Data localization
Data localisation or data residency law requires data about a nations' citizens or residents be collected, processed, and/or stored inside the country, often before being transferred internationally, and usually transferred only after meeting local privacy or data protection laws, such as giving the user notice of how the information will be used and obtaining their consent.[1]
Data localisation builds upon the concept of data sovereignty that regulates certain data types by the laws applicable to the data subject or processor. While, data sovereignty may require records about a nations citizens or residents follow its personal or financial data processing laws, data localisation goes a step further in requiring that initial collection, processing, and storage occur first within the national boundaries. In some cases, data about a nation's citizens or residents must also be deleted from foreign systems before being removed from systems in the data subject's nation.[1]
Motivations and concerns
The push for data localisation greatly increased after revelations by Edward Snowden regarding United States counter-terrorism surveillance programs in 2013.[2][3] Since then, various governments in Europe and around the world have expressed the desire to be able to control the flow of residents' data through technology. Some governments are accused of and some openly admit to using data localisation laws as a way to surveil their own populaces or to boost local economic activity.[2][4][5]
Technology companies and multinational organisations often oppose data localisation laws because they impact efficiencies gained by regional aggregation of data centres and unification of services across national boundaries.[2][6] Some vendors, such as Microsoft, have used data storage locale controls as a differentiating feature in their cloud services.[7]
International treaties and laws
While the Trans-Pacific Partnership included language that would have prohibited data localisation restrictions among participants,[8] the treaty was abandoned and never took effect.
After Germany and France either passed or nearly passed data localisation laws, the European Union is considering data localisation restrictions in 2017.[9][10] Data localisation laws are often seen as protectionist and would thus violate European Union competition law.
Data localization laws and scope
National laws
- Australia – health records[2][3]
- Canada in Nova Scotia and British Columbia – public service providers: all personal data[2][3]
- China – personal, business, and financial data[1][2]
- Germany – telecommunications metadata[11][12]
- Indonesia – public services companies must maintain data centres in country[3]
- Kazakhstan – servers running on the country domain (.kz)[2]
- Nigeria – all government data[2][3]
- Russia – all personal data[2][3][13]
- South Korea – geospatial and map data[2][3]
- Vietnam – service providers usage data[2][3]
National security
Most nations restrict foreign transfer of information that they consider related to national security, such as military technology.
See also
- Data governance
- Data sovereignty
- Information privacy (data protection)
- Legal aspects of computing
- Privacy
- Privacy law
References
- ^ a b c "Data Localization Laws: an Emerging Global Trend". Jurist. 6 January 2017.
- ^ a b c d e f g h i j k "Data Nationalism". Emory Law. 2015.
- ^ a b c d e f g h "A Primer on Russia's New Data Localization Law". Proskauer. 27 August 2015.
- ^ "Risky Business: Data Localization". Forbes. 19 February 2015.
- ^ "Silicon Valley tech execs: Surveillance threatens digital economy". Palo Alto Online. 9 October 2014.
- ^ "Google Pushes Back Against Data Localization". The New York Times. 24 January 2014.
- ^ "Will Data Localization Kill the Internet?". eCommerce Times. 10 February 2014.
- ^ "Trans-Pacific Partnership will ban data localization laws". Fed Scoop. 5 October 2015.
- ^ "Ansip promises EU rules on data flows by autumn". Euractiv. 5 October 2017.
- ^ "European Commission eyes an end to data localization in EU". IAPP. 12 January 2017.
- ^ "Data Residency Requirements Creeping into German Law". Bloomberg Lawdate=11 April 2016.
{{cite news}}: Cite has empty unknown parameter:|1=(help) - ^ "German data storage laws 'threaten free trade'". DW. 1 December 2017.
- ^ "Russia – New data localisation law: Current state of play". 8 December 2014.
