders, particularly in redressing divergences in protecting confidential and private data across legal systems within a decentralized world order. These global ventures will require recognition that technology giants, such as the Big Five, are unlikely to readily participate in such initiatives in the absence of commercial incentivization, or collective pressure from a group of influential business entities. The task of arbitration associations and institutions in securitizing confidential and personal data is formidable and pressing. The danger in their failing to do so timeously is to attenuate the exposure of arbitration stakeholders to a destructive global market in sensitive personal data in which commercial exploitation has evolved into highly profitable business enterprises. However, the first step should be for arbitration stakeholders to recognize openly the troubling and ongoing tensions they face in protecting arbitral confidentiality and privacy. From the perspective of Big Tech, that pursuit constitutes a futile search for an elephant in the room. For arbitration stakeholders, that pursuit constitutes a formidable but necessary challenge in protecting users within an unsettled digital order.

Footnotes

Annex 1. The scope and nature of confidentiality under the rules of arbitration institutions.

Annex 2. The exceptions to arbitral confidentiality under institutional rules.

Author notes