Why Google's Research Study on Data Localization and Cybersecurity Shouldn't Be Taken Seriously...
Earlier this week, Google announced the release of a research study - conducted by Leviathan Systems, but commissioned by Google - which sought to compare the security of cloud-based versus localized systems.
Many countries around the world have recently proposed laws that would require companies to keep the data about that country's users within national borders. For example, if a website in France was saving the personal data of French citizens, then the law would require the website to save that data somewhere within France's borders, as opposed to, say, California. The logic is two-fold: first, information about a country's citizens would stay out of the hands of spying foreign governments and, second, it would better enable countries to design and implement their own privacy laws (to that point, privacy laws are much stronger in the European Union than in the United States).
Predictably, Google and many other high-tech firms have come out against such laws requiring data localization. For them, it's an added expense. Google would need to backup and store user data within each such country in which it operates, rather than using Silicon Valley as its central hub for everything.
Because of this opposition, one has to be somewhat skeptical of a research study paid for by Google concluding that data localization is so clearly negative. Their argument is that cloud-based systems are more secure than localized ones, and that there would be a shortage of expertise within many countries to put stronger cybersecurity measures into effect.
It's not that there's no truth in that claim, it's just that we can be forgiven for being a little skeptical. This has become the modus operandi within the tech industry: lobby elected representatives, lobby regulatory agencies within the Executive Branch, and pay for-profit think-tanks to conduct research studies which, often, lead to predetermined results favorable to its sponsor.
From a purely economic point of view, of course Google wants to avoid data localization requirements. But there are non-economic arguments for why localization might be considered a positive - namely, the better protection of privacy rights. Google can hardly be considered unbiased, and thus, this study's conclusions shouldn't be considered authoritative, by any stretch.