The new findings counter claims that citizens find value in imposing constraints on international data sharing.
BLOOMINGTON, Ind. – It’s become increasingly common to receive a formal letter notifying you that your personal information has been included in a data breach. Social media and other online platforms collect so much information that notion of privacy is little more than an illusion. So how do Americans and others around the world feel about limiting the sharing of their data?
New research from the Indiana University Kelley School of Business and the Technology Policy Institute set out to answer that question, surveying people in the United States, the United Kingdom, South Korea, Japan, India, Italy and France.
Jeff Prince
“As data become increasingly valuable, policymakers have debated how to oversee data privacy. A compelling dimension of this debate concerns data localization mandates – rules that require certain types of data to be stored in their country of origin,” said Jeff Prince, professor of business economics, the Harold A. Poling Chair of Strategic Management and chairperson of the Department of Business Economics and Public Policy.
Prince and his co-author, Scott Wallsten, president of the Technology Policy Institute and a senior fellow at the Georgetown Center for Business and Public Policy in Washington, D.C., carefully designed several conjoint surveys and analyzed the participants’ choices over different data sharing arrangements.
The results showed that citizens in seven highly populated countries placed little to no value in data localization requirements.
“We found, at most, only modest evidence of added value resulting from data localization,” Prince said. “To the extent that there is added value from localization, it appears to largely come for data types where privacy – full restrictions on data sharing – is already highly valued.”
Such high value data largely includes financial information, such as bank balances and biometric information.
Data localization laws can significantly impact the business practices of data-intensive firms such as Apple, Google and Microsoft.
Prince and Wallsten also found no evidence that excluding China and Russia affected the evaluation of data localization restrictions among Americans, British, Italian, Indian and French citizens.
In contrast, Japanese and South Koreans expressed a preference against excluding China and Russia if data were being shared internationally.
“Our findings have several implications. First, they suggest that the use of privacy concerns as motivation for data localization laws may be overstated, although there may be some gross welfare gains for some types of data,” Prince and Wallsten wrote. “Our findings also indicate that if international sharing is allowed, restricting prominent authoritarian countries such as China and Russia appears to have little impact on consumer value, at least for a number of highly populated countries.
They go on to conjecture on why Japanese and South Koreans may be averse to excluding China and Russia in international data sharing: “China, Japan, and South Korea comprise a significant economic bloc, so this finding could indicate a belief by Japanese and South Korean citizens that restricting data access to a major trading partner could come at a cost.”
These findings counter the claims or implications that citizens find value from imposing constraints on international data sharing. Rather, they highlight that citizens may be mindful of downsides of restricting access from trading partners. Welfare justifications for data localization laws should not rely only on assumed preferences of citizenry for such restrictions.
Nations that have enacted such laws include Kazakhstan, Russia, China and Vietnam, and France and the United States are considering them. The European Union, through its General Data Protection Regulation imposes a form of data localization, placing restrictions on exporting data outside the EU.
Prince and Wallsten are authors of the working paper under peer review, “Do People Around the World Care Where Their Data Are Stored?”