Further, the unweighted average of all dimensions pertaining to a particular pillar yields the score for that pillar, whether enablers or safeguards. The average scores for dimensions 1–3 provide an overall sense of how enablers are performing, while dimensions 4–7 do the same for safeguards. No attempt is made, however, to average the scores obtained for enablers and safeguards into an overall country score. This avoids the creation of country rankings, as the purpose of the exercise is not to rank countries but rather to help them identify gaps in their respective regulatory frameworks.

Under the safeguards pillar, data governance regulatory environments for personal data and non-personal data are assessed differently. The personal data dimension collects information on the regulatory practices adopted to protect data that convey information specific to a known (or knowable) individual. Personal data protection that takes a human rights approach is considered good practice—emphasizing the rights of data subjects, including the right to challenge the accuracy of data and obtain corrections. An independent data protection authority also plays an important role in enforcing compliance of those requirements. With nonpersonal data, a balance must be struck between data sharing and protecting intellectual property rights. Cybersecurity and cybercrime are additional dimensions covered under the safeguards pillar. The cost of malicious cyberactivity in the US economy was estimated in 2016 at $57 billion to $109 billion (Council of Economic Advisers 2018). For the sustainable development of the data economy, there needs a regulatory framework that criminalizes illegal cyber-activities, specifies cybersecurity measures and requires the establishment of organizations such as national Computer Security Incident Response Teams (CSIRT). Finally, the safeguards pillar, includes cross-border data flows, the global volume of which increased twentyfold between 2007 and 2017, with a further threefold increase expected in the 2017–22 period (Cisco 2018). How cross-border data flows are regulated may shape a country’s competitiveness and opportunities in international trade. For instance, data localization conditions may deter some firms from opening offices in some countries.

The enablers pillar begins with an examination of the regulatory environment for e-commerce/etransactions. According to the UNCTAD (2020), the global value of e-commerce sales was estimated at $25.6 trillion in 2018, accounting for about 30 percent of global GDP. Comprehensive e-commerce regulations support inclusive e-commerce by suppressing digital inequities (UNCTAD 2019). They also could increase trust in the use of data to facilitate e-transactions. In addition, public intent data dimension measures regulatory provisions related to data collected for public purposes. An enabling regulatory environment that promotes the use and reuse of public intent data not only allows governments to achieve better development outcomes through evidence-based policy but also to create opportunities for private sector growth and innovation, as well as contribute to the development of the society as a whole through improved transparency and accountability. Private intent data dimension covers provisions regulating data collected with the original intent of pursuing commercial purposes. The recent booming of data-driven businesses has shown the potential of private intent data in supporting innovation, efficiency, and inclusion.

# **4. Findings**

# _4.1 The global picture_

Diagnostic results show the different regulatory environments that countries have adopted, enabling data use for market players on the one hand while safeguarding the rights of data subjects on the other (map 1). According to their scores on the safeguards and enabler pillars, countries fall into four groups: advanced, moderate, evolving, and basic. A score of 75–100 confers an advanced level for enabling/safeguarding and is coded green; a score of 50–75 confers a moderate level, coded yellow; a score of 25–50 indicates an evolving regulatory level, coded orange; while a score below 25 is considered basic and coded red.

6