OMG Central Bank Digital Currency (OMG-CBDC) Working Group (WG) Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== 4.6.2 Data Localization ======
|< 100% >|
| [[cbdc:public:cbdc_omg:04_doc:15_common:50_international:start| International Considerations]]  |  <WRAP>
<html><b>
<a href="mailto:cbdc-feedback@omg.org?Subject=OMG's CBDC WG Response: 
4.6.2 Data Localization

">Provide Feedback</a></b>
</html>
</WRAP>  |

[[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:d:data_localization | Data localization]] is about jurisdictions adopting policies with an aim to protect the jurisdictions' sovereignty over the data generated from within its geographic boundaries or from its residents. The policies are intended to help protect the jurisdiction and its residents from external entities (private or public).

Figure {{ref>dataLocalIncrease}} shows the increase in **Data Localization** measures globally from 1960-2015. This increase indicates that this is a problem that will only get bigger as time goes by. The CBDC needs to understand and recognize it as a growing international trend.

<figure dataLocalIncrease>
{{  cbdc:04_doc:15_common:50_international:screen_shot_2022-04-09_at_1.17.23_pm.png?600  |}}
<caption>Increase in data localization measures globally (1960 - 2015)((
Emily Wu,
Harvard Kennedy School - Belfer Center - For Science and International Affairs,
__Sovereignty and Data Localization__,
July 2021,
Accessed: 9 April 2022,
[[https://www.belfercenter.org/publication/sovereignty-and-data-localization]]
))</caption>
</figure>

The need for **Data Localization** is justified for different reasons, such as the protection of data from:
  * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:h:hacker&s[]=hacker | Hackers]] engaged in nefarious activities. 
  * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:p:pii | Personal Identifiable Information (PII) ]]
  * Regulators wanting to access the information on participants in cross-border transactions
  * External jurisdictions trying to identify individuals engaged in activities it finds illegal or offensive, but that are not considered that way locally
  * Unwanted or desired commercial mining
  * Public opinion favoring in-country data storage solutions and strategies

This usually takes the form of a mandate and/or a set of laws or regulations that require certain data to be physically stored on servers within the country of origin.

Data Localization policies tend to fall into three categories((
Emily Wu,
Harvard Kennedy School - Belfer Center - For Science and International Affairs,
__Sovereignty and Data Localization__,
July 2021,
Accessed: 9 April 2022,
[[https://www.belfercenter.org/publication/sovereignty-and-data-localization]]
)):

<table>
<caption>Data Localization Policies. See: ((
Emily Wu,
Harvard Kennedy School - Belfer Center - For Science and International Affairs,
__Sovereignty and Data Localization__,
July 2021,
Accessed: 9 April 2022,
[[https://www.belfercenter.org/publication/sovereignty-and-data-localization]]
))
</caption>
|< 100% 20% 30% 50% >|
^ Localization Category  ^ Description  ^ Law or Regulation Examples  ^
^ Local-only Storing, Transmission, and Processing ^ <WRAP>
This generally means an obligation to locally manage data or a prohibition of international data transfers. This is the strictest type of localization policy and is more likely to be descriptive of nations seeking broader control over citizen activities.
</WRAP> | <WRAP>

  : **Russia**
  : Under Russia’s Federal Law No. 242-FZ, operators must ensure the recording, systematization, accumulation, storage, adjustment (update, alteration), and retrieval of personal data of citizens of the Russian Federation will be performed through database servers located in the territory of the Russian Federation. Substantial fines are imposed on organizations and individuals that fail to comply with data localization requirements.

  : **China**
  : Article 37 of the Cybersecurity Law of the People’s Republic of China (‘CSL’) requires critical information infrastructure operators (‘CIIOs’) to store personal information and important data generated from critical information infrastructure in China. These requirements are likely to be expanded by the Personal Information Protection Law, the draft of which was released in October 2020.
</WRAP> |
^ Local Copy Required ^ <WRAP>
Companies are required to keep a copy of data in local servers or data centers. This allows for easier access to this data for regulation and law enforcement purposes, i.e., it is generally easier for local law enforcement agencies to access data stored locally than it is for them to access data stored in another jurisdiction.
</WRAP> | <WRAP>
  : **India**
  : Under India’s Personal Data Protection Bill, sensitive personal data (which includes financial information) must be stored in India, but a copy of the data can be transferred internationally if certain requirements are met. These include:
    : 1. The data principal provides explicit consent, the transfer is made pursuant to a contract or intra-group scheme approved by the Data Protection Authority
    : 2. The government has deemed a country to provide adequate protection
    : 3. The Data Protection Authority has specifically authorized the transfer
</WRAP> |
^ Narrower, conditional restrictions ^ <WRAP>
Transfers of data outside the country are only permitted if certain conditions are met by the transferee and/or by the recipient country.
</WRAP> | <WRAP>
  : **European Union**
  : Under the EU’s GDPR, the transfer of personal data outside the European Economic Area is permitted only where:
    : 1. The recipient is in a territory considered by the European Commission to offer an adequate level of protection for personal data
    : 2. Safeguards are in place, such as binding corporate rules approved by Data Protection Authorities
    : 3. A legal exemption applies, such as where data subjects provide explicit consent, the transfer is necessary to fulfill a contract or there is a public interest founded in EU or member state law

  : **Brazil**
  : Under the General Personal Data Protection Law (LGPD) international data transfers are only permitted in certain situations, including when recipient countries ensure an adequate level of data protection, when approved legal mechanisms (such as model contract clauses) are employed or when data subjects have provided their consent.
</WRAP> |
</table>


/**=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
/* To add a discussion page to this page, comment out the line that says 
 ~~DISCUSSION:off~~
*/
~~DISCUSSION:on|Outstanding Issues~~
~~DISCUSSION:off~~
OMG Central Bank Digital Currency (OMG-CBDC) Working Group (WG) Wiki

User Tools

Site Tools

Page Tools
