Data localization accelerates globally as privacy is linked with data transfer restrictions
The truism that “data is the oil of the 21st Century” is due for Version 2.0. Increasingly, data is more than a commodity: It’s a currency.
As the value of the big data analytics market zooms past an estimated $140 billion annually, countries around the world are tightening their grip to keep data on servers within their national borders. Data localization is increasingly impeding the flow of data across national borders as countries address concerns about privacy, security and the power of a few US-based Internet giants — and as countries assert their own parochial interests
A host of recent government and think tank studies and surveys document the accelerating global trend. The Office of the US Trade Representative recently released its 2021 report on digital trade barriers listing the European Union and 19 nations — large democracies such as Brazil and India as well as smaller states such as Ecuador and Kenya — as having data localization measures that could be barriers to digital trade.
Just five years ago, the same report listed only a single nation, Indonesia, as having data localization measures worrisome to the US. No longer is localization confined to authoritarian states, such as Russia and China, that want easy access to their people’s data and electronic communications.
A recent report by the Organization for Economic Cooperation and Development identified data localization measures in 40 jurisdictions, including the EU and countries in Africa, Asia, and the Americas. OECD said localization is being driven by countries’ “inward-looking policies,” a trend likely to be amplified by the Covid-19 pandemic. Concerned about the risk to international data flows, OECD is developing international principles to define appropriate government access to personal data stored by private companies.
Data localization measures raise the cost of hosting data because the Internet enables centralized data storage and processing; they may drive up costs by forcing companies to disperse their data by building data centers that otherwise wouldn’t make economic sense.
Data localization rules could also affect consumer choice and reduce competition. Big companies such as Facebook have warned that without the ability to easily transfer data, features such as its Newsfeed could become impossible to serve up to users. But Facebook’s smaller competitors could be hurt too. Snap warned in a securities filing in recent days that it might have to pull its Snapchat social network service out of some countries because of the regulatory burden of localization rules.
One of the few rivals to Facebook’s dominance in social networking, Snap warned that localization could lead to a “withdrawal by us from certain countries,” reducing the company’s audience and ”giving our competitors an opportunity to penetrate geographic markets that we cannot access.”
Even as data localization becomes a global phenomenon, it still has no precise and universal definition. However the concept is defined — some politicians have embraced the term “data sovereignty” — a government’s attempt to bind data to its soil is often a strikingly ineffective response to legitimate concerns.
Privacy advocates are also increasingly concerned that laws intended to protect the privacy and security of data are instead driving data localization, whether or not that was the intent. The International Association of Privacy Professionals noted a striking and rapid drop in the share of members from 2019 to 2020 that manage their data globally, and a corresponding increase in the share of members who segment their data geographically.
Those dates straddle the European Court of Justice’s “Schrems II” decision, which nullified the EU-US Privacy Shield because of the data transfer framework’s non-compliance with Europe’s General Data Protection Regulation.
