Member states and tech firms wary of EU ‘data flows’ plan

Commission Vice-President Andrus Ansip confirmed last month that he will propose legislation on the 'free flow of data' later this year. Now some advocates for the legislation worry he won't go far enough. [European Commission]

This article is part of our special report Cross-border business in the digital era.

Tech companies want the European Commission to propose new legislation in autumn that they hope will bring down data storage costs in some countries. But rumoured changes have worried firms that France could pressure the executive to weaken the rules.

A vocal group of firms have pushed the Commission to introduce a law that would make any national laws requiring storage within one EU country illegal unless the restriction is grounded in security concerns.

Now some companies are concerned that the executive’s proposal, expected in September, will be watered down by loopholes. Several sources close to the drafting process said the Commission is likely to take on a French proposal to include three exceptions guaranteeing authorities’ access to data, a so-called portability right for users to move their data between storage centres and EU-wide security standards for data facilities.

France is the only EU country that outright opposes the legislation, which is now colloquially known as the “free flow of data” proposal. Twice over the last year, more than a dozen countries signed letters to the Commission asking for an EU-wide ban on data localisation laws. Some member states are not sure a law is necessary but haven’t lobbied against it. In May, Commission Vice-President Andrus Ansip confirmed that he will draft a bill by autumn.

By the Juncker Commission’s own estimates, data contributed €272 billion, 1.9% of GDP, to the EU’s economy in 2015. A Commission document from January predicted that “if policy and legal framework conditions for the data economy are put in place in time”, that figure could rise to €643 billion by 2020. The document also mentioned that the executive is looking into data access and portability issues.

Fifteen countries ask for EU legislation on data flows

Ministers from 15 EU countries have asked the European Commission to focus on removing barriers to digital trade one week before the executive presents a mid-term review of its flagship Digital Single Market policies.

Three exceptions

But if the Commission includes those three exceptions, some countries might see it as a downgrade from what they hoped would be an absolute ban on data localisation.

“For those member states that were pushing for removing the localisation restrictions, it’s an extra hurdle that was added to the plate,” one EU source said.

Companies lobbying in favour of the data rules also said they don’t want those changes to go through.

One tech industry source said measures on portability and security shouldn’t be in the law. “These are gifts to the French government which have nothing to do with the free movement of data in the EU,” the source said.

Countries that want the new rules argue that big member states can force companies to set up data centres within their borders if they have laws requiring data to be stored there. That means member states with no data restrictions can lose out on business.

Several firms that responded to a recent European Commission consultation said they could save money if they were no longer required to store data in one country in order to sell services there.

Microsoft wrote in response to the survey that it cannot offer cloud services in EU countries with data localisation rules if it does not have data storage centres there. Getting rid of those restrictions “would directly contribute to our ability to expand our market base in member state markets”, Microsoft wrote.

Nessa, a Madrid-based banking software firm, wrote that getting rid of localisation laws could have a “multiplying effect in business”.

Other firms said they were not sure if the rules would affect them because they only store data in one country.

Ansip promises EU rules on data flows by autumn

The European Commission will propose legislation later this year to get rid of national restrictions that prevent data from moving between EU countries, following calls from more than a dozen member states to crack down.

Hot vs cold countries

Ministers and national attachés have debated the plans since last year. Talks have also opened up a split between warmer countries and cooler ones, where firms might save on energy costs for data storage centres.

Countries including Estonia, Denmark, Poland, Latvia, Lithuania, Sweden and the Czech Republic signed the two letters asking the Commission to legislate.

“If we have data localisation measures in big member states, nobody will invest in a data centre in little Denmark,” said Katinka Worsøe, an EU policy advisor at the Confederation of Danish Enterprise.

Worsøe said cool weather and green energy bring down costs in Denmark. She argued the country’s comparatively high labour costs might not be a deterrent because data centres do not employ as many people as factories.

Nordic countries have experienced a boom in data storage business, according to research from Gartner, a tech consultancy. Companies might even have “savings up to 50% to hosting infrastructure in the northern part of Europe” because of weather and energy costs, a 2014 note from the consultancy said.

Several EU officials suggested the rules could encourage companies to relocate data centres. One diplomat predicted the legislation would not cause firms to rush to cooler countries.

“Most data localisation requirements result as much from user preferences as from legal obligations,” said Yann Bonnet, director of the French Digital Council, the government’s digital policy think tank.

Poland has been outspoken in favour of a data law. But its Digital Minister, Krzysztof Szubert, is open to negotiating exceptions.

“The principle of free flow of data needs to be enshrined in European law. We also need to work on a flexible, future-proof and innovation-friendly framework for access, portability and interoperability of data,” Szubert told EURACTIV.com.

Skeptical states

A different group of member states are skeptical that the rules will change anything. Earlier this year, the Commission estimated that there are around 50 data localisation restrictions written into member states’ national laws.

Since then, the executive has scrutinised each country’s laws. Two diplomats said the Juncker Commission told them in May that their countries had a much shorter list of restrictions than previous estimates suggested. That weakened the case for legislation, the two diplomats said.

Even companies and diplomats who want an EU law say the rules would be most useful as a safeguard against any legal changes to put up barriers between countries in the future.

“There are already requirements now, but for us the really big problem would be if more are added. This is a chance for the EU to make sure that the protectionist wings don’t get too much of a go,” Worsøe said.

Kallas: We're 'a very small bit closer' to a digital single market

MEP Kaja Kallas told EURACTIV.com in an interview that Europe needs a law guaranteeing data flows across the bloc and shared her concerns about Digital Commissioner-designate Mariya Gabriel.

Background

The plan to create an EU-law guaranteeing the free flow of data quickly gained traction in the European Parliament too. Estonian Liberal MEP told EURACTIV this week that data restrictions “diminish the economy”. Bulgarian centre-right MEP Eva Maydell said that getting rid of data localisation laws would “lead to more competition” in the internet of things and cloud computing.