Data Sovereignty vs Data Localisation Law

By: Sonny Zulhuda

Transferring personal data beyond national boundaries has been a point of contention under many data protection laws across the globe. The European Union adopts this restriction that such transfer beyond EU boundaries cannot be done unless to the countries or places which have adequate protection on personal data of individuals.

Cloud-Data-SecurityThis rule is associated with the concept of “Data Sovereignty” which says that a country shall not lose a control or sovereignty over the processing of personal data pertaining to data subjects from that country. It also imposes that information which has been stored in digital form is subject to the laws of the country in which it is located. Therefore, a control over trans-border data flow is a form of upholding data sovereignty.

The concept of Data Sovereignty is reflected in the EU Data Protection Directives 1995 recitals whereas:

  • cross-border flows of personal data are necessary to the expansion of international trade;
  • the protection of individuals guaranteed in the Community by this Directive does not stand in the way of transfers of personal data to third countries which ensure an adequate level of protection;
  • the transfer of personal data to a third country which does not ensure an adequate level of protection must be prohibited.

As much as we are concerned with personal data transferred beyond our border, we also appreciate that personal data is inherently needed for the International trade and International cooperation. Hence, when a personal data is subject to trans-border flow, there shall be no discriminatory treatment to the citizen’s personal data despite where it is processed.

Data Localisation Law

This data sovereignty is sometimes confused with the rules of “Data Localisation”, which is totally a different thing. Data localisation laws set forth requirements to keep and store data “locally” (i.e., within national or regional borders), and thus not allowing data users to transfer data beyond borders. Consequently, any foreign party who wishes to collect or process personal data of individuals will be required to establish a local data storage facilities in the country of those individuals. Continue reading

Advertisements

Data Protection in the Era of Big Data, the Internet of Things (IoT) & Cloud Computing

By: Sonny Zulhuda

ALB Conference 2015This is the second such conference being organised by ALB/Thomson Reuters on Data Protection following the successful event a year ago. I spoke in a panel session last year, and will be speaking again this time. The conference will be on Thursday, 7th May 2015 at the JW Marriott Kuala Lumpur.

Keynotes will be delivered by Trevor Hughes, President of the International Association of Privacy Professionals (IAPP); Dr. Zainal Abidin Sait, Deputy Director-General of the Personal Data Protection Malaysia Department (PDPD); and Prof. Abu Bakar Munir, who was the Data Protection Consultant to the Malaysian Government.

My panel session is the one slotted at 16:10, focusing on “Data protection in the era of Big Data, the Internet of Things (IoT) & cloud computing,” covering the Jurisdiction and marketplace: Asia Pacific, EU and US.

Continue reading

  • October 2017
    M T W T F S S
    « Jul    
     1
    2345678
    9101112131415
    16171819202122
    23242526272829
    3031  
  • Visitor

    free counters

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,574 other followers