Four civil society experts discuss why data localization is becoming an increasingly common policy and what this means for people’s rights.
Data localization, which requires companies to store personal data on local servers, is a growing policy area. However, particularly in settings where the rule of law is weak, such requirements can give authorities easy access to people’s data, creating a breeding ground for human rights violations. Restricting the free flow of data also accelerates the fragmentation of the global internet.
Last October, the US Trade Representative’s withdrawal of support for cross-border data flows at the World Trade Organization reignited debate on the topic on the international stage. In doing so, USTR risks further worsening the uptake of data localization and encouraging other governments to follow suit.
In the following discussion, Freedom House’s Allie Funk and Jennifer Brody interview four experts analyzing data localization across Africa, Asia, and Eastern Europe.
- Alyona EpifanovaResearcher, German Council on Foreign Relations (DGAP)
- Lillian NalwogaProgram Manager, Cooperation on International ICT Policy for East and Southern Africa (CIPESA)
- Shumila Khandigital rights researcher and campaigner
- Savana’s Rashid DiyaFounder and Executive Director, Tech Global Institute
This discussion explores the myriad ways in which data localization is incorporated into law, the complex drivers behind it and its associated human rights implications, and the efforts of global civil society to protect human rights online. sheds light on how leaders can help. Note: This conversation transcript has been lightly edited for clarity and brevity.
Ally Funk and Jennifer Brody:
Data localization takes different forms depending on a country’s political and legal situation. How is this problem occurring in the countries and regions you are focusing on?
Alyona Epifanova:
The data localization law was adopted by Russia in July 2014, amid heightened tensions with the West following Edward Snowden’s revelations about US government surveillance and Russia’s annexation of Crimea. The Kremlin’s awareness that digital technology and data could be weaponized against Russia by foreign actors has increased significantly, triggering a shift toward increased sovereignty. Around the same time, Putin’s government faced the largest protests in Russia since the 1990s and sought to assert dominance over all levels of Russian political life and society.
Lillian Nalwoga:
Data localization is becoming a trend in Africa, with many countries enacting data protection laws that require data to be stored locally and close the borders of personal data unless authorized by a data protection authority or designated authority. Transfer beyond the limit is prohibited. Governments are using cybersecurity, financial services, and communications regulation to do this.
Savana’s Rashid Diya:
Data localization is a growing trend in Asia, with many governments enacting laws mandating varying degrees of restrictions on cross-border transfers. Bangladesh uses the Financial Services Regulation to impose sector-specific local data storage requirements on resident companies. Since 2020, various draft data protection laws have imposed mandatory restrictions on international data transfers for both residents and non-residents. The country’s latest draft law imposes de facto restrictions on cross-border transfers of personal data, making them conditional on bilateral, regional or multilateral agreements with the destination country, while making them legally binding. Requires storage of “sensitive data,” a term that is not defined. Law.
Shumila Khan:
Data localization in Pakistan has been proposed as two bills. These are the Personal Data Protection Bill and the Regulations on the Removal and Blocking of Illegal Online Content (Procedures, Monitoring and Safeguards) Regulations, 2020, which focus on the “protection of sensitive information”. “Personal Data” is stored within national boundaries. These laws also require social media companies to register and establish local offices in the country.
Ally Funk and Jennifer Brody:
Freedom House has developed a three-step approach to assessing the extent to which data localization policies impact privacy, freedom of expression, due process, and other fundamental freedoms. What are your concerns from a human rights perspective? How have you seen these concerns play out?
Lillian Nalwoga:
Free access to personal data undermines data privacy as it allows states to monitor users if necessary. In Africa, countries with data localization policies are spending billions of dollars to purchase surveillance technology and implement data collection programs. Many countries lack the necessary measures to protect personal data, including appropriate privacy laws, and where these laws exist, they are poorly enforced.
Alyona Epifanova:
When combined with additional legislation, data localization laws and user data protection measures can be exploited for mass surveillance purposes. In 2016, Russia enacted two federal laws, collectively known as the “Yorovaya Laws.” The law requires internet service providers and online platforms to retain user data, including messages, calls, images, and other information, for up to six months. Additionally, we will grant access to this data to the Russian Federal Security Service (FSB) upon request, even in the absence of a court order. For example, the FSB gained access to his taxi company’s database in 2023.
Shumila Khan:
In the Pakistani context, the state, especially the military, already has access to vast amounts of information and little accountability. The prospect of personal data being stored on local servers would further allow states to prosecute people for crimes related to online speech, including religious expression and sedition charges. It also reduces a company’s ability to deny data requests.
Savana’s Rashid Diya:
Countries are increasingly moving toward legalizing access to vast amounts of personal data without procedural guardrails, expanding their ability to surveil and oppress people. For example, the Bangladesh Telecommunications Regulation Act 2018 has provisions that require telecommunications operators to hand over personal data about their users to law enforcement authorities or risk having their licenses revoked. Similar provisions were introduced in both the Cybersecurity Act 2023 and the Draft Data Protection Act 2023. Similarly, India’s Digital Personal Data Protection Act of 2023 provides broad exemptions for government agencies from procedural guardrails, granting them access to personal data on vague grounds. national security and public order; Mandatory storage on domestic servers would make it easier for state agencies to force access to sensitive data, exacerbating surveillance and self-censorship.
Ally Funk and Jennifer Brody:
Do you have any other concerns about the impact of these laws?
Alyona Epifanova:
Data localization contributes to the fragmentation of the global Internet. A growing number of countries are asserting their sovereignty, building their own internet infrastructure and introducing their own regulations on data flows. The global internet divide is already impacting the way people access information, express themselves online, and communicate with each other.
Shumila Khan:
Countries like Pakistan lack the necessary technical and energy capacity to host such servers (the country frequently experiences power “load shedding”). The lack of good digital security protocols in the country also poses security concerns for the data collected.
Savana’s Rashid Diya:
Many countries in the global majority lack the institutional safeguards and infrastructure capacity to keep personal data secure within their borders. This risks data breaches and privacy violations occurring more frequently, with little or no meaningful recourse available to the public.
Ally Funk and Jennifer Brody:
Policymakers are considering data localization to address legitimate concerns that require thoughtful policy responses, such as cybersecurity, strengthening data protection, strengthening local technology sectors, and countering the monopolistic practices of technology companies. is often pursued. Do you have any ideas on how to solve these problems to get more rights?
Savana’s Rashid Diya:
There is substantial evidence of data localization. alone You can’t strengthen your local technology sector or strengthen your cybersecurity. Many governments are still pursuing ideas such as: only they had access to more Data would solve many important national security challenges.
However, without investigative capabilities, investment in the local technology sector, development of talent pipelines, strong competition laws, and mainstreaming of media literacy, data localization will do little to address any of the aforementioned gaps. Because the “money” in data is in processing, not storage, countries generally stand to gain more by creating incentives to strengthen their own technology sectors and ecosystems.
Lillian Nalwoga:
Governments must balance the challenges of data localization, data privacy, and digital transformation. In Africa, the level of digital development and adoption varies by country. Restrictions on cross-border data transfers can not only hinder efforts to meet localization requirements mandated by certain laws, but also limit progress towards implementing the digital transformation agenda.
Shumila Khan:
Governments have frequently used efforts to address cybercrime and national security concerns to justify these laws. However, history shows that many laws enacted on this national security basis have been used to silence dissent online.
Ally Funk and Jennifer Brody:
How can democratic governments engage with and support civil society efforts to combat data localization?
Alyona Epifanova:
Democratic policymakers should encourage discussion of the concept of digital sovereignty, which centers on individual self-determination and democratic values in the digital realm. Conducting a human rights evaluation of proposed data localization policies should be essential. To ensure unrestricted data flows, it is important to strengthen international cooperation within organizations such as the World Trade Organization, the G20, and the Organization for Economic Co-operation and Development.
Lillian Nalwoga:
I also agree with Alena. A Democratic government can provide aid to strengthen infrastructure and invest in innovation and human capital upskilling.
Savana’s Rashid Diya:
Civil society is working hard to enact countless laws and build better regulatory frameworks, but it needs short- and long-term support to do this work. This includes both financial resources and development opportunities. Democratic policymakers also need to support civil society efforts to explore alternative governance models and regulatory innovations. There is no one-size-fits-all approach to regulating digital ecosystems. What works in one country may not work in another. Instead, laws must reflect local needs and community realities, while ensuring compliance with international human rights law and democratic standards of transparency and inclusiveness.
Shumila Khan:
Most countries in the Global South feel left out of the gains from the technology industry and are forced to adopt xenophobic strategies such as data localization to gain greater control over their data. I feel that there is. Democratic actors can help ensure that the benefits from digital technologies are shared equitably and that governments have the resources and capacity to cope with a changing world. It can also strengthen support for local civil society. They are best positioned to have these nuanced conversations where they can balance the need to regulate big tech while resisting undemocratic government efforts to assert control over personal data. There is.
