There has been a substantial policy movement in favour of the localisation of data storage over the past decade (for example, see here). Policymakers often justify data localisation policies by appealing to consumers' supposed preference for having their data stored locally. In particular, they refer to privacy concerns, lack of trust in data handling practices in other countries, and preference for supporting local data storage firms. However, the evidence that consumers have strong preferences for data localisation is very thin. In fact, this new article by Jeffrey Prince (Indiana University) and Scott Wallsten (Technology Policy Institute), published in the journal Information Economics and Policy (ungated earlier version here), may represent the first attempt to really evaluate consumers preferences for data storage.
Prince and Wallsten use a discrete choice survey to evaluate preferences for localisation for different types of data. Specifically:
We constructed five different survey structures, one each centered on the respondent’s smartphone, financial institution, healthcare app, smart home device, and social media. The data types we consider include home address, phone number, income, financial activity, health status and activity, biometrics, music preferences, location, networks, and communications. Across the five survey structures and range of data types, we measure the relative value of full privacy (no data sharing) versus sharing only domestically (localization), sharing domestically and internationally (no localization), and sharing domestically and internationally excluding China and Russia (no localization but with limits). We administered each of these five different surveys across seven different countries: the United States, the United Kingdom, South Korea, Japan, Italy, India, and France
Their sample, drawn from Dynata's online panel, is 11,375 respondents, with 325 completed surveys for each of the five survey structures, for each of the seven countries. Each respondent was shown ten different discrete choice questions. In each question, respondents would have been shown hypothetical alternative scenarios about how their data could be stored and shared, and had to pick their preferred alternative. However, the article doesn't make clear how many alternatives the respondent was choosing from in each choice task, nor whether they simply chose the best of the alternatives, or provided a full ranking of all of the alternatives. Those are issues that are consequential for the analysis, but probably don't bias the results in any way.
In terms of data localisation, Prince and Wallsten distinguish between data not being shared at all, and data being stored and shared domestically only, internationally, or internationally while excluding China and Russia. The latter is included because consumers may be more concerned about their data being stored in China or Russia than being stored in other countries. First, Prince and Wallsten find that:
...virtually all of our parameter estimates are highly significant. As these are estimates of (dis) utility from sharing data in one of three ways (domestically only, internationally, internationally except China and Russia) versus not sharing, the consistent, negative and statistically significant estimates imply that respondents across all of our countries are averse to sharing their data.
In other words, people really don't like their data being shared, regardless of how or where it would be shared. However, in terms of data localisation, Prince and Wallsten find that:
...it is evident that there are a just handful of data types for which we find any notable data localization premium: bank balance, facial recognition, home address, and phone number, all with multiple instances, and voiceprint, with one instance.
Interpreting these results, Prince and Wallsten note that:
...the data types for which we find a data localization premium are also the data types for which citizens find the most value in having no sharing of any kind... citizens across our seven countries, by and large, place little to no value in data localization requirements, despite placing value on full privacy for these data (i.e., no domestic or international sharing)...
In addition, there are no differences between sharing internationally, and sharing internationally while excluding China and Russia. If anything, there is some weak evidence that respondents in South Korea and Japan preferred to have their data shared with China and Russia. That’s striking given how often policymakers highlight the dangers of data flowing to China and Russia. Prince and Wallsten conclude that:
Our findings have several implications. First, they suggest that the use of privacy concerns as motivation for data localization laws may be overstated, although there may be some gross welfare gains for some types of data. Our findings also indicate that if international sharing is allowed, restricting prominent authoritarian countries such as China and Russia appears to have little impact on consumer value, at least for a number of highly populated countries...
...our findings do provide a counterweight to any claim that citizens find value from imposing constraints on international data sharing.
It may still be worthwhile for policymakers to insist on data localisation. Of course, this is just one study (albeit the first study) using survey data from an online panel, so we should be cautious about overgeneralising. Nevertheless, based on this study, the argument that data localisation reflects consumers' preferences for data storage does not hold up to scrutiny. If they want to keep pushing data localisation, policymakers will need to lean on geopolitical or protectionist arguments instead.
No comments:
Post a Comment