The nature, evolution, and potential implications of data localization measures

How to find the key insights

Introduction; Identifying the nature and evolution of data localization

1. Though policy issues raised by data flows are diverse, a common challenge is the need to ensure that data crossing borders receives oversight and/or protection; the combination of enabling cross-border data transfers and ensuring transfers take place in the context of trusted relationships is known as data free flows with trust (DFFT); data localization is one important aspect of the regulatory environment impacting DFFT. (p. 4)
2. There is no single, widely accepted, definition of data localization; there is wide agreement that the consequence of data localization is more local storage or processing but there are different views as to what types of measures fall under the category of data localization; this paper defines data localization as an explicit requirement that data be stored and/or processed within the domestic territory. (pp. 5-6; Box 1)
3. Governments adopt data localization measures citing the need a) to protect privacy and data, b) to ensure access to information for regulatory purposes, c) to protect sensitive national security information, d) to ensure data security and integrity and continuity of critical systems, and e) to help develop domestic capacity in digitally intensive sectors. (pp. 6-7)
4. For data localization measures, the underlying objective is important for determining whether it is part of a justified public policy objective and whether the actual objective corresponds to the stated objective; it is important to assess whether the policy objective could be achieved in a less trade restrictive way; it is often difficult to assess the ultimate objective of a data localization measure. (p. 7)
5. Data localization measures vary widely but can be grouped into three broad categories (pp. 8-9, Figure 1):
   • Measures that require local storage of data without prohibiting storage or processing in other countries, to allow regulators jurisdictional reach (p. 8);
   • Measures that require local storage and processing but allow international access or transfers on the basis of clearly defined conditions (pp. 8-9, Box 2);
   • Measures that mandate local storage and processing of data while also prohibiting transfers to other countries (or only on the basis of ad hoc authorizations), these can apply to a range of data and are often less transparent and more ambiguous in scope of application (pp. 9-11, Box 3).

6. A fourth category about access rather than location is emerging, including measures where there is no requirement for data to be stored locally, but with requirements to guarantee access to data; emerging legislation covers non-sensitive data; conditions for access include notices of where the data might be stored; requirements for an agreement to exchange information to be in place; or requirements that records be kept according to domestic guidelines irrespective of where these are stored; this approach has been growing in recent years and these measures are largely applied by OECD countries. (pp. 11-12 and 15, Box 4, Figure 5)
   
7. The number of explicit data localization measures has increased: by early 2023 there were 96 measures across 40 countries in place and 4 draft regulations; nearly half of these measures have emerged after 2015; the measures are becoming more restrictive and by early 2023 more than two-thirds involved a storage requirement with a flow prohibition. (pp. 12-13, Figure 2)
8. Data localization measures are more prevalent across non-OECD countries, accounting for 70% of all measures; non-OECD countries are also more restrictive with 91% of measures in non-OECD countries involve storage requirements with flow prohibitions; the measure affect a diverse range of data and sectors, with 32% of measures having implications across all sectors of the economy; there are stark differences in how OECD and non-OECD countries approach regulation of certain types of data, with non-OECD countries taking a more restrictive approach even for non-sensitive data. (pp. 13-15, Figures 3-4, Table 1)

Identifying some of the implications of data localization for businesses

1. Businesses perceive that local storage measures with no flow restrictions can lead to increases in data management costs of around 16%; local storage requirements combined with flow restrictions lead to considerably higher costs of around 55%; 8% of businesses surveyed said that prohibitive data localization measures would stop their ability to operate internationally; around 70% of businesses did not think that data localization measures helped deliver other legitimate public policy objectives. (pp. 17-18, Figures 7-8)
2. Cross-border e-payments are payments conducted electronically where merchants and consumers are located in different countries; domestic payment systems are not directly connected internationally, so e-payments set in motion a complex system of interbank credits and debits relying on the movement of different types of data across borders. (p. 19)
3. The financial, banking or payment sectors face the highest number of data localization measures after cross-cutting measures, with a clear divide in approaches across OECD and non-OECD countries, with 12 of 17 specific measures identified arise in non-OECD countries, taking the most restrictive form. (p. 19)
4. The proliferation of data localization measures in the e-payment sector has led to an increase in the cost of operating domestically and across geographical borders; any form of local storage can be costly because keeping local copies of data requires duplicating measure to maintain high level of data security, implying significant additional capital and personnel costs; businesses in this sector prefer centralization of servers to reduce costs; for large markets the costs can be faced but businesses might reduce services or pass costs to consumers and in small markets business might choose to pull out of the market or reduce investment there. (pp. 19-20)
5. Indirect impacts of data localization measures in this sector include: reduced efficiency of e-payment systems; less secure and reliable e-payment systems subject to increased risk of cyberattacks; decreased competition in e-payment markets; increased risk of data loss from natural disasters and reduced resilience; reduced ability to detect and prevent fraud; negative downstream affects for small businesses; and uncertainty about regulation. (pp. 20-21)
6. Cloud computing allows users to rent IT resources, including computing power, storage, and database management, offering the ability to scale up or down activities without needing to undertake important capital investments; the use of cloud computing is growing and will continue to grow; cross-border data flows are integral to cloud computing as the cloud is a vast network of remote but interconnected servers located around the world that allow access to files and data from and Internet-capable device regardless of location. (p. 21)
7. Data localization measures are motivated by data safety, national security, respect for human rights, and ensuring government access to data in the event of judicial proceedings; some businesses perceive that these measures are intended to favor domestic cloud computing companies; 7 requirements have been identified to date. (pp. 22-23, Box 5)
8. Data localization requirements are problematic for cloud providers since location independence is a core aspect of the cloud delivery model; regulatory requirements push providers to increase transparency over server location; data localization requirements can lead to: 1) increased costs of providing cloud computing services; 2) negative impacts on downstream users; 3) reduction in the amount of services provided; 4) increased compliance costs given challenges navigating requirements apply to what kinds of data; 5) increased cybersecurity risks; and 6) increased risk of data loss from natural disasters and reduced resilience. (pp. 23-24)
9. Air travel data: Aviation is a data intensive sector; the ticketing process involves the collection, transfer, and processing of data across different countries; when passengers book a specific flight, Passenger Name Records with personal travel information are created and stored on computer reservation systems (CRS); for payments, third party payment providers or payment gateways are used, many of which are dependent on processing data across borders; information on CRS systems is integrated with airline departure control systems (DCS) and airport information systems; the DCS system also shares passenger information with international baggage tracking platforms; passenger information may also be shared with government agencies in countries passengers are traveling to or where they are transiting or overflying. (pp. 24-25, Figure 9)
   
10. The Convention on International Civil Aviation (Chicago Convention) governs international air transport rules, with a comprehensive network of bilateral air services agreements; sharing of passenger information is governed by Annex 9 of the Chicago Convention, which many ICAO members accept, but individual member states increasingly impose their own requirements on provision of such data; the aviation industry is subject to more cross-cutting requirements on business operations, including data transfer and data localization; as the sector handles large volumes of personal data, localization requirements also have substantial implications on the cross-border sharing of passenger information needed for international air travel. (p. 26)
11. Rules prohibiting or unduly restricting the ability to transfer passenger data internationally restrict passenger travel internationally; because of constant updates to passenger data and airline activity, it is essential that there is a single source of that information and in practice a single geographic location where that data is held; as a result, data localization requirements in certain countries will have very significant impact on how airlines operate in those countries, and at worst, might negatively impact decisions of airlines to fly to those countries. (pp. 26-27)
12. The aviation industry already has well-defined rules and standards in place for passenger data; cross-cutting data localization measures can affect business operations; there are growing uncertainties on the linkages with data protection and privacy rules in aviation; regulatory uncertainty can raise compliance costs and undermine efficient air transport services. (p. 27)

Identifying discussion points

1. International discussions can ensure that approaches to data localization deliver on justified public policy objectives in a least trade restrictive way, including through continued:
   • monitoring of the evolving regulatory environment;
   • discussion around moving towards less restrictive forms of data localization;
   • cooperation on data localization issues in dialogue with regulators, trade policymakers and other relevant stakeholders, including the private sector; and
   • efforts to realize global rules that address data localization and take into account justified public policy objectives while avoiding excessive fragmentation. (pp. 27-28)

Conclusion

The OECD trade policy paper provides a short, concise, and easily accessible summary of data localization requirements, trends, and the impact on select businesses and industries. It is a helpful and easy to use summary of an issue of growing importance in international trade and investment.

Download report

Complementary reports and analysis

Hinrich Foundation

• China’s data management: Putting the party-state in charge
• The greater good: Eight challenges to the global e-commerce boom
• The long road to a seamless global digital economy

External Resources

• US drops digital trade demands at WTO to allow room for stronger tech regulation – Reuters
  Is the US changing its policy approach to digital trade to allow more space for domestic regulation and policy-making?

• Digital Empires: A Conversation with Anu Bradford – Tech Policy Press
  How should nations regulate the digital economy and digital trade?

• The era of borderless data is ending – The New York Times
  Economies are increasingly working to control data within their borders.

© The Hinrich Foundation. See our website Terms and conditions for our copyright and reprint policy. All statements of fact and the views, conclusions and recommendations expressed in this publication are the sole responsibility of the author(s).