- Cross-border data flows are an integral mechanism of today’s economy, impacting a country’s competitiveness and growth. All economic sectors rely on secure, cost-efficient and real-time access to data. A requirement that all data-related business processes must take place within a country does not only affect social networks and e-commerce, but any business directly or indirectly.
- The Russian privacy legislation (the “OPD Law”) has been amended by a new law (FZ-242) that includes a clear data localisation requirement. Article 18 §5 of the law requires data operators to ensure that any collection or use of personal data of Russian citizens is made using databases located inside Russia.
- Data localisation leads to productivity losses as firms may not be able to use services provided from abroad, or must set up their own domestic data centres inside Russia. Experience shows that the data-intensive service industry will pass on new costs from regulatory compliance to other sectors of the economy, and the productivity loss it generates leads to lower returns of investment.
- The losses are equivalent to -0.27% of gross domestic product (GDP), equivalent to a loss of 286 billion roubles (US$ 5.7 billion). Applied with 2015 IMF forecasts, the Russian economy would contract by -4.1% this year. Investments in the Russian economy would drop by -1.41% or 187 billion roubles, with considerable effects on employment. The manufacturing sectors are hardest hit, as they must absorb cost increases from their suppliers.
- These highly negative results have taken into account any possible positive effects (e.g. from Russian data processing firms replacing foreign ones). However, the losses are too large to be offset by new jobs created or government initiatives like subsidies and other incentives. Russia’s production structure would shift towards less innovative and volatile sectors such as agriculture, raw materials and energy.
- Yet the numerical results of this analysis do not fully capture the longer term adverse effects of regulations of data flows on technological progress, competitive behaviour and Russian firms’ innovative capacities. Since these factors are the main drivers of long-run economic output growth, our results are likely to significantly underestimate the economic losses arising from data localisation requirements.
Please Note: This paper is now available in Russian language version here.
Introduction – the importance of data to the economy
Over the last decade, data has become a critically important resource for business. As global economies have become digitalised, firms are increasingly using data in their production processes and in servicing their clients. Manufacturing depends on real-time connection with its suppliers, market places and transporters; service industries like logistics, retail, public utilities or financial services depend on processing information to deliver to its clients; provision of healthcare and social services process more data than ever before. In short, cross-border data flows are an integral mechanism of today’s economy, impacting a country’s competitiveness and growth.
Recent statistics show that data even plays a similar (or sometimes bigger) role in manufacturing than raw materials or energy a fact that may surprise many. Businesses of all kinds are sending, receiving and processing data across borders to improve efficiency and to grow. They rely on secure, cost-efficient and real-time access to data across borders. In fact, 75% of the value derived from the internet comes from traditional industries. As a result, if a law requires that all data-related business processes must take place within a country, it does not only affect social networks and e-commerce; any business is affected by such a requirement to localise data.
Through the new amendment to the OPD Law, designated FZ-242, Russia may now introduce a requirement to localise any personal data physically within the country. However, much (if not all) data contains information that could be construed as personal data. In reality, there is no technical or legal way to separate personal data from non-personal mechanical information. Any transaction on the internet made while logged in to an account is effectively personal data, and even the most harmless pieces of company data will contain information about the employee. The scope of the law is sweeping, and firms are likely to store non-personal data locally.
Russia is not the first country in the world to impose such data localisation requirements across all sectors of the economy: Vietnam, China, Indonesia and India have implemented similar laws. However, none of these developing countries has a GDP per capita that exceeds US$ 5 000. Russia – with an economic output that is three times larger – will be the first modern economy to attempt full data localisation. Also, half of Russia’s GDP comes from the services sector, which uses data extensively. A cost prohibitive measure that forces firms to store their data in every country in which they operate would have unforeseeable consequences for the Russian economy and its ability to attract investments and create jobs.
It is worth noting that other BRIC nations, notably Brazil, have withdrawn data localisation laws for fear of hurting its own economy. Given the precarious economic conditions in Russia, it is critical that the country is not exposed to further risks of damaging the economy.
 See Bauer, Lee-Makiyama, van der Marel, ‘A Methodology to Estimate the Costs of Data Regulations’, ECIPE Working Paper, 02/2014
 McKinsey Global Institute, ‘Internet Matters: The Net’s Sweeping Impact on Growth, Jobs, and Prosperity’, 2011
 World Bank World Development Index, 2013