As the Brazilian lower house of Congress, Camara de Deputados, prepares to vote on the Internet Framework bill, ITI joined a coalition of nearly 50 global business groups urging in a letter to congressional leaders to reconsider proposed in-country data storage requirements. The proposals come from the Rousseff Administration and aim to secure Brazilian citizens’ data in response to NSA surveillance revelations
In the letter, global business groups highlight the potential impact these requirements could have on Brazil’s businesses, citizens, and economy, given their reliance and integration into global digital trade flows. ITI is also concerned that mandating in-country data storage would in practice become an obligation to build data centers in Brazil as a condition of market access. ITI urges all governments to refrain from local infrastructure mandates, which are discriminatory and contrary to the notion of cross-border trade. Moreover, server location does not determine whether data are properly secured. Rather, it depends upon the mechanisms and controls in place to safeguard the data -- for example, ensuring that comprehensive security policies are developed and implemented, and that the security infrastructure is routinely audited to identify and remedy vulnerabilities.
If Brazil’s Congress approves these requirements, it will set a dangerous precedent that could embolden other countries to impose similar requirements. A domino effect of these requirements would be extremely disruptive to the open, global, and decentralized nature of the Internet. By balkanizing the Internet, countries’ requirements for data storage localization would not only limit the ability of their own local ICT service providers, content creators, and platforms to reach new markets worldwide, but also effectively shut foreign companies and their technologies out of multiple markets, disrupting global digital trade and restricting local users’ ability to access to customized and localized services globally available.
As demonstrated by the wide array of industry groups supporting the letter, in-country data storage requirements would have significant ramifications beyond the ICT industry. From manufacturing to healthcare to services, industry groups from more than 17 countries across Africa, Asia, Europe, and the Americas highlighted in the letter the unintended consequences an in-country data storage mandate could have on their industries:
- Decreased security: Data security is not a function of where data are held but how they are maintained and protected. A focus on the physical location of data distracts from this reality and would leave data in Brazil potentially more insecure.
- Higher costs: With these requirements, Brazil would be limiting its computational capacity overall and would not be leveraging economies of scale, thereby raising costs for end users who must pay for additional infrastructure.
- Decreased competitiveness: Cut off from the most innovative and efficient cloud services and the strongest computing power around the world, Brazil risks being unable to develop its tech sector and being uncompetitive in the global economy. In addition, these in-country data storage requirements risk being emulated by neighboring countries, which would significantly frustrate Brazil’s aspiration to become a regional IT and data center hub for Latin America.
- Harm to consumers: Data localization requirements would deny Brazil’s internet-savvy consumers access to cloud services available around the world that yield social, economic, and security benefits.
Earlier this year, ITI urged the Brazilian Government to instead institute government policies and the necessary infrastructure that will encourage competitive investment in data centers in Brazil, policies that foster innovation and the growth of commerce, and legislation that protects individuals’ privacy while allowing them to benefit from the digital economy and the information flows that support it. ITI is ready to work with the Brazilian Government to ensure that citizens’ data are secure while creating a competitive environment for the growth of the digital economy in the Americas and around the world.
Read the full text of our letter here.