How can we get data flowing freely among nations with different cyber laws?

Data Free Flow with Trust (DFFT), a proposed guiding principle for international cooperation on data flows, is moving into the implementation phase

Data is the fuel that powers the digital economy. While rules for handling data inevitably vary from one country to another, it is important to ask: Can we minimize barriers to cross-border data transfers in order to address common challenges and bring benefits to society? Creating an environmentally sustainable circular economy, for example, requires building a system to capture carbon-related information on products throughout entire global supply chains. That, in turn, requires coordinating data-related regulations in every country – a huge and complicated task. How can it be achieved?

This is where Data Free Flow with Trust (DFFT) comes in. DFFT was first proposed by Shinzo Abe, then the prime minister of Japan, as a basic principle for rule-making in the field of cross-border data transfers. After its debut in Davos, DFFT was endorsed in June of 2019 by members of the G20 group of nations.

The DFFT concept has influenced rule-making on data-related issues in many countries. Countries around the world have since been working to establish rules for digital trade that align with the DFFT concept. For example, the Japanese government has agreed to hi-standard e-commerce rules in two trade agreements: the Japan-US Digital Trade Agreement and the Japan-UK Economic Partnership Agreement (EPA). In addition, preliminary discussions on data-related rules are underway between Japan and the EU. At the regional level, the Regional Comprehensive Economic Partnership (RCEP) is also part of this trend, while Japan, Singapore and Australia are jointly facilitating multilateral discussions on e-commerce at the WTO.

Data consensus challenges

There are several barriers currently facing the DFFT initiative. Most significantly, international harmonization is extremely difficult because each country has a different approach to data protection and data trust. Reaching a global consensus on rules that involve security and privacy, in particular, will take time, as national interests and viewpoints vary widely. The issue of government access to private-sector data is a prime example of such an issue. Government access can include actions ranging from purchasing data from the private sector to requesting information for national security reasons.

Categorizing different kinds of government access in ways that policy-makers and other stakeholders in a range of countries can understand is an important step in reconciling perceptions and creating a basis for discussion, and forms part of our work on this topic. The OECD has been working on this issue and making steady progress, but it is expected to take some time to reach a global consensus. In the end, every country needs to take responsibility for explaining its rules and gaining the understanding of its trading partners.

The DFFT Roadmap, developed at the G7 Digital and Technology Ministerial Meeting in 2021, reflects this understanding of the issues. In addition to offering guidelines for trustworthy and reliable government access to data, the roadmap established action plans in three other areas: data localization; regulatory cooperation; and data sharing for priority sectors.

DFFT: A bottom-up approach

One argument against DFFT is that if a country participates in a cross-border data transfer system before its domestic data ecosystem is firmly established, its data assets could be stripped by foreign entities.

But the cost of sitting on the sidelines is high. Cross-border data flows can have significant benefits for local economic growth, as the World Economic Forum's white paper, Advancing Data Flow Governance in the Indo-Pacific: Four Country Analyses and Dialogues described.

What is required, then, is a pragmatic and bottom-up approach to DFFT that meets the needs of business. This means that high-level and comprehensive intergovernmental rule-making efforts can parallel public-private partnerships to resolve individual issues.

A recent report by Japan's Ministry of Economy, Trade, and Industry (METI) analyzed cross-border data flows at the business level, dividing the issue into six categories (see below) of specific challenges and measures, and made recommendations.

According to the report, some IoT manufacturers face the following pain point: They sell IoT equipment globally and provide maintenance service, including failure predictions based on real-time data about operating conditions. However, regulations regarding the handling of such data vary from country to country and change frequently. A clear and uniform process to determine what kinds of information can cross borders would allow for greater leveraging of the capabilities of IoT, including real-time monitoring.

“Few discussions about DFFT have examined specific situations in which 'data does not flow' in business settings," said Professor Tatsuhiko Yamamoto, chair of the panel that compiled the report. "We gathered and analyzed cases on the lifecycle of global data transfer using private sector voices and real examples."

These challenges could be solved by establishing a mechanism using RegTech, technologies designed to automate compliance and process monitoring. In this regard, a white paper issued by the Forum in April 2022 identifies seven common success factors that help define best practices in RegTech deployment.

One upcoming milestone for DFFT is likely to be the G7 in 2023, which will be hosted by Japan, the country that proposed the concept in 2019. At the Davos Agenda 2022, Kishida Fumio, prime minister of Japan, expressed his commitment to the effort by stating: "Three years ago in Davos, our country advocated DFFT. We are taking the DFFT even further forward.”

As the summit milestone approaches, we hope the debate on DFFT will broaden to include real-world benefits and applications. In that context, we expect that DFFT-aligned public-private partnerships will become even more important as solutions to business pain points.

Written by
Fumiko Kudo, Project Strategy Lead, C4IR, World Economic Forum, Japan
Ryosuke Sakaki, Fellow, C4IR, World Economic Forum, Japan
Jonathan Soble, Editorial and Communication Lead, World Economic Forum, C4IR Japan