Data localization, a term invented less than a handful of years ago, is getting a lot of attention—both for good and bad. The draft of the Democratic party platform includes a commitment to oppose data localization across the world, so that’s good. The fact that the party has to do so is distressing, indicating that data localization has become increasingly popular in some parts of the world. Opposing data localization should be a bipartisan endeavor, and Republicans this week should speak out against it because data localization harms freedom of speech, economic growth, and a free and open internet.
Data localization is a government requirement that data should physically stay within a particular jurisdiction’s boundaries, perhaps subject to limited and onerous exceptions. For example, Russia passed a data localization law in 2014, requiring that data about Russians be held on a server within that country (though copies of the data can be moved abroad). While the Russian government justified it as necessary to mitigate U.S. spying and defend the country’s “digital sovereignty”, the law seems designed to help Russia’s own intelligence services by keeping information about Russians within their easy reach.
Data localization not only helps local spies, but can be a good way to impede competition from abroad. Foreign companies face three unattractive options: (1) bear the costs of either building out new server facilities or renting space on local servers in each of the countries requiring data localization; (2) quit those markets; or (3) ignore the obligation and hope to escape scrutiny.
These choices harm not only technology companies, but all companies, from General Electric to accounting firms to the local plumber. All companies hold data—about customers, employees, and visitors to their websites or mobile apps. Car companies increasingly receive data from their vehicles—witness Tesla’s remote monitoring of all of its car crashes. The town plumber too may store information about his or her customers often using a foreign cloud-based service. Data localization applies to all companies that gather data on individuals, meaning nearly all large and even small companies operating today. Localizing data in those foreign countries also means segregating data by country of origin, limiting the ability to do cross-country analytics. The largest companies are the ones most likely to be able to build out local data infrastructures; it is the small and medium sized companies who will either withdraw from markets or simply violate the law, unable to afford to comply. Local start-ups will find their choices of cloud and other service providers narrowed, and their expenses increased while their flexibilities are decreased.