Many of us store personal data in the “cloud” and most of us have worked for, or been a client of, a business that does so—sometimes with our consent, but often without it. Yet a growing number of constraints have been imposed around the world on information in the cloud, fueling concerns that the Internet—the economic engine of the information age—may become hopelessly fragmented.
Many countries now regulate where information can be stored and under which conditions it can be transferred abroad, often invoking the principle of equivalent protection for data privacy and security, which means data privacy protections in the country receiving the data must be at least as strong as those of the originating country. The trend toward restricting data storage to specific geographic boundaries is called “data localization.” While data localization is likely to characterize the Internet of the future, it will also likely create new opportunities for growth.
Regulatory Storms
In October 2015, the European Court of Justice ruled that the transfer of European Union consumer data to U.S. computer servers under the EU–U.S. Safe Harbor Agreement did not provide EU consumers with the equivalent protection they are entitled to under EU privacy laws. The overturning of Safe Harbor caused many to predict that the days of free and easy access to information between Europe and the United States had come to an end. Since then, a new agreement between the United States and the EU has been reached—but many concerns remain about the transfer of sensitive data across national boundaries.
Although EU laws provide consumers a much higher degree of control over their personal data than U.S. laws, the EU is not the exception, according to interviews we conducted with experts around the world. Almost every country, except for extreme cases like China and Russia, gives its citizens more control over their personal data than U.S. law provides. From the interviews, a consensus emerged: Individual national regulations governing data transfer and privacy will not significantly converge in the foreseeable future.
In examining the state of data and privacy regulation across the world, we observed:
- With comprehensive privacy rights enshrined in its founding documents, the European Union continues to lead and enforce data protection through its courts.
- The United States offers no similarly broad basis for digital privacy in its laws nor did we see signs of significant movement to provide greater rights to privacy of digital data.
- Latin American countries—while formally guaranteeing many of the same rights as their European counterparts—have been largely unable to effectively enforce them, but future improvements are expected.
- Both Russia and China appear to be moving toward greater isolation of their digital infrastructures and have been restricting cross-border information movement in recent years.
While national regulations will likely be a significant force that leads to greater data localization, not all forces leading toward data localization are regulatory. Consumer preferences for data privacy, national security concerns, liability concerns of business entities and even the growth of data streaming and voice applications will also drive the need for data localization services. Specific industries to service those needs should see significant growth, as outlined below.
Given these developments, market demand should grow for local or regional data centers and for software or hardware that facilitates geographic localization. It also should increase demand for services that audit the geographic routing of data, authenticate access to data, and provide more convenient and secure encryption of data both at rest and in transit.
Entrepreneurs who embrace these new market forces will likely thrive in the emerging digital era of greater data localization.
Marlon Graf, Jakub Hlávka, and Bonnie Triezenberg are assistant policy analysts at the nonprofit, nonpartisan RAND Corporation and doctoral candidates at the Pardee RAND Graduate School.
Commentary gives RAND researchers a platform to convey insights based on their professional expertise and often on their peer-reviewed research and analysis.