Five regimes from four countries were distinguished by explicitly referring to data localization as part of their approach to content moderation:
- Pakistan’s Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards) Rules (2021);
- Russia’s Federal Law No. 149-FZ on Information, Information Technologies and Protection of Information (2006);
- Turkey’s Law on the Regulation of Publications Made in the Internet Environment and Combating Crimes Committed through these Publications (2007);
- Vietnam’s Decree No. 72/2013/ND-CP on the management, provision and use of Internet services and online information (2013); and
- Vietnam’s Law on Cybersecurity (2018; including Decree 53/2022 Elaborating a Number of Articles of the Law on Cybersecurity of Vietnam).
Regulations in this group were categorized by:
- Data localization requirements (5/5 regimes);
- Requirements to remove illegal content on notification (4/5 regimes), rather than requirements for proactive monitoring (1/5 regimes);
- Few (5/5 regimes) or no (3/5 regimes) considerations of freedom of expression;
- Sanctions including blocking and restricting access to content or platforms (4/5 regimes), but not extending to prison sentences (0/5 regimes); and
- An absence of independent regulator or audit requirements (0/5 regimes).
The relatively small number of countries referring to data localization in their content moderation regulation may be misleading, as many others are beginning to mandate data localization in wider reforms and legislation targeting the digital economy. These countries include Brazil, China, Nigeria and Russia., Although it does not mandate data localization, the EU’s data protection legislation places certain restrictions and conditions on the transfer of data, while other countries have mandated data localization for certain types of data, including financial or medical.
This approach to content regulation generally requires platforms to store, and likely provide access to, data on territory over which a state has legislative authority. For example, an October 2020 amendment to Turkey’s Regulation of Internet Broadcasts and Prevention of Crimes Committed through Such Broadcasts (Law No. 5651) requires domestic or foreign social network providers to store user data in Turkey.
Over the past decade, platforms – most of them based in the US – have had significant discretion in managing government data-access requests. For countries looking to manage speech or behaviour more closely, US-based data storage impedes their attempts to identify users responsible for infringements.
The five regimes demanding data localization in the context of content regulation provide few protections for freedom of expression in their legislation, and have been proposed by countries where protections for speech and other human rights are limited. The legislation often coincides with requirements for companies to hand over user data or identify users to state authorities on request. Taken together, the proposed regulations may represent an attempt by a state to significantly increase control over the internet inside its borders. Notably, none of the regimes grouped under this approach provide for an independent regulator, with the government taking responsibility for enforcement.
Governments may choose to adopt and enforce data localization requirements for several reasons. The main reason is to enable ‘easy’ access to data by national law enforcement and/or security agencies. When government agencies require access to data that may be hosted in another country outside of their jurisdiction, not only do they require cooperation from the company hosting the data, but also from the government of the territory where that data is hosted. From a law enforcement viewpoint, data localization measures help circumvent such obstacles by ensuring that data (or at least, a copy of the data) is in a certain territory/jurisdiction.
This approach to content regulation generally requires platforms to store, and likely provide access to, data on territory over which a state has legislative authority.
Beyond the issue of access, data stored within a given country’s territory would, in principle, be subject to that country’s jurisdiction, and thus, laws, regulations and policies. Depending on the processes in place in that country’s jurisdiction and the overall legal landscape surrounding data access, the government would be in a better position to apply measures over any data located in its territory.
Yet data localization requirements have implications and give rise to concerns. Mandating the installation or use of hardware inside a country’s borders may prove a step too far for all but the largest digital platforms or services in light of the financial and operational implications. When faced with demands for compliance, it is probable that smaller platforms will seek to end their operations and provision of services to users in that territory. If fully enforced, users may see a reduction in service availability and find online services dominated by platforms capable of meeting these regulatory requirements, occasionally punctuated by other platforms and services too small to catch the regulators’ attention. These trends combined would likely mean that users are significantly limited in their experience of the open, global internet.
In addition, data localization requirements would mandate companies to store data in physical systems geographically located in the territory of countries putting in place such measures; hence, instead of centralizing all data in a single location, they will have to acquire (or rent) and ‘maintain servers in each of these countries in which they do business’. Proliferation of data centres would have a considerable environmental impact, due to the compute powers required and subsequent energy consumption, as well as their greenhouse gas emissions and waste.
Data localization carries further risks. Centralizing digital infrastructure inside a country’s borders puts that infrastructure at risk should that country come under attack. ‘Data embassies’ located abroad, such as those employed by Estonia, highlight the advantages of securing a country’s data beyond its own physical borders. Localization also presents a risk for users dependent on platforms to act as a buffer against state authority. In dealing with some states around the world, US-based platforms have been reluctant to abide by national laws, up to and including challenging requests for data or information about users in court, frequently on the grounds that data is not held in that particular country. A lack of regulatory safeguards in the data localization as part of content moderation regulation group will not reassure platforms, while data localization weakens a company’s ability to protect its local users’ privacy or freedoms.
Data localization debates can cut both ways. Pressure on ByteDance from the US government to use local US data storage for US users of its app, TikTok, highlights the growing international concern about the security implications of unrestricted data flows.
In a way, it would not be realistic to expect a ‘one-size-fits-all’, harmonized approach to data localization that would be universally adopted and operationalized. While cooperation agreements are in place to, for example, facilitate cross-border data transfers, data localization measures inherently rest on the concept of data sovereignty and, thus, countries’ exercise of prerogatives and control in line with their respective national priorities. Yet stricter approaches to data localization, and the subsequent power authoritarian governments hold over their populations, raise questions regarding implications for human rights. For example, Russia’s data localization requirements and strict monitoring and enforcement are seemingly motivated by government concern over the use of social media in anti-government protests. This apparent focus jeopardizes the users’ (and, more generally, the population’s) right to the freedom of expression, right to protest and enjoyment of broader civil and political rights.
Democratic context
Legislation is inseparable from the context in which it is enforced. A full examination of the regulatory approach to platforms and the democratic integrity of each government is beyond the scope of this paper, but a partial picture can be discerned.
Within the groups identified in this paper, and even globally, there are noticeable outliers. Examples include requirements for human rights due diligence reporting in countries that do not otherwise recognize human rights, and protections for freedom of expression in countries known to habitually suppress anti-government speech.
These outliers, however, tend to be anomalies. Taking the 2021 Freedom House Global Freedom Index as an indicator of the strengths of protection for political rights and civil liberties in a given country, it is clear that stricter regulations tended to be concentrated in countries with lower ‘freedom scores’. Countries with strong democratic traditions, meanwhile, tend to support multi-stakeholder, independent regulations, with caveats in line with protections for individual liberties and rights.
Similarly, there is a strong correlation between national regimes that task independent regulators with platform regulation and countries scoring highly on the Freedom House index, while requirements around surveillance and data localization are largely found in countries with lower scores.
