Localisation laws imperil the internet

The great economic contribution of the internet has been to accelerate the exchange of data around the world. By making organisations more productive and markets more efficient, and broadening economic participation, this has added 10.1% to global GDP in the decade leading to 2014, according to a study by the McKinsey Global Institute.

This flow of data, enabled by the internet, was the catalyst that drove the latest wave of globalisation. But just when the public mood in many countries is turning against globalisation, these global data flows are also under threat, in part from the fragmentation of the rules that govern the internet.

Not only does this jeopardise the growth of the global digital economy, it could also limit the internet’s potential as a means of communication that helps overcome cultural differences. Both of these are worth fighting for.

Privacy, protection and perpetrators

Perhaps the biggest blockages to the global flow of data are so-called data localisation laws that oblige companies to store data about citizens within their country’s borders. These laws are often the result of diverging rules on privacy and data protection, ostensibly at least.

In the West, the digital economy is dominated by US-owned services that create value from the collection and analysis of user data. However, the speed and scale of this data collection prompted many countries to introduce stricter privacy protections than those in the US, and some have introduced data localisation policies to ensure these are adhered to.

Another factor driving data localisation is the growing role of data in criminal investigations and national security. The protocols for law enforcement agencies and regulators to extract data from companies based abroad are cumbersome, so some governments demand that data are kept within reach of the relevant authorities. This includes digitally progressive countries such as Sweden, where the Financial Services Authority requires “immediate” access to financial data.

One of the most far-reaching data localisation laws was introduced in Russia in 2015. It mandates that all companies that collect personal data pertaining to Russian citizens must store it within the country.

The most apparent impact of this law was on the US technology giants. Apple kowtowed, and took space in a Russian data centre. LinkedIn, which refused on the grounds that it doesn’t have a business operation in the country, found its website blocked.

Daniel Castro, vice-president at the Information Technology and Innovation Foundation (ITIF), a US think-tank with large US technology companies numbering among its funders, says these laws are more damaging for smaller firms, which do not have the resources to set up local facilities.

These laws may also deprive citizens of access to valuable services, he says. Citizens of countries that require medical data to be stored locally, for example, may be denied access to cloud-based healthcare systems if service providers cannot afford to operate locally.

ITIF sees this hindrance to international business as a feature, not a bug, of data localisation policies. It attributes some examples, such as South Korea’s requirement that companies receive citizens’ consent before moving their data offshore, to pure “mercantilism”.

Mr Castro is even more critical of the EU. The EU’s General Data Protection Regulation (GDPR) obliges any company, regardless of origin, that sells products and services in the EU to manage data about European residents in accordance with its privacy laws. These include a stricter definition of consent than companies have traditionally been required to achieve.

This, Mr Castro says, is “digital colonialism”. The EU is “trying to go around the world and tell everyone they have to abide by its data policy even if it's not to their advantage,” he says. “And I think it's troubling because Europe is using its economic power to achieve this goal.”

Border patrol

Ironically, GDPR is a pillar of the EU’s Digital Single Market strategy, which ITIF itself acknowledges is “a valiant attempt to remove barriers that inhibit digital economic activity”. GDPR replaces a highly fragmented system of privacy rules among EU member states, and in doing so will make it easier for digital businesses to operate across Europe.

The EU also plans to address barriers to cross-border data flows in future trade negotiations, according to a report by Reuters.

By definition, however, no single body working alone can counteract the fragmentation of rules governing data flows. Instead, it calls for multi-stakeholder dialogue and co-operation of the kind that helps keep the internet’s technical infrastructure running.

This is something an organisation called the Internet and Jurisdiction Policy Network is working to achieve. “If we go down the path of trying to find unilateral solutions in an unco-ordinated manner, it is clear that we will lose the cross-border benefits of the internet,” says the network’s co-founder and deputy director, Paul Fehlinger.

At its second annual conference in February 2018, the group agreed on a working plan (among others) to address the inadequacy of protocols governing the exchange of data for criminal investigations. The first task is to establish an agreed set of standards and procedures for data requests. These, it hopes, will help the design of new protocols that, in turn, remove some of the need for data localisation policies.

Meanwhile, the Internet Society, a US-based non-profit, has launched a project to extend collaborative approaches of internet governance to matters of policy and regulation.

The internet’s early proponents hoped that it would emancipate the world from national divisions. In 2018 that looks optimistic (not least because China seems intent on carving out its own slice of cyberspace), as does any hope that the internet would remove the need for businesses to navigate local rules and regulations.

But the potential of the technology to bring the world closer together is still great, and still unfolding. A renewed commitment to collective governance of the internet will help to counterbalance any nationalistic impulses that threaten to pull it apart.