“All Gaul is divided into three parts,” Julius Caesar famously wrote in his account of Rome’s Gallic Wars. Two thousand years later, there is a global policy battle underway over how countries should treat cross-border data flows, and it too is divided into three tribes: Data nationalists, including Russia and China, insist on data localization, believing that it is necessary to ensure national and economic security.
Data interventionists, especially the European Union, erect barriers to data flows unless other countries agree to their terms. Data liberals embrace the global free flow of data, recognizing that legal responsibilities can accompany the data wherever it goes and that data flows are critical to modern trade and innovation.
Unfortunately, data liberals are losing ground as barriers to data flows continue to spread. To respond, nations embracing data liberalism, especially Australia, Japan, New Zealand, Singapore, the United Kingdom, and the United States, should work collectively to develop new rules to support data flows and more forcefully resist efforts to limit data flows.
Data Nationalists: “Data localization is necessary because [economy/security/privacy]!”
Data nationalists prioritize government control over data, arguing that data localization is necessary to protect economic and national security interests. China and Russia justify their restrictive data rules on the principle of cyber sovereignty, where a government can essentially take whatever action it deems necessary with respect to data.
Both force firms to only store data locally (a concept known as data localization). Russia has demanded that online services store data locally in part so that the government can exert greater control over
these businesses, such as to censor social media platforms. China has enacted dozens of laws and regulations making data transfers illegal or prohibitively complicated and costly. Arbitrary enforcement and uncertainty about how these laws work makes firms risk averse, leading them to store data locally even if they could potentially transfer it (a concept known as de facto data localization).
And while China has enacted a range of sweeping new digital and data-related laws (such as its Cybersecurity Law, Personal Information Protection Law , and Data Security Law), none of them create meaningful constraints on the government’s ability to access this locally stored data. Other nations, such as India,
Pakistan, Turkey, and Vietnam, are following suit in enacting similarly restrictive data policies.
Data Interventionists: “Adopt our rules, or else we’ll impose data localization!”
Data interventionists believe that data flows should be conditioned on other countries harmonizing their rules to the interventionists’ preferred policies on issues such as privacy or data sharing. These countries set strict rules for the collection, use, and transfer of data and cut off data flows to any country that does not adhere to their approach. Data interventionists use data flows as a bargaining chip to impose their (restrictive) data economy policies on other countries.
The EU is the leading data interventionist. It wants to force its own restrictive approach to data privacy—under General Data Protection Regulation (GDPR)—on other countries via “adequacy”
determinations (where it judges their approach privacy against GDPR). Adequacy determinations allow firms from another country to transfer EU personal data back to their home country.
The EU’s slow, vague, and politically driven country-by-country adequacy determinations is central to its efforts to try to use market access as a carrot to get other countries to copy their approach. While GDPR has undoubtably had a broad impact on global data privacy discussions and policies, with many countries adopting and adapting parts of it, it has had far less success in forcing other countries to fully adopt it with hardly any new adequacy determinations.
EU-style data interventionism verges on data imperialism, especially as the list of countries that willingly subject themselves to adequacy negotiations shrinks and more firms from developing countries try and engage in digital trade with the EU by copying the GDPR, despite it being a poor fit for their countries.
While data privacy is the clearest example of the EU’s data interventionism, it won’t likely stop there. The EU is now considering creating a conditional flow framework for non-personal data. Likewise, the EU could very bludgeon other nations into adopting its emerging AI and cybersecurity frameworks.
Data Liberal: “No data localization—let data flow freely!”
Data liberals support the free flow of data. These countries recognize that data flows are a force for good and that legal responsibilities can move with the data as firms can be held accountable according to local laws regardless of where the data is transferred.
Data liberal countries value the role of an open, competitive, and rules-based global digital economy and are working together to enact new norms, rules, and frameworks to support the critical role of data in today’s digital economy. Where the flow of data raises legitimate issues (such as assuring regulatory access to data for regulatory oversight), these countries enact new agreements with likeminded countries to address the underlying issue (namely regulatory access) without restricting the movement of data.
Critics of data liberals misunderstand that enacting new global rules around data and digital trade is not mutually exclusive from them enacting sensible, balanced laws on data privacy, cybersecurity,
competition policy, and other data-related issues at home. Australia and New Zealand are both leading data liberals and they are not labor, human rights, consumer rights, or regulatory scofflaws. Their global leadership on digital trade hasn’t stopped them from updating data privacy, cybersecurity, and other laws and regulations.
They, and other data liberal countries like the United Kingdom and Singapore, use new digital trade and economy agreements to deepen international regulatory cooperation as this is
what is truly needed with a globally distributed technology like the Internet. These agreements aim to build better regulatory alignment and interoperability on new and existing data policy issues—it is not
some “race to the bottom” as the ideological opponents of these efforts try and portray them.
Data Liberals Unite!
The debate over data flows will shape the future of the global digital economy. If the United States wants to build a future where data can flow freely between nations to foster commerce and innovation,
it should work to not only build a global alliance among data liberals, but also work to convert data interventionists to their agenda, who at least agree in principle with the free flow of data.
Nigel Cory (@nigelcory) is associate director of trade policy at the Information Technology and Innovation Foundation. Daniel Castro (@castrotech) is vice president of ITIF and director of the Center for
Data Innovation.
