ISLAMABAD: The Asia Internet Coalition (AIC) comprising global digital media giants raised several questions on “data localisation” while saying it can contribute towards lower productivity, slower growth and reduced employment.
The Coalition in a report, “Data Localisation in Pakistan” estimates that labour productivity would decline by 14.7 percent in 2025 if the Personal Data Protection Bill, based on its May 2023 draft, is enacted in 2024. This can roughly be calculated in dollar terms to a GDP loss of USD 16.5 billion in the following year after enactment.
This decline in labour productivity and GDP loss can also be translated to a potential loss of 3.2 million jobs. Macroeconomic changes come about due to firms’ and consumers’ responsiveness to policy changes, the report noted.
The report noted that the current policy and regulatory landscape in Pakistan require some data localisation. However, there is room in the policy landscape for such measures to be further tightened. For example, the introduction of the current draft of the Personal Data Protection Bill would lead to a significant shift in the regulatory landscape relevant to data localisation.
The Commission, to be constituted under the Personal Data Protection Bill, has wider powers and can refuse to allow transfer of personal data on the grounds of vague terms like “public interest” or “national security of Pakistan”.
The report highlights that data localisation could also have repercussions for businesses, and consequently, on the economy. The additional requirements for, and the distinction made between, sensitive and critical data is a key focal point. Differentiated compliance processes for private sector and public sector was raised as a challenge by multiple firms. This challenge is likely to be compounded when data is to be shared between public and private organisations.
Concerns have also been raised about implications on cybersecurity if data localisation is required. For example, international cloud providers provide a variety of services, which may not be the case for local providers not benefiting from economies of scale. Further, points were raised that use of distributed systems can increase resilience, making databases less susceptible to
cybersecurity threats and outages.
Data localisation measures can have cost implications for firms, as highlighted in the case studies. This could include an increase in labour costs, given the need to hire human resources. This narrative, which suggests that data localisation would lead to job creation, may seem contradictory to the economic analysis, which suggests that jobs will be lost. This may, in part, be due to the economic analysis taking a longer-term view. One could assert that this is due to some players having to cease operations if costs become unsustainable. The skills gaps, and the time needed to bridge the skills gap, may also contribute. In part, it may be due to a model’s inability to capture all the nuances of the legal and regulatory environment, and firm behaviour.
Changes in the wider policy environment and market may change implications for firms. For example, many of the claims on the cost implications are made based on the current options for data storage in the local market; however, if an international cloud service provider were to set up data centres in Pakistan, the costs to firms may fall. However, certain concerns about data security and availability in the absence of distributed systems may remain.
Despite these common challenges, sectoral impacts will differ. The strategic positioning of the IT/ITeS sectors can be impacted by these laws, which in turn can influence investment and growth, In contrast, any impact on health provision - a merit good - can have knock on effects on the quality of life of Pakistan’s citizens,
As with many other areas, the extent of the impacts of localisation requirements would differ according to the governments approach to enforcement. A more light touch approach to enforcement will yield less stark impacts on an economy than a more heavy handed one. However, in principle, the merits of data localisation do not seem to outweigh the potential risks, as illustrated by its regional peers’ move away from such measures.
The report raised concerns on data localisation requirements. It stated that data localisation could increase hosting costs. One IT company estimated a 70 percent increase in hosting costs, while an ecommerce retailer estimated that a fully locally compliant solution for financial services would cost approximately over 10 times that of its current cloud-based solution. In the current environment, the high costs necessitated by a data localisation requirement are likely to disproportionately impact small and medium firms.
It further stated that data localisation may raise cybersecurity risks. An e-commerce retailer highlighted the risks of centralised data storage, emphasising that such approaches compromise the security benefits of a decentralised architecture. Further, an IT company highlighted concerns about disaster recovery and data mirroring under data localisation requirements.
Copyright Business Recorder, 2024
Comments
Comments are closed.