GNI-Freedom House Workshop: Data Localization and Human Rights

July 8, 2021  |  News, Policy

Overview

On May 7, 2021, GNI and Freedom House hosted a workshop on data localization and human rights. The workshop gathered a group of global experts, primarily from GNI’s membership and the Freedom on the Net community, to better understand the human rights impacts of the growing number of laws and regulations governing the storage and transfer of electronic data across national borders. 65 people participated in the workshop, with 19 representing companies and the rest coming from academia, civil society, and the investor community. This workshop was intended to help inform future work by Freedom House, GNI, GNI members, and the broader digital rights community on data localization.

Depending upon their design and implementation, data localization mandates can impact a broad range of human rights, including privacy, freedom of expression, freedom of association, personal security, and non-discrimination. The workshop offered an overview and discussion of the technical and legal dimensions of data localization requirements. It also featured discussion of companies’ experiences responding to them in various contexts.

Key takeaways from the discussions included:

• Governments have articulated various motivations for data localization mandates: privacy and data protection, including in response to concerns about privacy practices of third countries; existing limits to accessing digital evidence stored across borders; enhancing competitiveness of local companies.
• The degree to which data localization mandates can in fact help achieve these potential benefits warrants further scrutiny. These impacts can vary based on the legal and regulatory approach taken to matters such as the penalties for noncompliance, relationship to existing legal process for accessing user data, or any rules, standards, or exceptions that could help facilitate cross-border data transfers. Also relevant is the broader country context, such as the protection of privacy and other human rights in existing legal frameworks and general respect for the rule of law.
• One particularly relevant tactic that is increasingly correlated with data localization mandates is “personnel localization” or “hostage measures” that require companies to employ local staff who can be held personally liable for noncompliance.
• Companies must weigh these myriad contextual factors when considering the human rights impacts of data localization mandates and making decisions about market entry/exit. There are examples of significant penalties for failing to comply, up to blocking of a service altogether.
• Data localization mandates can be difficult to implement for services that store and transmit data in a distributed fashion. This is particularly true with respect to the growing number of cloud services.
• Data localization requirements may also have different impacts on data storage practices and human rights depending on the types of services (C2B, B2B, etc.) impacted and the ability of companies to protect data at rest and in transit.

Workshop participants identified areas for further research and advocacy, including better documenting and analyzing the impacts of data localization requirements and governments’ justifications for implementing them. Participants also agreed to push governments themselves to better analyze and articulate the potential human rights impacts of such rules and regulations.

Participating Organizations

Berkman Klein Center at Harvard Law
BT Group
Centre for Democracy and Technology
Centre for Communications Governance, National Law University, Delhi
Change.Org
Centre for Internet and Society, India
Cloudflare
Collaboration on International ICT Policy in East and Southern Africa (CIPESA)
Derechos Digitales
Media Research Association and Dokuz8NEWS
Domini Impact Investments
Facebook
Freedom House
Frontiir
Global Partners Digital
Google/Google Cloud
GW Law
Internet Bolivia
Internet Society
Internews
IPANDETEC
Microsoft/LinkedIn
Nanyang Technological University, Singapore
Orange
PEN America
Ranking Digital Rights
SMEX
Telefónica
Telia Company
Tik Tok
Verizon
WOUGNET

Related Resources

• GNI “Jurisdictional Assertions and Limits” issue page, also see “New World Borders,” 2018 GNI Annual Learning Forum
• “User Privacy or Cyber Sovereignty? Assessing the Human Rights Implications of Data Localization” — Freedom House
• “Splintered Speech: Digital Sovereignty and the Future of the Internet” — PEN America
• “The Localisation Gambit: Unpacking Policy Moves for the Sovereign Control of Data in India” — Centre for Internet and Society (CIS), India
• “Internet Way of Networking Use Case: Data Localization” — Internet Society
• “Regulating for a digital economy: Understanding the importance of cross-border data flows in Asia” — Brookings Institution
• “Data Nationalism” — Emory Law Journal