Data localisation, what is it and what are its potential implications? (JAPAN)

7 Dec 2023 15:00h - 16:30h UTC

official event page

Table of contents

Disclaimer: This is not an official record of the UNCTAD eWeek session. The DiploAI system automatically generates these resources from the audiovisual recording. Resources are presented in their original format, as provided by the AI (e.g. including any spelling mistakes). The accuracy of these resources cannot be guaranteed. The official record of the session can be found on the UNCTAD website.

Full session report

Gareth Tan

Data localization has become a major concern for small and medium enterprises (SMEs) in Southeast Asia. Recent cybersecurity mandates, like Indonesia’s amendment of GR71, requiring storing personal identifiable information in government data centers, have posed challenges for SMEs. These challenges include increased compliance costs, due diligence obligations, and restricted access to digital tools. Consequently, the sentiment around data localization is mostly negative.

To address SME concerns, policymakers need to engage with them to understand their limitations and worries regarding data localization. SMEs do not seek to avoid regulations but require advance notice and consultation during the regulation-making process. The withdrawal of a draft executive order on data localization in the Philippines highlights the importance of stakeholder engagement and consultation.

Transparency and certainty are crucial for effective business planning and sustainability. Abrupt policy changes can harm businesses, including SMEs. Therefore, greater transparency in the regulatory process and clear guidance for businesses are needed.

Improvements in the consultation process, particularly for SMEs, are necessary. Limited response time and abrupt consultations hinder SMEs from providing valuable input. Southeast Asian governments have room for improvement, ensuring SMEs have sufficient time and resources for effective participation.

Data localization requirements burden SMEs with compliance costs and shrink profit margins. Even if it is just a copy stored locally, it still adds to the compliance burden. SMEs have to allocate additional resources to comply, impacting their profitability.

In conclusion, data localization has significant implications for SMEs in Southeast Asia. Policymakers must engage with SMEs to understand their concerns. Transparency, certainty, and improved consultation processes are necessary. However, the compliance burden on SMEs should be acknowledged. Considering these aspects will facilitate a smoother transition to data localization and better support SMEs in the digital age.

Javier Lopez Gonzalez

Data localization measures, which require data to be stored and processed within a country’s borders, have been implemented in various sectors, including finance, public services, telecommunications, and cloud computing. However, only 32% of these measures apply in a cross-cutting manner. The impact of data localization measures is debated, with proponents arguing that they can promote domestic innovation, privacy protection, and data security. However, businesses are skeptical about these benefits. It is worth noting that the most restrictive form of data localization measures is evolving rapidly. On the other hand, there are concerns about the negative consequences of these measures. Operational costs can increase due to local storage requirements, and data localization can pose risks to cybersecurity and data resilience. To strike a balance between data localization and the free flow of data, policymakers should carefully consider the policy objectives they aim to achieve. Trade agreements play a crucial role in addressing data localization while maintaining open markets. Alternative solutions, such as federated learning and digital economy agreements, can promote greater data sharing without compromising privacy. Overall, data localization measures require thoughtful implementation, taking into account various factors and considerations.

Audience

During the discussion, several key points regarding data localization, data flows, and data privacy in trade agreements were explored. One argument focused on the potential risks of including language pertaining to data localization and data flows in trade agreements. It was highlighted that such language could exacerbate power imbalances between countries. The complexity and lack of understanding surrounding data issues were also cited as contributing factors. To illustrate this point, the example of disproportionate agricultural subsidies was given, demonstrating how complexity often works against less powerful countries.

On the other hand, there was a call for more nuanced regulation of data and its flow. It was emphasised that different types of data have different imperatives, necessitating a more nuanced understanding of how data should be regulated. The evolving dialogue towards this more nuanced understanding was highlighted as a positive development.

Concerns were raised about the lack of transparency and enforcement in terms of data use. It was stated that regulations and policies in place are not efficient enough, and data handling often remains unknown until there is a data breach or whistleblower interference. The recent example of the Information Commissioner’s Office in the UK attempting to fine Clearview AI over a breach of GDPR was mentioned as evidence of this problem.

The necessity for improvement in the transparency of data treatment was also highlighted. The issue of accountability, as mentioned by one of the speakers, was emphasised, as well as the problem of breaches occurring in another jurisdiction.

Furthermore, challenges in terms of cross-border enforcement and consumer redress were raised. There was a specific mention of a case where local courts ruled that the Information Commissioner’s Office (ICO) did not have jurisdiction over a breach because the data had been used in a third territory.

The discussion also touched on the need for more discussions with technologists to ensure the enabling of data flows of non-private data. Although privacy-enhancing technologies were acknowledged as a starting point, there was a call for more comprehensive security measures over data transfers, which could involve technological inputs.

One speaker disputed the notion that only the most extreme forms of data localisation are targeted by trade rules. It was suggested that all categories of data localisation could potentially be deemed illegal under certain trade rule proposals and models. This raised concerns about privacy infringement.

The power dynamics in digital trade negotiations were highlighted as having the potential to disadvantage certain countries, particularly those in the Global South. Despite knowing the value they bring to the negotiation table, other factors may still place them at a disadvantage. The example of Kenya was cited, where pressure is being exerted to change laws to allow free flows of health data, despite the country’s existing law allowing for data localisation in the health sector.

The importance of considering technological development in trade negotiations was underscored. It was noted that as the economy shifts to a digital economy, more small and medium enterprises (SMEs) are likely to become digital SMEs. In order for these SMEs to innovate and scale, diverse digital technology needs to be taken into account in negotiations.

Lastly, the necessity of incorporating a “necessity test” for language on legitimate public policy (LPP) or language in the Trade in Pharmaceutical Products (TPTP) context was emphasised. This point was raised as a common question from members.

In conclusion, the discussion highlighted the various complexities and challenges surrounding data localisation, data flows, and data privacy in trade agreements. While there were arguments for the regulation of data and nuanced understanding, there were also concerns about transparency, enforcement, and the potential infringement upon privacy. The power dynamics in digital trade negotiations and the importance of considering technological development were also acknowledged. The need for improvement in mechanisms for transparency, enforcement, and consumer redress was emphasised, as well as the consideration of different stages of countries in trade negotiations. Overall, the discussion underscored the importance of finding a balance between promoting data flows and protecting data privacy in trade agreements.

Wataru AIKAWA

Data localisation is a complex and contentious issue in digital policy-making, with numerous debates and policy discussions surrounding it. The panel on this topic consists of experts from various backgrounds, including international organisations, industry associations, tech companies, and policymakers. This diverse group of participants brings together different perspectives and expertise to address the challenges of data localisation.

The necessity test of data flow or data localisation requirements is a crucial component of negotiations. This test helps determine whether data should be allowed to flow freely across borders or whether it should be stored and processed locally. Understanding the positions of those advocating for strong policy space, such as privacy, is vital in shaping effective data localisation regulations.

There is a variety of data localisation requirements, ranging from mandating data to be stored solely in a specific country to requiring a copy of the data to be stored in multiple countries. The implementation of these requirements should be clear, objective, and transparent to ensure compliance and avoid misunderstandings.

The choice of data localisation measures depends on the policy objective. Some measures aim to restrict access to data from other governments, while others seek to ensure that the government has access to its own data. Identifying the policy objective is crucial in determining the appropriate approach.

Several factors need to be considered when discussing data localisation, including security interests and economic benefits. It is essential to evaluate these factors from both domestic and international perspectives to create effective and efficient regulations.

Trade agreements also play a role in addressing data localisation issues. While there are both value and limitations in including data localisation provisions in trade agreements, collaboration is necessary to find the best approach and deal with specific challenges.

In conclusion, data localisation is a complex and important topic in digital policy-making. It requires careful consideration of various factors, including policy objectives, security interests, economic benefits, and international collaboration. Clear and transparent regulations, based on empirical research and understanding of different viewpoints, are necessary to address the challenges posed by data localisation.

Hadri Sopri

Data plays a crucial role in the digital economy as it enables the seamless flow of information, leading to greater efficiency and economic gains. The availability of data allows businesses to achieve economies of scale and optimize their operations. Furthermore, data gains significant value when it is applied to solve specific problems. By leveraging data, companies can develop new products, business models, and industries, contributing to the growth and innovation of the digital economy.

Cloud computing is another important aspect of the digital economy as it can democratize access to technology. Through the cloud, companies can have access to essential tools and data needed to leverage technologies like artificial intelligence (AI). This accessibility promotes inclusivity and reduces inequalities, allowing businesses of all sizes to harness the potential of advanced technologies.

However, the practice of data localization can pose challenges to the digital economy. Data localization refers to the requirement for data to be stored within a specific geographic location. While this measure aims to protect data and prevent vulnerabilities in IT systems, it can undermine cybersecurity. Data localization prevents the sharing of data across borders, limiting the ability to detect and prevent cyberattacks. Moreover, it undermines best practices like sharding, which distribute data across multiple locations to enhance security and resilience.

Trust and understanding of new technologies are essential factors in implementing data localization measures. Many barriers to the flow of data are driven by a lack of digital trust and understanding of new technologies. Measures put in place to regulate data flows are often not fit for purpose and can hinder policy objectives. Therefore, building trust and promoting digital literacy are crucial in developing effective data localization strategies.

Instead of restricting data flows through measures like data localization, it is important to promote accountability and implement high data protection standards. This approach ensures that data can flow securely and be trusted by users and businesses. It is essential that these measures meet policy objectives, are interoperable, and do not impose undue costs on businesses. By prioritizing security and data protection, the digital economy can thrive while maintaining the necessary safeguards.

When it comes to trade policy and agreements, it is important to consider the diverse priorities and circumstances of different countries. Larger countries with existing infrastructure may have different calculations when it comes to the cost and benefits of data localization compared to smaller countries. Trade negotiations should be based on consultation processes that involve stakeholders and increase awareness of the rules associated with entering new markets. This certainty provided by trade rules enables businesses to plan and make entries into new markets, stimulating economic growth.

Flexibility in data localization rules is necessary to accommodate the specific needs and circumstances of each country. The implementation of data localization should take into account the potential benefits it can bring, such as enabling exports of digital industries. It is essential for countries to gather all necessary input before entering negotiations and ensure that the safeguards in place are suitable and effective. It is worth noting that big companies may not be significantly impacted by data localization, while smaller businesses can benefit by lowering their costs and entering new markets.

Digital agreements are crucial for technological cooperation and interoperability. Countries like Singapore and Australia have pioneered digital agreements that go beyond just setting rules. These agreements also facilitate cooperation and interoperability in using new technologies. Promoting interoperability allows different systems and technologies to work together seamlessly, enhancing the scalability and efficiency of digital processes.

Lastly, there is a growing appetite for new technologies and trade agreements. In the ASEAN region, digital payments have gained significant traction, and a few countries have collaborated on developing interoperable QR codes, which have proven to be successful pilots for new technologies. This demonstrates the willingness of countries to embrace innovation and explore opportunities for collaboration in the digital economy.

In conclusion, data is the lifeblood of the digital economy, driving efficiency, innovation, and economic gains. While data localization may have potential drawbacks, promoting accountability and high data protection standards can ensure secure and trusted data flows. Trade policy should take into account the diverse priorities and circumstances of different countries, with consultation processes leading to better trade negotiations and market entries. Flexibility in data localization rules is crucial, and digital agreements facilitate technological cooperation and interoperability. The appetite for new technologies and trade agreements is growing, as demonstrated by the success of digital payments and QR code technology in the ASEAN region.

Amy Stuart

Transparency is crucial in the implementation of new policies and regulations, especially in sectors like government services, finance, and healthcare that deal with sensitive data. It is important to ensure that these sectors have the necessary policy space for securely storing and managing data. Developing countries, in their pursuit of digital advancements, may impose data localization requirements, meaning that data generated within their borders must be stored locally.

Australia is a country that respects data localization measures. They hold childcare and healthcare records locally, demonstrating their commitment to protecting sensitive information. Additionally, Australia focuses on minimizing barriers that hinder global trading by adopting rules on data localization to enhance trade.

Australia values both non-binding norms and principles as well as binding rules. They have negotiated with countries like Singapore and the European Union to find common ground and achieve flexible and cooperative policy development.

Feedback loops are essential in the policy-making process. Australia emphasizes the importance of receiving input and learning from experiences to improve. Their investment approvals process has evolved to provide more opportunities for front-end planners to present their data management plans based on feedback.

Contrary to concerns, data localization measures have not significantly hindered the U.S. big tech economy, which holds two-thirds of the internet’s market cap. These companies have effectively navigated the complex bureaucratic requirements in different countries with the help of their resources, including ex-diplomats and trade officials.

In trade negotiations, Australia advocates for equality and engages in talks at the World Trade Organization (WTO) to address issues such as unfair agricultural subsidies. They are committed to achieving fair and equitable trade agreements.

Consumer protection is another priority for Australia. They are working on rules to combat deceptive online activities and improve the transparency of goods sold on the internet. Their ambitious consumer protection initiatives aim to enhance the overall online shopping experience and address concerns about misleading practices.

Trade rules often target severe data localization measures, but it is important to consider non-conforming measures (NCMs) that allow significant policy space in areas such as health, education, and investment screening. By taking these measures into account, trade rules can strike a balance between data localization concerns and broader public policy objectives.

Power dynamics in trade negotiations are changing, with developing countries representing over two-thirds of the members involved in negotiating digital rules at the WTO. This shift highlights the need to consider a broader range of perspectives and priorities in trade discussions.

Lastly, persistence and ongoing engagement are crucial in the negotiation process to achieve visible outcomes. Group dynamics in negotiations provide more opportunities and a better understanding of different policy dimensions.

In conclusion, transparency, respect for data localization measures, minimizing trade barriers, and a commitment to equality and consumer protection are key aspects of Australia’s approach. By embracing both binding rules and non-binding norms, and actively seeking feedback and input, Australia strives for effective and well-rounded policy-making in the global context.

AS

Amy Stuart

Speech speed

180 words per minute

Speech length

2728 words

Speech time

910 secs

A

Audience

Speech speed

199 words per minute

Speech length

2302 words

Speech time

694 secs

GT

Gareth Tan

Speech speed

184 words per minute

Speech length

1890 words

Speech time

618 secs

HS

Hadri Sopri

Speech speed

205 words per minute

Speech length

3000 words

Speech time

878 secs

JL

Javier Lopez Gonzalez

Speech speed

214 words per minute

Speech length

2964 words

Speech time

831 secs

WA

Wataru AIKAWA

Speech speed

119 words per minute

Speech length

3296 words

Speech time

1660 secs