Data localization doesn’t compute

Bert Verschelde

Concerns about data privacy and security are legitimate, but forcing companies to store personal data on Korean territory is not the right answer. In the wake of Edward Snowden’s NSA revelations, governments across the world have moved to increase online privacy and security of critical and personal data within their borders. More often than not, new legislative initiatives have included some form of regulatory restrictions on data, such as data localization - the requirement that companies store and process data within the country in which they were collected.

While calls for increased online data security are legitimate and warranted, recent customer information leaks in Korea’s financial sector show that restricting where data is stored is problematic. Storing data within the borders of one country is not only ineffective against foreign surveillance, data security experts say it increases the chance of data breaches and abuse. When data is mandatorily stored within borders, it creates a tempting “honeypot” for criminals to target.

Moreover, forcing local storage of data can have a very harmful impact on the economy enforcing it. Our simulations show that Korea’s economic growth would be severely stifled by an expanded, or economy-wide data localization measure. The impact of data localization across all sectors is estimated to be equivalent to 1.1 percent of Korea’s GDP in 2014. In real terms, this is equivalent to a loss of roughly $13 billion. In addition, investment in Korea would drop by 3.6 percent, causing its economy to pass up roughly $180 million in foreign direct investment.

How do these losses come about? When cross-border data flows are constrained, it affects not only Internet companies such as Facebook, Google and Line, but almost the entire economy. This is because data is an increasingly important raw material for many industries. Companies in the logistics, retail and communications sectors rely on data for a large part of their production input. For example, international couriers and logistics companies cannot efficiently deliver packages without access to personal data from overseas. Today’s popular messaging apps also depend on a free flow of data, and Korean start-ups in this space may choose to locate outside the country.

Even in manufacturing, most large investments today are related to IT systems and data connectivity. Exporters rely on using or sharing data with their foreign customers for efficient production, research and marketing. It is no surprise, then, that export-driven economic growth in Korea would incur a big setback if cross-border information flows were constrained.

There also are consumer welfare losses associated with data localization in the form of higher prices. From a practical perspective, data localization laws such as Korea’s map regulation, which prohibits foreign companies from accessing Korean map data, means many visitors have trouble finding places and directions on their smartphones. This has an adverse impact on the travel industry. Data localization in this case also serves as a barrier to the inflow of innovative location-based products and services, while increasing the burden faced by developers trying to enter foreign markets, who must redevelop products to be compatible with foreign map data.

In short, data today is just as crucial to the global - and Korean - economy as electricity or manpower. In an interconnected and increasingly digital economy, policy makers need to carefully balance data protection and productivity. Any attempts to build on Korea’s existing data protection regime need to take into account the important contribution of free cross-border data flows to Korea’s economic performance and the substantial costs and security implications associated with locking data within the country.

By Bert Verschelde, European Center for International Economy