There is an old saying in baseball that a strong defense is so fundamental that one does not appreciate or even notice it until the moment when one no longer has it. Likewise, free and unencumbered information flows over the Internet have become so fundamental to the way we now do business, find our news, learn new skills and even go on vacation that we no longer appreciate or even notice them.
However, data localization policies are a recent international development that, if they take root in enough places, will teach us, well and truly, to notice and appreciate our access to information. And they will do so in vivid and painful fashion.
While data localization has most recently and dramatically come to prominence in the form of Russian data localization legislation, at bottom it is a global issue. In fact, to date the Internet has linked the world’s information platforms so seamlessly that the effects of a successful data localization effort in any one major country or economy would make itself felt globally and immediately.
Quite ironically, what may seem at first to have been an act of spectacularly literal self-absorption may have an impact that ripples quickly and resolutely outward into other countries. In an interconnected world, it seems, an act of misguided introversion can indeed have an impact of which an extroverted malevolence of global ambition could only have dreamed.
While data localization has most recently and dramatically come to prominence in the form of Russian data localization legislation, at bottom it is a global issue.
As highlighted in the recent American Chamber of Commerce report entitled Protecting Data Flows in the U.S.-China Bilateral Treaty, in a further irony, there is reason to doubt whether data localization can actually achieve its intended goal of increasing information security. In fact, as the report argues, forcing concentrations of data storage in single or limited locations runs contrary to accepted information-security protocols and, therefore, may well have the effect of weakening information security.
In the coming months and years, it will be interesting to observe how the politically—and perhaps even emotionally—driven impulse for data localization will weather its encounter with the technical and economic realities that have caused the more sober and clear-eyed among us to argue against it. If the impulse survives that encounter, it will be interesting to observe what compromises to its original stances it will have to accept in order to press forward into the future.
The impulse for data localization is alive in China as well.
As always, cross-border data transfer restrictions have a practical impact that is often similar or identical to the objectives of data localization. In China, personal information protection laws and regulations have been enacted on a sector-by-sector basis, and cross-border data transfer restrictions are no exception. At this time, the strictest cross-border personal information transfer restriction—apart from notice and consent requirements—apply to:
- personal financial information,
- personal credit reference information and
- personal health information.
Aside from the foregoing, cross-border transfer restrictions are imposed under the Law on Protecting State Secrets, which restricts offshore transfers of media that has been identified and designated as containing information related to national security and national interests. Cross-border transfer restrictions are also suggested under nonbinding industry guidelines for the information-services sector and under guidelines for the formulation of laws and regulations to govern cloud computing.
Adopting data localization policies ... would thereby consign Chinese businesses in these industry sectors to the role of being late adapters rather than innovators in their own right.
Restrictions in more industry sectors can of course be added as new laws and regulations are enacted. Most recently, a draft Counter-Terrorism Law was circulated in 2014 that, if enacted in its original form, would require business operators in the Internet and telecommunications sectors to store data on servers in China and provide encryption keys to public security authorities. While this law remains in draft form, and was not passed by the National People’s Congress during its past March session, the prospect remains that the bill and its data localization terms could be promulgated in the near future.
This would be unfortunate.
Again as highlighted in the report, data localization policies have the effect of undermining innovation. Despite all the economic and technological advances that China has made in recent decades, for many important economic sectors, the engines of innovation and discovery still do not reside within China. They reside elsewhere, and therefore to participate in this innovation China’s own industries must—short of physically relocating themselves to these other countries—remain in close communication with them.
Adopting data localization policies would cut off China’s communications with these engines of innovation. It would thereby consign Chinese businesses in these industry sectors to the role of being late adapters rather than innovators in their own right. In the end, these Chinese industry sectors would find themselves simply awaiting and accepting innovations achieved elsewhere and then executing practical applications of them while others in the world have already commenced their next wave of innovation.
This has special relevance for China.
In the past, long periods of isolation from the rest of the world economy have placed China in positions of relative backwardness. China found herself in such positions not only in 1978 but also in 1839. The latter had vast consequences, as a long dearth of innovation left China unprepared for the moment when the world turned upside down, British military forces wielding superior technology stormed upon her shores to protect an illicit international narcotics traffic and the Celestial Empire was reduced to the position of being somebody else’s semi-colony.
Never again, China has promised herself, and would that it be so, and yet it must be clear by now that in order to remain strong and competitive against the rest of the world, China cannot isolate herself from it again. Data-localization policies can and should be opposed by those who want what is best for China, for her own sake, and want her to have the control over her own future that an openness to innovation stands to deliver.
photo credit: Great Wall of China via photopin (license)