Facilitating cross border data flow in the Digital Single Market : final report

This study investigated the prevalence of restrictions of the free flow of data within the EU, based on primary and secondary (covering CZ, FR, DE, IT, LT, LU ES and UK). Absolute prohibitions outside areas of core national interest (security and defence) are rare. Compliance obligations are typically aimed at ensuring regulatory oversight and access. In addition, some businesses have strict 'data residency' requirements that are not based on formal legal restrictions. Location is seen by many market participants as a proxy for security, despite the fact that technical security is not enhanced by local data storage. However, functional requirements for data storage and processing within national boundaries arise from legitimate concerns about illegal access; accessibility of services and support (including language barriers); and latency and bandwidth. These cannot be dismissed and may justify location preferences. An important finding is the widespread misinterpretation of the existing legal framework. Many market participants assume data storage and processing within national boundaries is mandatory or advised where it in fact is not. A lack of reliable 'digital trade' statistics means that the economic impact of restrictions on the free flow of data is difficult to assess.