## 3 Discussion
### Data Localization and Data Portability: A New Regime for Old Problems  
In the face of concerns about the security and privacy of data in the cloud, lawmakers in jurisdictions around the world are turning to data localization measures. These legal or quasi-legal tools include laws, regulations, and policies designed to ensure that data and records are accessed, processed, and stored within a specific jurisdiction. Data localization measures attempt to assert greater control over the privacy rights of data owners whose records cross jurisdictional borders. This approach is a direct result, then, of the recognition that, when data crosses jurisdictional lines, that data might well be subject to the laws of the other jurisdiction or jurisdictions into which it crosses. In a world that is increasingly embracing the cloud, records that are there stored or accessed will most certainly cross jurisdictional lines in the absence of concerted efforts to keep them in a particular jurisdiction. Data localization measures concern scholars and commentators for a number of reasons, including the arguments that they a) enable oppressive regimes to establish tighter control over the records of their citizens, b) stand in the face of the idealistic concept that the cloud should support a free and open internet, and c) harm the very security of data by pooling records in one place which might invite the attention of those with ill-intent. Others hold that data localization laws serve as a \"pernicious form of non-tariff barrier which harms the growth of trade in a digitally powered world\" [31]. Data localization advocates, on the other hand, focus on how data localization measures can help address the legal and security imbalance created by the multijuridirectional reality of records in the cloud. For example,scholars at the University of Toronto have considered the risks to those who use e-communications such as cloud services. In their report titled _Seeing Through the Cloud_, the authors underscore that \"...moving to the global Cloud requires Canadians or those living in Canada to forfeit their rights and protections as citizens and residents--particularly their constitutional protections...\" [32]. Put another way, if a Canadian citizen entrusts his/her records to a CSP who physically stores them at a server farm located in the United States, the Canadian's records will enjoy less privacy protection than similar records stored in the same place by an American citizen. Until such a time when records stored in the cloud can remain secure and private, those that advocate the blanket cessation of data localization measures risk taking away one way to address the privacy imbalance that currently exists with records in the cloud. The usefulness of a particular data localization law as a tool for either trust or security is of necessity fact-dependent. Data localization measures must not be viewed as being all passed for the same reasons by the same countries; much like in the case of \"privacy\", data localization laws embrace a diversity of legal tools which apply to different records in different ways. For example, data localization laws in British Columbia, Canada, are primarily contained in the Freedom of Information and Protection of Privacy Act (FIPPA), which is limited in its application to public bodies. Kazakhstan, by contrast, requires almost all information in the \"kz\" domain to be hosted domestically ([31], p. 139). The effectiveness of a particular data localization law must be evaluated in the context of that regulation and its application. That said, the general principles behind data localization laws can and should be scrutinized for their effectiveness in improving the trustworthiness and security of records in the cloud. The first assumption of data localization laws is that, by limiting the jurisdictions in which records and data can be accessed, processed, and stored, those records will be protected from bad actors against whom another jurisdictions' laws would provide no recourse.