Laura Sandor, fellow, Datasphere Initiative
Since 2017, the number of data localization policies established by governments across nations has doubled. The implications around the rising number of localization policies are many, including challenges to the solving of global problems. In that regard, one area that has increasingly become a target of data localization policies has been the healthcare sector. The digitalization of health data throughout the past few decades has driven governments to develop policies targeting sensitive data. And while protecting health data fosters individuals’ autonomy, protecting their privacy; extensive protection over health data could limit medical and technological advances and increase bias in areas like Artificial Intelligence (AI).
Establishing localization policies within the healthcare sector may result in a diminished ability for cross-border data sharing. Cross-border data sharing has positively contributed to a better global economy within domains such as public health, agricultural production, and law enforcement. Recently, the COVID-19 pandemic shed light on the need for the flow of health data between nations, as also acknowledged by the World Health Organization in their recently launched Pandemic Hub.
Without access to large amounts of worldwide data, researchers would not have been able to efficiently understand the rate and method of infection of the virus nor its variants and would have been disadvantaged in creating vaccines.
Despite the pandemic demonstrating the need for the free flow of data within the healthcare sector, data localization policies are continually being implemented across nations. During my fellowship at the Datasphere Initiative, I will investigate the various rationales behind data localization policies and their impact on the healthcare sector. This initial blog provides the foundation for this effort.
Core concepts: Data localization and cross-border data flow
Data localization¹ measures aim to institute a geographical restriction on free data flows, and thus reducing the ability for data to be moved beyond a country’s border for processing or storage once it is collected. Data localization often points to a regulation establishing that the collection, processing, and storage of a country’s nationals’ data need to be done within the borders of said nation.
The Organisation for Economic Cooperation and Development (OECD) highlights that data localization measures are implemented through various norms, from federal laws – e.g., EU General Data Protection Regulation (GDPR), Brazil’s General Data Protection Law (LGPD) -, to administrative requirements in other norms not specifically related to data protection and privacy – e.g., requirements posed by the Chinese government demanding that servers be located within its borders when a company opens a subsidiary in their territory.
Unlike data localization, cross-border data flows refer to the free movement of information globally, without restrictions. This free movement does not need to be without friction, to responsibly unlock the value of data while respecting legitimate rights. As previously mentioned, cross-border data flow positively contributes to a myriad of areas, boosting the global economy.
How did we get here?
With the fast digital transformation of every sector, data sources rapidly moved from analog versions to digital, which, in theory, would facilitate flow. The fast adoption of Digital ID and the digitalization of medical records are examples of this transition. And while some countries allow data to flow easily around the world—recognizing that legal protections can accompany the data—many more have enacted new barriers to data transfers that make it more expensive and time-consuming, if not illegal, to transfer data overseas.
Measures to localize data have spiked since 2017, with countries restricting cross-border data flows, increasing from 35 to 62 and overall restrictions from 67 to 144. In the same period, 38 other data localization policies have been proposed or considered in countries worldwide.
The motivations behind these new policies, and what ultimately has led us to this position, vary depending on the objectives of each government. Countries usually justify these measures based on (1) ensuring individual rights and privacy are better protected, (2) allowing for the protection of sensitive information for national security purposes, (3) increasing accessibility of information for regulatory processes in areas such as taxes, insurance, banking, etc. and (4) increasing domestic competences in sectors that heavily rely on digital means. More recently, European efforts under the continental Data Strategy also point to limiting data flows to support local competitiveness.
To further investigate and understand this rapid increase in data localization policies by countries, especially health information and other sensitive data, it is important to identify the relationship between the pandemic, technology, and geopolitics. This effort also might require mapping and understanding policy actors acting in silos – meaning, enacting norms or leading initiatives without a better assessment of the implications of policy choices across fields, sectors, or fora.
The Pandemic Impact and the Great Impasse
In 2019, the COVID-19 pandemic thrust every country into a national health crisis as their citizens rapidly became infected. As a result, there was an increased demand and strain within the health sector for medical equipment, devices, facilities, and technologies to support frontline workers, patients, and people quarantining at home. While in parallel, we witnessed a rapid development of pandemic surveillance and further platformization of health data and services. Therefore, new innovations and methods were developed quickly – and in many cases under a lot of criticism – to meet the needs of society in this extreme time.
To realize these demands, countries were forced to quickly move through digital transformation processes, including those supporting large storing and processing of pandemic-related data. Cloud computing, AI, big-data analytics, deep learning, and the Internet of Things (IoT) had to be quickly adopted and deployed. Altogether, these digital technologies were able to provide the ability for countries to combat COVID-19 through detecting infection, telemedicine services, tracing infection, forecasting infection cases, monitoring treatment, vaccine development, and deployment, etc.
Thus, the pandemic resulted in a potentially permanent digitalization and platformization of various aspects of health research, interventions, and services. However, for these digital technologies to provide accurate outcomes and outputs, they required big data – meaning large amounts of data that provides a massive amount of information to the scientists, health workers, and epidemiologists and help them to make informed decisions to fight the COVID-19 virus. This data can be used to track the virus on a global basis continuously and to create innovation in the medical field. Thus, the pandemic shed light on the vital need for cross-border data flows between countries to develop effective preventative and remedial measures.
The result of such restrictions – that, at times, are justified on flawed assumptions that I will investigate during my fellowship – is the reduced capacity of countries, the private sector, and researchers to create data-driven innovations and developments within the healthcare field, which will specifically affect our joint ability – as a global society – to deal with global challenges, and more concretely offer fast and innovative health services and solutions.
Next steps
In the following months of my fellowship, I intend to further look into this impasse between flow and data localization to then investigate and propose how we can responsibly unlock the value of data for all, especially when dealing with global challenges.² I will be asking “what does ‘responsibly unlocking’ could mean in this context?.” This will include identifying the various effects as well as misconceptions around data localization, and how it specifically affects the health sector. The COVID-19 pandemic will serve as a case study. Ultimately, this research aims to provide a policy brief on future recommendations for policymakers.
¹ Data localization and data residency are often two concepts that tend to be confused with each other. Data localization describes the restriction of data needing to be kept or stored in the place of origin it is created in. Data residency concerns the geographical location where a business stores their data (geographic location of their choice).
² This topic has also been introduced and discussed in the report We Need to Talk About Data.
References
Box, J. (2019). Data Sovereignty vs Data Residency vs Data Localization. Insightsforprofessionals.com. https://www.insightsforprofessionals.com/it/storage/data-sovereignty-data-residency-data-localization
Chandra, M., Kumar, K., Thakur, P., Chattopadhyaya, S., Alam, F., & Kumar, S. (2022). Digital technologies, healthcare, and Covid-19: insights from developing and emerging nations. Health and Technology, 12(2). https://doi.org/10.1007/s12553-022-00650-1
Cory, N. (2020, May 7). Viruses Cross Borders. To Fight Them, Countries Must Let Medical Data Flow, Too. Itif.org. https://itif.org/publications/2020/05/07/viruses-cross-borders-fight-them-countries-must-let-medical-data-flow-too/
Cory, N., & Dascoli, L. (2021, July 19). How Barriers to Cross-Border Data Flows Are Spreading Globally, What They Cost, and How to Address Them. Itif.org. https://itif.org/publications/2021/07/19/how-barriers-cross-border-data-flows-are-spreading-globally-what-they-cost/
Dron, L., Kalatharan, V., Gupta, A., Haggstrom, J., Zariffa, N., Morris, A. D., Arora, P., & Park, J. (2022). Data capture and sharing in the COVID-19 pandemic: a cause for concern. The Lancet. Digital Health, 4(10), e748–e756. https://doi.org/10.1016/S2589-7500(22)00147-9
Frontier Economics. (n.d.). THE EXTENT AND IMPACT OF DATA LOCALISATION Report prepared for DCMS. Retrieved January 24, 2023, from https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1125805/Frontier_Economics_-_data_localisation_report_-_June_2022.pdf
Internet Governance Forum. (2020). IGF 2020 WS #227 Data localisation in the times of COVID-19 | Internet Governance Forum. www.intgovforum.org https://www.intgovforum.org/en/content/igf-2020-ws-227-data-localisation-in-the-times-of-covid-19
Keck, M. (2022). BRIEF. https://web-assets.bcg.com/7a/2b/9a0cb4b545ad87cf7e901301ad27/en-uncdf-brief-cross-border-data-flows-2022.pdf
Livingston, S., & Greenleaf, G. (2016, September 29). Data Localisation in China and Other APEC Jurisdictions. Papers.ssrn.com. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2895610
Svantesson, D. (2020). Data localisation trends and challenges: Considerations for the review of the Privacy Guidelines. OECD Digital Economy Papers, 301. https://doi.org/10.1787/7fbaed62-en
Tréguer, F. (2020, May 1). The State and Digital Surveillance in Times of the Covid-19 Pandemic. Covid-19. https://www.sciencespo.fr/ceri/en/content/state-and-digital-surveillance-times-covid-19-pandemic
World Health Organization. (n.d.). Pandemic Hub. Pandemichub.who.int. Retrieved January 24, 2023, from https://pandemichub.who.int
