Data Localization, International Law Perspective

Category: Current Issue, Articles, Vol. 12, No. 2, 2025, Ali, Shareef Sanar, International Law & Regional Integration

Download article

Authors: Ali, Shareef Sanar

Title: Data Localization, International Law Perspective

Abstract: Although the core principles of the General Agreement on Trade in Services (GATS) can extend the agreement to the movement of data, thereby enhancing the effectiveness of GATS in the digital age, there is very little to prevent governments from implementing wide data localisation measures, as GATS provides broad exceptions that create leeway for circumventing these obligations. Additionally, the ambiguity surrounding internet technology has given governments more justification. After all, how could anyone challenge these policies when technology and intelligent services themselves were once incapable of detecting what Edward Snowden later exposed? In response to these uncertainties, and the existing security exceptions in GATS, countries continue to invent new data localisation measures through different approaches. China forbids data transfers by default, only allowing them as exceptions, and emphasises national security with ambiguous discretionary limits. The GDPR limits transfers from outside the EU in order to balance privacy and trade but provides exceptions. The USA, without a unified federal legislative framework, has focused localization on areas such as taxation and defence, motivated mostly by national security. Given these dynamics, and the sensitivity of national security, the author argues that greater emphasis should be placed on reactivating the role of WTO panels and, at the very least, establishing broad boundaries for what constitutes security, even if the concept itself is difficult to define precisely.

Keywords: Data protection, data localization, data flow, international trade law, trade barriers, WTO panels

Cite as: Ali, S. S. (2025). Data Localization, International Law Perspective. Studia Juridica et Politica Jaurinensia, 12(2), 123–142. https://doi.org/10.71100/STUDIA.2025.2.8

Doi: 10.71100/STUDIA.2025.2.8

References:

  1. Abe, Y. (2021). Data localization measures and international economic law: How do WTO and TPP/CPTPP disciplines apply to these measures? Public Policy Review, 16(5), 1–29. https://www.mof.go.jp/english/pri/publication/pp_review/ppr16_05_02.pdf
  2. Bahri, A. (2020). Challenging localization: Analyzing data localization against GATS. International Journal of Legal Science and Innovation, 2(3), 337–346. https://www.ijlsi.com/wp-content/uploads/Challenging-Localization-Analyzing-Data-Locali zation-against-GATS.pdf
  3. Bowman, C. (2017, January 6). Data localization laws: An emerging global trend. JURIST – Hotline. http://jurist.org/hotline/2017/01/data-localization-laws-an-emerging-global-trend. php
  4. Chander, A. & Le, U. (2014). Breaking the web: Data localization vs the global internet. UC Davis Legal Studies Research Paper, No. 378. https://ssrn.com/abstract=2407858
  5. Charter of Fundamental Rights of the European Union (CFR).
  6. Cory, N. (2017, May 1). Cross border data flows: Where are the barriers and what do they cost? ITIF. https://itif.org/publications/2017/05/01/crossborder-data-flows-where-are-barriers-and -what-do-they-cost
  7. Cybersecurity Law of the People’s Republic of China (2016) (CSL).
  8. Data Security Law of the People’s Republic of China (2021) (DSL).
  9. Del Giovane, C., Ferencz, J. & López González, J. (2023). The nature, evolution and potential implications of data localisation measures. OECD Trade Policy Papers, No. 278. OECD Publishing. https://doi.org/10.1787/179f718a-en
  10. Devane, H. (2022, January 27). Data localization: A complete overview. Immuta. https://www.immuta.com/blog/data-localization/
  11. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 (Data Protection Directive).
  12. European Commission. (2021, June 4). Updated standard contractual clauses for data transfers. European Commission. https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
  13. Executive Order No. 14117: Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern (2024) (EO 14117).
  14. Fahey, E. (2023). Does the EU’s digital sovereignty promote localisation in its model digital trade clauses? European Papers, 8(2), 503–511. https://www.europeanpapers.eu/europeanforum/does-eu-digital-sovereignty-promote-loca lisation
  15. Fraser, E. (2016). Data localisation and the Balkanisation of the internet. SCRIPTed, 13(3), 359. https://doi.org/10.2966/scrip.130316.359
  16. Hodson, S. (2019). Applying WTO and FTA disciplines to data localization measures. World Trade Review, 18(4), 579–607. https://doi.org/10.1017/S1474745618000277
  17. Inside Privacy. (2022, May 3). Leaked draft version of the European Health Data Space regulation. Inside Privacy. https://www.insideprivacy.com/international/european-union/leaked-draft-version-of-the-european-health-data-space-regulation/
  18. Internal Revenue Service. (2021). Publication 1075: Tax information security guidelines for federal, state, and local agencies (Rev. 11-2021). https://www.irs.gov/pub/irs-pdf/p1075.pdf
  19. Kyger, L. (2024, August 8). Data localization and other barriers to digital trade. Hinrich Foundation. https://www.hinrichfoundation.com/research/article/tech-digital-trade/data-localization
  20. Lu, W. (2024). Data localization: From China and beyond. Indiana Journal of Global Legal Studies, 31(1), 183–202. https://muse.jhu.edu/pub/3/article/924201
  21. National Board of Trade. (2014). No transfer, no trade: The importance of cross-border data transfers for companies based in Sweden. National Board of Trade. https://unctad.org/system/files/non-official-document/dtl_ict4d2016c01_Kommerskollegi um_en.pdf
  22. (2020). Data localisation trends and challenges: Considerations for the review of the OECD Privacy Guidelines (OECD Digital Economy Papers No. 301). OECD. https://www.oecd.org/content/dam/oecd/en/publications/reports/2020/12/data-localisat ion-trends-and-challenges_d775fe8a/7fbaed62-en.pdf
  23. Outbound Data Transfer Security Assessment Measures (2022) (ODTSAM).
  24. Personal Information Protection Law of the People’s Republic of China (2021) (PIPL).
  25. Provisions Pertaining to Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons (2024).
  26. Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation) (GDPR).
  27. Regulation (EU) 2022/868 of the European Parliament and of the Council (Data Governance Act) (DGA).
  28. Regulation (EU) 2023/2854 of the European Parliament and of the Council (Data Act) (DA).
  29. Regulation on Network Data Security Management (China, 2024) (NDSM Regulation).
  30. Regulations on the Security Protection of Critical Information Infrastructure (China, 2021) (CII Regulations)
  31. Satori Cyber. (2024, December 1). Data localization 101: The essentials. Satori Cyber. https://satoricyber.com/cloud-data-governance/data-localization-101-the-essentials/
  32. Singh, J. (2022). Data localization. Jus Corpus Law Journal, 3(2), 495–503. https://www.juscorpus.com/wp-content/uploads/2023/01/96.-Jigyasa-Singh.pdf
  33. Tang, A. (2021, July 6). Cross-border data transfer and data localization requirements in China. ISACA. https://www.isaca.org/resources/news-and-trends/industry-news/2021/cross-border-data-transfer-and-data-localization-requirements-in-china
  34. Tseng, E. (2024). Data localization: The compatibility with GATS and its outlook. Michigan Journal of International Law Blog. https://www.mjilonline.org/data-localization-the-compatibility-with-gats-and-its-outlook/
  35. Whorra, G. (2022). Data localization: An issue beyond borders. RGNUL Financial and Mercantile Law Review, 9, 43. https://heinonline.org/hol-cgi-bin/get_pdf.cgi?handle=hein.journals/ rlfladme2022&section=7
  36. World Trade Organization. Argentina – Measures relating to trade in goods and services. Panel Report of 2015. No. WT/DS453/R.
  37. World Trade Organization. Argentina – Measures relating to trade in goods and services. Appellate Body Report of 2016. No. WT/DS453/AB/R.
  38. World Trade Organization. Korea – Measures affecting imports of fresh, chilled and frozen beef. Appellate Body Report of 2000. Nos. WT/DS161/AB/R and WT/DS169/AB/R.
  39. World Trade Organization. Russia – Measures concerning traffic in transit. Panel Report of 2019. No. WT/DS512/R.
  40. World Trade Organization. United States – Measures affecting the cross-border supply of gambling and betting services. Panel Report of 2004. No. WT/DS285/R.
  41. World Trade Organization. United States – Measures affecting the cross-border supply of gambling and betting services. Appellate Body Report of 2005. No. WT/DS285/AB/R.
  42. Yakovleva, S. (2018). Should fundamental rights to privacy and data protection be a part of the EU’s international trade “deals”? World Trade Review, 17(3), 477–508. https://doi.org/10.1017/S1474745617000453
  43. Yakovleva, S. (2024). Personal data transfers in international trade and EU law: A tale of two ‘necessities’. In Governing cross-border data flows: Reconciling EU data protection and international trade law. Oxford University Press. https://doi.org/10.1093/oso/ 9780192899248.003.0002
Back to the previous page

studia logo.webp

Topics

Current issue

studia-vol12-no2-2025_cover.jpg