Personal Data Protection and Safeguarding Draft Act June 2019 … In addition, requiring Internet Service Providers to store data locally can create a barrier to entry into the market for new platforms and services. This would negatively affect the freedom of expression of users, who will see their access to resources for research, education, and communication reduced. Indeed, meeting the requirement of data localisation is complex and costly, and harms individual users or new initiatives by potentially depriving them of the conditions of interoperability necessary to connect globally. Freedom of expression and democracy assume the free flow of information and require the prevention of measures that create fragmentation in the internet. … In this respect, the exercise of freedom of expression requires conditions that encourage—rather than discourage—user access to a plurality and diversity of media.83 The UN Special Rapporteur for Freedom of Expression and Opinion, in his 2016 report, recommended “It will be particularly critical for States to avoid adopting legal rules that implicate digital actors—including, but not limited to, data localisation standards, intermediary liability and internet security—that undermine the freedom of expression…”84 In comparison, the GDPR does not impose any requirement that the data be located in an EU Member State. It requires that the state have adequate data protection provisions similar to the GDPR; personal data can be transferred to third countries under the condition that the level of protection of natural persons guaranteed by the Regulation is not undermined. The two relevant sections state: Article 45: A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory, or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation. Article 46: In the absence of an adequacy decision by the Commission, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. Other countries in the region have also followed this approach. In Turkey, personal data can be transferred abroad if sufficient protection is provided in the foreign country where data is to be transferred or the Board has authorised such transfer, where sufficient protection is not provided.85 The same principles also apply in Tunisia.86 4. Failure to Balance Data Protection with the Right to Information The public right of access to information held by public bodies is a fundamental aspect of the right of freedom of expression87 The right of access to information and data protection often play complementary roles. They both are focussed on ensuring accountability of powerful institutions to individuals in the information age. Michel Gentot, the former President of the French National Commission for Liberties and Informatics (CNIL), stated “FOI and Data Protection” are “two forms of protection against the Leviathan state that have the aim of restoring the balance between the citizen and the state". International law clearly requires that the right of access to information is reconciled with the right of privacy. As with freedom of expression, any limitations must be established in law, necessary, and proportionate.88 Office of the Special Rapporteur for Freedom of Expression Inter-American Commission on Human Rights, Freedom of Expression and the Internet, 2013. 83 Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, A/71/373, 6 September 2016. 84 85 Turkey Law on the Protection of Personal Data, Article 9. Tunisia Organic Act 2004-63 on the Protection of Personal Data, 27 July 2004, Art. 51. UN Human Rights Committee, General Comment 34. 88 Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Frank La Rue, A/68/362, 4 September 2013. 86 87 ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 26 of 58