another service or product provider in a structured readable format.<sup>23</sup> More in detail, the right to portability has been adopted approximately by 14 percent of high- and lower-middle-income countries, 9 percent of upper-middle-income countries, and 6 percent of countries in the low-income group.

Another issue investigated under the private intent data dimension is the voluntary licensing on FRAND terms, which enables companies and patent holders to share technology and data. On the one hand, holders of data-related intellectual property rights (IPRs) are encouraged to invest in products and markets, as they can control access to licensed products and receive returns on their investments. On the other hand, sectoral or international standard setting organizations may require patent rights to be applied on FRAND terms when these are considered standard essential patents. The diagnostic results show that voluntary licensing to access essential data on FRAND terms is regulated in 14 percent and 9 percent of high- and uppermiddle-income countries, respectively, while the matter is not regulated by any lower-middle- and lowincome country.

As more and more economic transactions occur online, the ability of private sector actors to digitally verify the identity of users against the ID system becomes essential for efficient digital transactions. High-income countries are taking the lead on adopting such practices, with more than 79 percent of them allowing so. For instance, Canada’s SecureKey Technology digitally identifies users through the online credentials used with private partners.<sup>24</sup> A comparable solution is found in approximately half of the upper-middle-income countries. However, no low-income country allows private sector actors to digitally verify the identity of users against the ID system.

# _4.4 Existence of laws vs. robustness of laws_

The details presented above on data regulation frameworks seek to capture the existence of foundational laws, the robustness of these laws, and data governance administration. These additional details comprise the value this diagnostic provides compared with efforts like UNCTAD’s e-transaction database and DLA Piper’s data protection law tracker. Besides collecting information on the existence of any e-commerce and data protection laws, ATI, or open data legislation, the diagnostic also measures the robustness of such laws to assess whether they contain specific provisions or regulatory attributes. Moreover, in order to capture information on the implementation of those regulatory frameworks, the diagnostic also includes a few questions on administrative aspects of data governance, such as any digital ID systems for e-services, key institutions such as CSIRTs for cybersecurity and data protection authorities, common technical standards to ensure government system interoperability, mandatory data classifications used across government systems, and so on.

The diagnostic results show that although many countries have established various data regulations, those regulatory frameworks are not extensive enough or sufficiently aligned with good regulatory practices to ensure that the legal framework can create an enabling environment for the data economy (figure 10). Lowincome countries in particular are weak on technical infrastructure or institutional settings that enable robust data governance, such as the existence of digital ID system for e-services, mandatory use of common technical standards to ensure government system interoperability. In comparison, high-income countries show a high score on the administrative aspects of data governance even though some legislation is not robust enough with a full range of regulatory good practice incorporated. This reflects quite a pragmatic approach in exploring the most appropriate regulatory framework for their countries.

> 23 See art. 438 of the Digital Code Act, accessible at: https://sgg.gouv.bj/doc/loi-2017-20/

> 24 Additional information available at: https://www.canada.ca/en/revenue-agency/services/e-services/cra-login-services/sign- <u>partners-help-faqs/using-a-sign-partner.html</u>

24