Industry Trend Analysis - Free Trade Agreements Must Also Consider Free Data Flows - JUNE 2017

BMI View: Increased digitisation means using and processing personal data has become part of many companies' daily routine. However, many countries have put restrictions on the free flow of data, with privacy, security, surveillance and protectionism core reasons for these restrictive measures. We expect greater focus to be put on free data flows as part of free trade agreements, as well as its impact across many sectors.

The increased use of digital services across all economic sectors has meant that data has become a key tenet of many companies' strategies. This not only includes online players or similar, whose livelihood is based purely on processing and analysing data, but a range of other companies which are making the shift from providing a product to providing a service. However, this has been accompanied by growing restrictions regarding data flows across borders, and the rise of data sovereignty/localisation. The OECD reports that restrictive measures have grown from 10 in 2004 to 60 in 2014, highlighting four main categories of measures restricting data (see table). We believe there are four main issues driving that trend, whose impact ranges from the tech market to digital trade flows.

Measures Restricting Data
Category Definition
Source: OECD
Free No restrictions on either the flow or storage of data
Conditional Flow Restrictions Requirements to be met prior to data transfer, such as prior consent or recognition of adequate data protection standards
Local Storage Data must be stored locally but transfers allowing foreign processing could still take place. Transfers may or may not face flow restrictions
Flow And Storage Prohibition Data must be stored locally and cannot flow across borders

We believe there are four main reasons for the rise of data sovereignty/localisation:

  • Privacy: countries will mandate that data is stored and/or processed domestically, to ensure that the protection of their citizens' personal data is safeguarded, which might not be the case in other countries;

  • Security: countries will mandate that data is stored and/or processed domestically, to ensure that personal data is protected at the highest possible threshold against cyberattacks and cybercrime;

  • Surveillance: countries will mandate that data is stored and/or processed domestically, so that surveillance authorities can gain easier access to personal data; and,

  • Protectionism: countries will mandate that data is stored and/or processed domestically, so that domestic companies have an advantage over their foreign competitors.

All of these have been used in several countries already, for example:

  • In the US, where the Patriot Act mandates that the data of US citizens must be stored in the country. The US authorities are also looking to use the dominance of US online companies to gain access of foreign citizens' data, even if stored abroad. A case brought by Microsoft, regarding the use of its servers in Ireland, has backed the principle of territoriality, but the judicial process may start again;

  • In the EU, where despite having a single framework for data protection with the General Data Protection Regulation (GDPR), free flow of data within the bloc is still restricted. The Commission is looking to remedy the situation, but several markets, including Germany and France, have a strong focus on data protection (especially the former), while there are also some surveillance considerations;

  • In China, where the new Cybersecurity Law cements the government's goals to preserve data sovereignty and will ensure Chinese dominance in the cloud computing and datacentre space domestically, a form of protectionism;

  • In Russia, where LinkedIn was forced to stop services after it refused to store data domestically, part of a pattern favouring domestic online players against their online rivals. Surveillance is another key reason for keeping data in Russia;

  • In Turkey, where PayPal stopped services after a new law mandated financial services to keep their data domestically. There has also been greater government control of online players, with YouTube or Twitter blocked sporadically.

These restrictions have already had an impact, none more so than in the agreement governing data transfers between the US and the EU. The European Court of Justice invalidated the previous agreement, the Safe Harbour, as it did not offer European citizens adequate protections against the US surveillance authorities. Its replacement, the Privacy Shield, proposes some remedies, but will still face scrutiny from the courts. Equivalence is extremely important in agreements regarding data flows, as it is imperative that personal data must receive the same level of protection as it has domestically.

Ensuring free data flows will be a key component of any future trade agreements, especially when dealing with services. The Trans-Pacific Partnership, before the new US administration pulled the agreement, ensured free data flows amongst the different signatories, while the issue is also a key part of the negotiation between the EU and Japan regarding their own free trade agreement. But the issue of free data flows goes beyond free trade agreements. Restrictions can be akin to a new tariff, where it is more costly for a foreign new entrant to enter a market mandating domestic storage, while it can also increase cyber-risks, by storing data in facilities less equipped to deal with sophisticated attacks. It also provides a barrier to greater digitisation of the economy, by increasing the cost of using connectivity across many sectors.

Related Articles

  • ' New Cybersecurity Law: Cementing Data Sovereignty ' , November 17 2016

  • ' Data Protection Could Be Weakened By Competing Regulation ' , January 11 2017

  • ' Data Sovereignty A Risk To Cloud Market ' , January 23 2017

  • 'US Datacentre Market Set For Strong 2017 ' , January 30 2017

  • ' Trump Protectionism: Threats And Opportunities For Electronics Manufacturers ' , February 15 2017

  • ' US Protectionism: Industry Impacts At Home And Abroad ' , March 16 2017

  • ' IoT & Big Data In Europe's Agribusiness: Iron Curtain Divide ' , March 16 2017