The Australian government is set to introduce bilateral restrictions on data localisation through its free trade agreement with the United Kingdom, even as it considers introducing broader requirements for local data storage.
Legislation to enable implementation of the Australia-United Kingdom Free Trade Agreement (A-UKFTA) — the first negotiated by the UK since Brexit — passed this week, with the agreement set to begin a month after the UK passes its own bill.
Once in effect, the agreement will commit the two countries to “cross-border data flows and prohibit unjustified data localisation requirements”, according to the Department of Foreign Affairs and Trade (DFAT).
Under the deal, Australia and the UK will not be “permitted to prohibit or restrict the transfer of information, including personal information, where the transfer is necessary for the conduct of ordinary business”, a recent parliamentary report notes.
It also includes a mutual commitment against requiring businesses to build data storage centres or use local computing facilities within each country’s domestic jurisdiction.
Some exceptions exist, namely that each party may contravene the commitments to pursue a “legitimate public policy objective”.
Public policy objectives may include the protection of personal information, personal privacy, and the confidentiality of individual records and accounts. Local computing facility requirements for “financial regulation” is also permitted, if it is not otherwise possible to obtain the data “sufficient, direct, regular or timely access”.
DFAT says the measures against data localisation are included to provide “a more certain and secure online environment and support increased growth in digital trade between Australia and the UK”.
Similar clauses to avoid data localisation laws have been agreed with several countries, including in the Digital Economy Agreement between Australia and Singapore, signed at the end of 2020.
However, the Australian and UK agreement comes alongside the Department of Home Affairs’ ongoing preparation of a National Data Security Action Plan, which consulted on the potential for data localisation laws.
The National Data Security Action Plan consultation paper, released in April, notes that data localisation laws are increasingly being adopted in other jurisdictions “often to stop insecure transfer of personal information across borders”.
In September, submissions to the discussion paper revealed contrasting opinions between Australian governments and big tech companies on data localisation.
Business groups joined companies like AWS, Meta, and Google Cloud in arguing that data localisation presented no inherent benefit to cybersecurity and would impede the economy.
The Tech Council of Australia, for instance, argued that “data localisation is based on the misconception that cybersecurity risk is dependent on physical location”.
CSIRO alongside state and territory governments, however, saw some benefit in data localisation.
The Australian Capital Territory government said it is “supportive of data localisation for governments and critical infrastructure providers” but that it should be accompanied by measures to “encourage businesses to invest in new and emerging technologies within Australia”.
The A-UKFTA is also the first Australian free trade agreement that includes a dedicated chapter to innovation containing several initiatives, including an Innovation and Early Career Skills Exchange Pilot visa program.
The visa program will make 3,000 visas available over two years. The innovation stream allows “participants with a demonstrated contribution to innovation” to work and live in Australia for up to three years.
A Strategic Innovation Dialogue will also be established with the UK to promote innovation policy focused on trade and “encourage trade in innovative goods and services”, such as artificial intelligence and emerging technologies.
While the Australia-UK free trade agreement was signed in December 2021, under the previous Coalition government, the UK government has yet to complete the domestic procedures needed to ratify the treaty.
The Trade (Australia and New Zealand) Bill is still before the UK Parliament’s House of Commons.
The free trade agreement will enter into force 30 days after both parties to the treaty has passed enabling legislation.
Do you know more? Contact James Riley via Email.
It all seem a bit confusing still. Does this agreement allow for the flow of personal medical records between both countries?
Can a digital health product that hosts client’s data in the UK, expands into Australia and be able to store data of Australians in the UK?
Please help clarify.
If your stuff is down the other end of a (vulnerable) undersea cable, or through a transit facility, or at the whim of a regime outside Australia, well yes AWS, Meta, and Google Cloud data localisation DOES present an inherent benefit to cybersecurity (and the holy “sovereign capability”). Apparently those naughty Russians and Chinese are going to rip up underseas cables, aren’t they? And NO, it won’t impede the Australian economy. It will probably create “jobs” in this country. And maybe the profits can stay in Australia too. I think that’s better. And NO to Tech Council of Australia and CEO Pounder, it’s NOT “data localisation””. Cybersecurity risk includes transit risks. Less transit, less risk. Sounds good to me. Let’s localise.