In association with

Whose law is it anyway? Microsoft data centre raises questions

Wednesday's announcement that Microsoft will build a data centre in Auckland raises jurisdictional questions over which country's law will apply to the data stored on its servers, Marc Daalder reports

In announcing the construction of a new Microsoft data centre in Auckland, Prime Minister Jacinda Ardern touted the project's implications for data sovereignty.

"It also adds a bit more comfort when it comes to data sovereignty, through on-shore storage, which has been an issue that’s been raised in many quarters," she said at a press conference on Wednesday afternoon.

Data sovereignty comes into play when determining whose law applies to data stored in a specific location. It can also involve indigenous concerns over government or corporate entities storing or owning indigenous data or intellectual property.

In this case, Ardern seemed to be saying, New Zealand will have a bit more control over the data stored in servers on its soil than that stored overseas.

"If the information is here in New Zealand, then it or the entity that's storing it here will be subject to New Zealand law," Rick Shera, an IT law expert and partner at the law firm Lowndes Jordan, told Newsroom.

"That means in particular our Privacy Act. Our Privacy Act has a relatively strong right of access to that information for the individual about whom that information is. That access right is being strengthened under the bill that is coming through at the moment."

Although the new Privacy Bill will apply to data stored overseas if the entity has any presence in New Zealand, it's a lot easier to deal with data stored locally than internationally, Shera said.

"Now sometimes they can apply in an offshore environment as well, but certainly if the data is here in New Zealand and the entity controlling it is subjecting itself to New Zealand law by putting the data here and having a data centre here, then yes our laws will be much more applicable than trying to enforce them overseas. Which is often a rigamarole because you have to get a New Zealand judgment and try to get it enforced in an overseas jurisdiction and sometimes that works and sometimes that doesn't."

Shera said Microsoft choosing New Zealand was a vote of confidence in our regulatory framework.

"It's a real sign of confidence by Microsoft in New Zealand and New Zealand law to put a data centre here. In the privacy area, it reflects the fact that New Zealand privacy law is recognised internationally as a strong privacy law in giving adequate protection to individuals," he said.

Privacy isn't the only issue at play, however. After March 15, the Chief Censor ruled footage from the attacks and the manifesto written by the terrorist were objectionable content. Despite take-down requests from the police, some overseas websites refused to pull the content. If it had been stored in a Microsoft data centre on New Zealand soil, however, a request to Microsoft could prove more effective.

"They would be subject to New Zealand law, whether that be privacy or any of the other laws that might apply in the online environment," Shera said.

"So I'm thinking the Films, Videos, and Publications Classification Act, which deals with objectionable material. There's the Harmful Digital Communications Act, which deals with seriously emotionally distressful information. There are all of the various copyright statutes which apply to copyright area. All of those will apply to that data."

However, there's another issue: the CLOUD Act. This 2018 American law claims jurisdiction over data that is being stored by a company connected to the United States, even if the data itself is stored outside US borders.

"The United States is renowned for this: It passes laws which it argues have international effect. In a sense, it tries to enforce its laws in other jurisdictions simply because the entity, in this case Microsoft, might have some sort of connection to the United States," Shera said.

"With Microsoft, it obviously has a very strong connection with the United States, but often entities will have a very very marginal relationship with the United States, but the United States still feels that it's empowered to take action in the United States against foreign entities."

Help us create a sustainable future for independent local journalism

As New Zealand moves from crisis to recovery mode the need to support local industry has been brought into sharp relief.

As our journalists work to ask the hard questions about our recovery, we also look to you, our readers for support. Reader donations are critical to what we do. If you can help us, please click the button to ensure we can continue to provide quality independent journalism you can trust.

With thanks to our partners