OMG Central Bank Digital Currency (OMG-CBDC) Working Group (WG) Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

====== 4.6.1 Data Residency ======
|< 100% >|
| [[cbdc:public:cbdc_omg:04_doc:15_common:50_international:start| International Considerations]]  |  <WRAP>
<html><b>
<a href="mailto:cbdc-feedback@omg.org?Subject=OMG's CBDC WG Response: 
4.6.1 Data Residency

">Provide Feedback</a></b>
</html>
</WRAP>  |

According to the OMG Cloud Working Group's Discussion Paper on Data Residency((
Cloud Standards Customer Council and the Object Management Group,
__Data Residency Challenges__,
May 2017,
Accessed: 8 April 2022,
[[https://www.omg.org/cloud/deliverables/CSCC-Data-Residency-Challenges.pdf]]
)). The **Data Residency** issues from the **Cloud Working Group Data Residency White Paper** are summarized in Table {{ref>drIssues}} with each issue being given a unique number. 

<table drIssues>
<caption>A review of the Data Residency Issues the CBDC needs to address.</caption>
|< 100% 10% 45% 45%>|
^ Data Residency Issue Number  ^ Description  ^ CBDC Explanation  |
^ DR01 ^ <WRAP>
Large multinational companies wish to consolidate data centers from multiple countries into a smaller set of locations (data center consolidation). 
</WRAP>|<WRAP>
Although a U.S.-based CBDC is not a multinational company, it is, by nature, a multinational enterprise. A summary of the multinational nature of the CBDC found in OMG's CBDC WG [[cbdc:public:cbdc_omg:04_doc:12_summary:start| White Paper Analysis]] follows: 
  : 1. **''B0036''** and **''B0042''** set as a "desirement" the preservation the dominance of the U.S. Dollar internationally
  : 2. **''B0009''**, **''B0024''**, **''B0034''**, **''P0026''** express the "need for speed" 
  : 3. **''B0027''** expressed the need for trust and reliability
  : 4. **''B0053''** is resiliency
  : 5. **''B0009''**, **''B0015''**, **''B0035''**, **''B0041''** for the need of cross-border operations
  : 6. **''D0009''** to support foreign demand
</WRAP>|
^ DR02 ^ <WRAP>Organizations migrate some of their services to the cloud or to a hosted solution managed by an outsourcing company located in another country. “Services” is a very broad term here, and risk arises simply if a remote backup solution stores the backup data in another country. 
</WRAP>|<WRAP>
For the same reasons given in the explanation for **''DR01''** above, the CBDC has an implied "desirement" for cloud-based data collection and the redundancy it offers. In addition, **''B0051''**, and **''D0011''** both refer to data collection, which can cause Data Residency issues when data is from outside U.S. sources. 
</WRAP>|
^ DR03 ^ <WRAP>A Business Process Outsourcing (BPO) solution, or a managed helpdesk solution, causes agents in a different country to have access to protected information in order to perform the contracted service. 
</WRAP>|<WRAP>
Figure {{ref>bpoData}} provides a list of the top services to outsource to third Party BPOs. Some of these are relatively benign in terms of data visibility by BPO employees. Other areas such as //"Information Technology(IT)"// and //"Claims, eligibility, and appeals processing"// might need to be addressed for any CBDC implantation.
<figure bpoData>
{{  cbdc:04_doc:15_common:50_international:screen_shot_2022-04-08_at_2.22.00_pm.png?400   |}}
<caption>Federal Managers report that BPO is used for a wide range of services((
Government Business Council,
__Inside Federal Outsourcing - A Candid Survey of Federal Managers__,
May 2015,
Accessed: 8 April 2022,
[[http://cdn.govexec.com/media/gbc/docs/gbc_government_outsourcing_report.pdf]]
))</caption>
</figure>
</WRAP>|
^ DR04 ^ <WRAP>Employees travel across borders, carrying sensitive data with them on their laptops and smartphones. 
</WRAP>|<WRAP>
For the U.S. CBDC, it is not about employees traveling across borders as much as U.S.-based citizens and residents traveling across the border. Even if the people do not travel across the borders, their money may travel through international purchases and remittances.
</WRAP>|
</table>

For the CBDC, the Data Residency issues **''DR01''**, **''DR01''** will cause issues if the CBDC obtains international usage and will probably reduce adoption of the U.S. Dollar which are among the stated desirements the Federal Reserve **White Paper**. See Table {{ref>internatDesire}}.

<table internatDesire>
<caption>International "desirements" specified in the Federal Reserve **White Paper**.</caption>
|< 55% 10% 45% >|
^ Statement No.  ^ Statement  ^
^ B0036 ^ Preserve the dominant international role of the U.S. dollar |
^ B0041 ^ Support streamlining cross-border payments  |
^ B0042 ^ Preserve the dominant international role of the U.S. dollar |
</table>

The level of risk to the CBDC mostly depends on several factors in how the design of the CBDC and the international laws and regulations that will ultimately cover the CBDC. The **Cloud Working Group Data Residency White Paper** identified four major risk areas which have relevance to the CBDC:

  - Nature of the being gathered and stored by the CBDC
  - Severity of the laws and regulations governing data in the jurisdiction where the data resides, passes through, or is being manipulated
  - Nature of the services the CBDC will offer internationally
  - Level of awareness (or ignorance) of the issues by international communities

The **Cloud Working Group Data Residency White Paper** (see Table {{ref>dataResidencyUseCase}}) uses a series of Use-Cases to help explain how to classify data usage and when there might be **Data Residency** issues. The table lists each Use-Case and where it is being generated, stored, processed, routed, and finally accessed by the End User. In other words, the [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.2_views:3_taxonomic:4_data_tax:02_state_taxonomy:start | State of the Data]]:

  * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.2_views:3_taxonomic:4_data_tax:02_state_taxonomy:data_at_rest | Data-At-Rest]]
  * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.2_views:3_taxonomic:4_data_tax:02_state_taxonomy:data_in_motion | Data-In-Process]]
  * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.2_views:3_taxonomic:4_data_tax:02_state_taxonomy:data_in_use | Data-In-Use ]]

<figure dataResidencyUseCase>
{{cbdc:04_doc:15_common:50_international:screen_shot_2022-04-08_at_12.30.15_pm.png?700|}}
{{cbdc:04_doc:15_common:50_international:screen_shot_2022-04-08_at_12.33.24_pm.png?300|}}
<caption>Data Residency Use Case Matrix from the **Cloud Working Group Data Residency White Paper**.</caption>
</figure>

Table {{ref>dataUses}} gives an explanation for the values in each of the cells in Figure {{ref>dataResidencyUseCase}}.

<table dataUses>
<caption>Where the data is stored (i.e., [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.2_views:3_taxonomic:4_data_tax:02_state_taxonomy:data_at_rest | Data at Rest]].)</caption>
|< 100% 20%>|
^ **In-country** | <WRAP>
Data is physically present within the boundaries of the jurisdiction in question. When this location is on the physical premises of the data custodian, it is equivalent to in-house
</WRAP>|
^ **In-house** | <WRAP>
Data is present within the physical premises of the data custodian. Whether this is a single (computer) room, building or campus is not germane. What is germane is whether the storage, servers and network infrastructure are all privately controlled by the data custodian. As a specific case, if two locations are physically separate and connected by an Internet connection, this criterion would be violated. Examples of data sources that are in-country but not in-house are a well-site sensor on a private owner’s oil lease and an automatic teller machine (ATM) is in an International airport, on a ferry, or on a cruise ship.
</WRAP>|
^ **External** | <WRAP>
One or more infrastructure components (storage, servers, network) are outside the jurisdiction in question. An example is a seismic vessel acquiring data within the territorial waters of a country. The acquisition process is being monitored by personnel physically within that country. The data is transmitted via satellite to a ground station located in another country (e.g., Russian Arctic via a Norwegian ground station, offshore Indonesia via a Singapore ground station, etc.) and then via the Internet to the company’s home country
</WRAP>|
</table>

/**=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
/* To add a discussion page to this page, comment out the line that says 
 ~~DISCUSSION:off~~
*/
~~DISCUSSION:on|Outstanding Issues~~
~~DISCUSSION:off~~
OMG Central Bank Digital Currency (OMG-CBDC) Working Group (WG) Wiki

User Tools

Site Tools

Page Tools
