That would be a godsend because the disease is seldom discovered until late, at which time the patient’s prognosis is almost invariably grim.

For their research, WEHI researchers are using the PURPLE Pancreatic Cancer Translational Registry. The registry tracks the treatment of over 4,000 patients across Australia, New Zealand, and Singapore. That is a sizable sample, but it is a fraction of the 500,000 people diagnosed with the disease globally each year. A larger dataset would undoubtedly provide more insights into the disease and accelerate their findings.

Unfortunately, it is often not possible to include data from the European Union, China, and other countries in such research in a timely manner because of measures restricting cross-border access. Over the past decade, numerous countries have implemented data-related measures with the stated purpose of enhancing cybersecurity, improving data privacy, or pursuing myriad other policy goals.

Some countries have also implemented a variety of “data localization” requirements limiting where data can be processed or stored. While politicians often justify such requirements as being integral to data privacy, other policy objectives are also at play. Most of these laws include strict guidelines regarding where personal data are kept, which often necessitate establishing data storage facilities within the country as well as limits on cross-border data flow.

Governments justify these restrictions by citing national security considerations, economic interests, or “digital sovereignty.” While policymakers treat these as costless interventions in the market, they have a direct and significant effect on the ability of pharmaceutical and medical device companies to conduct broad and diverse studies that cross national borders, limiting the size and diversity of trials.

Our analysis finds evidence that the expansion of these laws in the last few years has slowed the development of new drugs and medical devices. This diminution could soon affect patient diagnosis, treatment, and monitoring, as well as the progress of research and development, the pace of preclinical and clinical studies, and the ability to conduct post-market surveillance.

Why restrictions? / There are three broad justifications for data localization policies. First, jurisdictions impose these ostensibly to protect their citizens’ data and facilitate law enforcement efforts in pursuing or prosecuting criminal entities that might exploit such data. The claim is that, if these data move across national borders, they are more vulnerable to nefarious uses and less available to benevolent ones.

Second, countries implement these rules to bolster their domestic economy. They correctly believe the data have value and infer that storage within national borders somehow provides their economy with potential gains. For instance, with these mandates, nations seek to stimulate investment both in the creation of data storage facilities as well as in the analysis of the data.

A third motivation is rooted in concerns related to sovereignty. Countries express apprehension about being overly dependent on foreign nations or losing control over a potential economic resource (e.g., data and technology).

However, these arguments don’t hold water. For starters, there is little evidence that local data storage requirements protect the data (Brannon and Schwartz 2018). In fact, in authoritarian countries, it undoubtedly makes it more likely that such data will be illegally accessed by the government authorities themselves.

There is also no reason to think that storing data within one’s jurisdiction produces any tangible economic benefits. The investment in constructing a data center does not extend much beyond the cost of constructing the building, purchasing servers, and hiring a few people to secure the facility. The tangible economic benefits from the data largely come from researchers’ ability to access that data for research, which data localization agreements inhibit.

Data localization laws contribute to higher compliance costs, increased operational inefficiencies, innovation delays, market entry barriers, and reduced global trade. A 2016 report concluded that data flows accounted for $2.8 trillion of global GDP in 2014 and that “cross-border data flows now generate more economic value than traditional flows of traded goods” (Maniyika et al. 2016). A 2022 report discusses the importance of cross-border data flows in collaborating on research and development in areas such as health tech and pharmaceutical development (Zurich Insurance 2022). Yet, as can be seen in Figure 1, the trend of mandating data localization has been on the rise since the inception of the internet, with a noticeable acceleration over the last decade.

Quantifying the effects / The paucity of research on the nature and broad effects of data localization rules makes it challenging to quantify the costs imposed on drug trials and related medical innovation. We began our attempt to do so by surveying 400 experts in health economics or allied healthcare professions, and 32 participants responded to an online questionnaire. All respondents had graduate degrees in economics and did research that focused on health markets or public health.

The survey first asked if respondents knew of hindrances preventing researchers from readily obtaining cross-border access to pre-clinical, and/​or clinical data, as well as whether they thought these constraints serve to delay the discovery of promising chemical compounds, biological substances methods, or technologies for the treatment of many health conditions. Over three-fourths of respondents said they felt these rules did delay discoveries of new treatments for medical conditions. Only 7 percent of respondents indicated these restrictions have no effect on research and development. The survey results are shown in Figure 2.

The survey also asked respondents about their perception of the effects of data localization mandates and restrictions on cross-border data transfers on the costs of pre-clinical and clinical trials. Over 80 percent of experts we surveyed felt these rules effectively reduce the number of pre-clinical and clinical research trials.

We next asked respondents their thoughts on the effect data localization restrictions have on the safety and efficacy of innovation. Fully half reported they felt these restrictions decrease the safety and efficacy of new innovations in the biopharmaceutical sector, while 22 percent felt there would be an uncertain effect.

Fourth, we asked about the effect of data localization mandates and restrictions on the representativeness of data collected in research studies. Nearly two-thirds responded that data localization restrictions would decrease the representativeness of the data collected.

Lastly, we asked for their perspectives on how data localization mandates and restrictions disrupted innovation in health-related sectors. Nearly two-thirds of respondents felt these policies would create a notable disruption, while 23 percent felt the disruptions would be minor.

GDPR and drug development / Quantifying the effects of data localization rules and data transfer restrictions on drug trials poses myriad challenges. However, we can draw insights from the effects of similar policies on past research. To that end, we examined how the EU’s 2018 implementation of the General Data Protection Regulation (GDPR) affected clinical research involving the US National Institutes of Health (NIH), specifically on collaborations between the United States and the EU.

To estimate the effect of these restrictions, we began by examining data that compared the initiation of clinical trials funded by the NIH in the largest and wealthiest European Union countries (France, Germany, Italy, and the UK, collectively referred to as the EU4)—with trials initiated in the United States during the period surrounding the implementation of the GDPR. We obtained data from Clin​i​cal​Tri​als​.gov, an online repository of clinical research studies and their outcomes. This dataset enabled us to determine the number of new clinical trials initiated both before (2015–2017) and after (2018–2019) the enactment of the GDPR.

The analysis shows that in the two years following the GDPR passage, the number of NIH-funded clinical trials in the United States increased significantly (20.7 percent) compared to the three years preceding it. However, NIH collaboration with the EU4 countries sharply declined (47.5 percent) during the same period.

This decline could simply be an artifact of declining clinical trials within the EU4 relative to the United States. To see if that was the case, we examined data on total clinical trials—irrespective of NIH affiliation—for the EU4 countries and the United States. Total clinical trials in the United States increased by 14.7 percent between the 2015–2017 and 2018–2019 time periods (similar to the NIH-funded US trials at +20.7 percent). Total clinical trials started in the EU4 countries increased by 17.5 percent. Hence, the decrease in NIH-funded EU4 trials is not related to a broader reduction in clinical trials during this period.

These findings suggest that GDPR data usage constraints may have substantially diminished cross-border data collaborations. Future restrictions are likely to have similar consequences.

Drag on innovation / Countries pursue data localization measures in part because many jurisdictions have exaggerated the benefits of impeding cross-border data flow. There is no tangible evidence that such rules enhance data privacy, and no credible analysis has found that these steps have any tangible effect on a country’s economic activity. Nevertheless, such policies can be politically acceptable to the populace because the perceived benefits they generate for a country—a public perception of improved data security and some marginal economic activity or job creation—may outweigh the economic costs to that particular country.

The lost benefits from faster drug or medical device innovation ultimately get spread across the globe to other jurisdictions. Nonetheless, those losses are large—for the country imposing the regulations as well as the rest of the world. Our analysis suggests the global costs clearly outweigh the aggregate benefits.

As nations struggle with the dual objectives of safeguarding data and promoting international collaboration in drug and medical device development, researchers must do more to help policymakers understand the opportunity costs of data localization laws.

Readings

• Brannon, Ike, and Hart Schwartz, 2018, “The New Perils of Data Localization Rules,” Regulation 41(2): 12–13.
• Manyika, James, Susan Lund, Jacques Bughin, et al., 2016, “Digital Globalization: The New Era of Global Flows,” McKinsey Global Initiative, February 24.
• Zurich Insurance, 2022, “Cross-Border Data Flows: Designing a Global Architecture for Growth and Innovation.”