Identifying some of the implications of data localization for businesses

Businesses perceive that local storage measures with no flow restrictions can lead to increases in data management costs of around 16%; local storage requirements combined with flow restrictions lead to considerably higher costs of around 55%; 8% of businesses surveyed said that prohibitive data localization measures would stop their ability to operate internationally; around 70% of businesses did not think that data localization measures helped deliver other legitimate public policy objectives. (pp. 17-18, Figures 7-8)
Cross-border e-payments are payments conducted electronically where merchants and consumers are located in different countries; domestic payment systems are not directly connected internationally, so e-payments set in motion a complex system of interbank credits and debits relying on the movement of different types of data across borders. (p. 19)
The financial, banking or payment sectors face the highest number of data localization measures after cross-cutting measures, with a clear divide in approaches across OECD and non-OECD countries, with 12 of 17 specific measures identified arise in non-OECD countries, taking the most restrictive form. (p. 19)
The proliferation of data localization measures in the e-payment sector has led to an increase in the cost of operating domestically and across geographical borders; any form of local storage can be costly because keeping local copies of data requires duplicating measure to maintain high level of data security, implying significant additional capital and personnel costs; businesses in this sector prefer centralization of servers to reduce costs; for large markets the costs can be faced but businesses might reduce services or pass costs to consumers and in small markets business might choose to pull out of the market or reduce investment there. (pp. 19-20)
Indirect impacts of data localization measures in this sector include: reduced efficiency of e-payment systems; less secure and reliable e-payment systems subject to increased risk of cyberattacks; decreased competition in e-payment markets; increased risk of data loss from natural disasters and reduced resilience; reduced ability to detect and prevent fraud; negative downstream affects for small businesses; and uncertainty about regulation. (pp. 20-21)
Cloud computing allows users to rent IT resources, including computing power, storage, and database management, offering the ability to scale up or down activities without needing to undertake important capital investments; the use of cloud computing is growing and will continue to grow; cross-border data flows are integral to cloud computing as the cloud is a vast network of remote but interconnected servers located around the world that allow access to files and data from and Internet-capable device regardless of location. (p. 21)
Data localization measures are motivated by data safety, national security, respect for human rights, and ensuring government access to data in the event of judicial proceedings; some businesses perceive that these measures are intended to favor domestic cloud computing companies; 7 requirements have been identified to date. (pp. 22-23, Box 5)
Data localization requirements are problematic for cloud providers since location independence is a core aspect of the cloud delivery model; regulatory requirements push providers to increase transparency over server location; data localization requirements can lead to: 1) increased costs of providing cloud computing services; 2) negative impacts on downstream users; 3) reduction in the amount of services provided; 4) increased compliance costs given challenges navigating requirements apply to what kinds of data; 5) increased cybersecurity risks; and 6) increased risk of data loss from natural disasters and reduced resilience. (pp. 23-24)
Air travel data: Aviation is a data intensive sector; the ticketing process involves the collection, transfer, and processing of data across different countries; when passengers book a specific flight, Passenger Name Records with personal travel information are created and stored on computer reservation systems (CRS); for payments, third party payment providers or payment gateways are used, many of which are dependent on processing data across borders; information on CRS systems is integrated with airline departure control systems (DCS) and airport information systems; the DCS system also shares passenger information with international baggage tracking platforms; passenger information may also be shared with government agencies in countries passengers are traveling to or where they are transiting or overflying. (pp. 24-25, Figure 9)
The Convention on International Civil Aviation (Chicago Convention) governs international air transport rules, with a comprehensive network of bilateral air services agreements; sharing of passenger information is governed by Annex 9 of the Chicago Convention, which many ICAO members accept, but individual member states increasingly impose their own requirements on provision of such data; the aviation industry is subject to more cross-cutting requirements on business operations, including data transfer and data localization; as the sector handles large volumes of personal data, localization requirements also have substantial implications on the cross-border sharing of passenger information needed for international air travel. (p. 26)
Rules prohibiting or unduly restricting the ability to transfer passenger data internationally restrict passenger travel internationally; because of constant updates to passenger data and airline activity, it is essential that there is a single source of that information and in practice a single geographic location where that data is held; as a result, data localization requirements in certain countries will have very significant impact on how airlines operate in those countries, and at worst, might negatively impact decisions of airlines to fly to those countries. (pp. 26-27)
The aviation industry already has well-defined rules and standards in place for passenger data; cross-cutting data localization measures can affect business operations; there are growing uncertainties on the linkages with data protection and privacy rules in aviation; regulatory uncertainty can raise compliance costs and undermine efficient air transport services. (p. 27)