In recent NAFTA investor-state arbitral proceedingsTennant Energy LLC (USA) v. Government of Canada (PCA Case No. 2018-54) held at the Permanent Court in the Hague (PCA),claimant insisted on the GDPR compliance in the Procedural Order. Tennant Energy argued that since one of the arbitrators was a British national with their seat in the United Kingdom, and the PCA is regarded a supranational institution under EU data protection law, GDPR obligations arise whenever there is a transfer of personal data between the PCA and the tribunal. Canada refused to accept GDPR related provisions in the Procedural Order and claimed that NAFTA in its entirety fell outside the material scope of the GDPR, since the EU is not a member to this treaty. The arbitral tribunal sided with Canada by not applying the GDPR regulations to the procedure at the PCA, however it acknowledged the importance of ensuring a high level of data protection in the treaty-based arbitral proceedings.