Data Localisation – The DCDT’s Draft National Policy on Data and Cloud

Over the last months we have reported on the DCDT’s proposals for data localisation. The Minister hosted a meeting of stakeholders on 18 June. The following was EFSA’s statement which supports our written submission on the Draft National Policy:

“The Ecommerce Forum of South Africa (EFSA) thanks the Honourable Minister for Communications and Digital Technologies, and her staff for arranging a stakeholders’ meeting on the Draft National Policy on Data and Cloud for 18 June 2021.

EFSA has submitted its detailed written views on the Draft Policy.

The following points emphasis some aspects already raised by the Forum.

• EFSA stresses its support for all efforts by government to reduce the digital divide in South Africa. The right to reasonably priced access to telecommunications and the internet is essential for all citizens in particular during the continuing COVID pandemic.  This is essential for the enablement of access to financial products as well as enhanced participation in the economy through access to additional products and services.
• Education on the  digital economy starting at secondary school through tertiary institutions and training establishments, in our view, is essential for the youth in South Africa. This should not just be confined to data and cloud. EFSA calls for an inter-governmental body to work with private bodies, such as ourselves, to plan effective and encompassing curricular to ensure that the young are adequately prepared for the digital future.
• EFSA recognises that the establishment of robust regulations on data sovereignty (the rules surrounding personal and non-personal data) is essential for the future of the digital economy in South Africa. Such regulations include data privacy (eg POPIA, PAIA, ECTA), intellectual property rights, cybersecurity rules, company law and governance (in particular the recommendations of King IV).
• EFSA also recognises that rules on the national storage of financial data have been imposed recently in some countries.
• However, it is noted that the extent of personal and non-personal data which the Draft Policy proposes should be covered is far greater that elsewhere – insofar as the Draft Policy implies that a copy of all personal and non-personal data generated in the RSA must be localized (stored) in the RSA. EFSA calls for a harmonization between current legislation and regulation and the proposed regulatory regime governing data to ensure that there is not an overlap or flagrant disharmony.
• Data localisation is still a new legal concept. Its long-term effects if applied extensively across all sectors are unknown. In particular, EFSA has pointed out in its submission to the DCDT that the policy is likely to restrict access to cloud computing and to the Internet of Things, which will increase costs and reduce research potential, particularly for South African SMEs. As the South African economy is already under severe pressure due to the current COVID crisis, this may severely impact already compromised companies.
• Localisation is also likely to reduce the effectiveness of cybersecurity by concentrating data in one locality. For this reason, data localization is not a universally favoured approach to data governance.
• The policy when applied to financial data will reduce the options for e-payments and new digital currencies across national frontiers. This is of particular importance for the scalability of ecommerce as well as foreign participation (eg foreign direct investment) in the economy.
• EFSA believes that the POPIA supported by the Information Regulator is fully fit for purpose in the digital environment; and that privacy is a human right which should not be undermined.
• The issue of public access to private data (personal or non-personal) raised by the Draft Policy is in need of clarifying.
• EFSA is concerned that South Africa, which enjoys by far the most advanced cloud environment in Africa with 4 mega-cloud services, fails to provide leadership within the African Free Trade area (AfCFTA) with this broad proposal for data localisation.
• Localisation is a fundamentally protectionist approach toward the free flow of data, and could restrict future intra-African trade, which in turn would reduce the potential for the re-industrialisation of Africa.
• Data localisation should best be approached at continental not national level and consideration should be given for the exportation of data to countries with sufficiently stringent data protection regulation such as the EU.
• EFSA therefore calls on the DCDT to withdraw the Draft Policy until there is more certainly on any unintended negative effects”.