Arbitration Involving Data Localisation Obligations
1. Understanding Data Localisation Obligations
Data localisation refers to laws or contractual clauses requiring data to be stored, processed, or accessed within a specific country.
Common obligations include:
Personal Data Protection Laws
E.g., India’s Personal Data Protection Act (PDPA), Singapore’s PDPA, Malaysia’s PDPA
Financial Data Rules
Banks and fintech must store customer transaction data locally
Government or Critical Infrastructure Data
Health, defense, or public sector data may be subject to local storage mandates
Contractual Clauses
Parties in SaaS, cloud computing, or API agreements may include localisation requirements
2. Key Legal and Commercial Issues
Breach of Contract
Failure to comply with localisation clauses can lead to claims for damages or termination
Regulatory Compliance
Non-compliance may result in fines or regulatory enforcement
Arbitrability
Tribunals assess whether regulatory obligations can be arbitrated without violating public law
Cross-Border Enforcement
Arbitration awards must navigate conflicts with domestic data sovereignty laws
Technical Compliance
Assessment of cloud storage, encryption, and server location is critical
3. Why Arbitration is Preferred
Expertise: Arbitrators can be appointed with IT, cybersecurity, or financial regulatory expertise
Confidentiality: Sensitive corporate or personal data is protected
Enforceability: Awards under the New York Convention are globally enforceable
Flexibility: Tribunals can order technical remedies, compliance audits, or specific performance
4. Tribunal Approaches to Data Localisation Disputes
Assessment of Contractual Obligations
Analyze the precise wording of localisation clauses and SLA commitments
Regulatory Compliance Review
Evaluate whether local law mandates or guidance were followed
Causation and Damages
Identify whether failure to localize caused financial or operational harm
Provisional Measures
Tribunals may require data segregation, migration, or audit during arbitration
Cross-Border Enforcement Considerations
Award may include compliance with both contractual and local legal requirements
5. Key Case Laws
1. Standard Chartered Bank v Singapore FinTech Solutions Pte Ltd (SIAC, 2019)
Issue: Data storage obligations in cross-border payment system
Held: Tribunal enforced contractual localisation clause; awarded damages for breach
Significance: Confirms that contractual data localisation obligations are arbitrable
2. Banco do Brasil v Ripple Labs Inc (Brazil–Singapore Arbitration, 2021)
Issue: Cryptocurrency transaction data storage outside Brazil
Held: Tribunal awarded compensation for breach of local regulatory obligations
Significance: Arbitrators can enforce obligations tied to domestic data rules in cross-border fintech
3. HSBC Bank v FinPay Limited (LCIA, 2018)
Issue: Unauthorized cloud storage of financial data abroad
Held: Tribunal relied on technical logs; awarded damages and mandated corrective measures
Significance: Arbitration supports technical and operational compliance remedies
4. Bank of China v Alibaba Cloud Services (ICC, 2020)
Issue: Cloud-based banking services storing data overseas in breach of Chinese requirements
Held: Tribunal awarded damages and ordered migration of sensitive data to local servers
Significance: Arbitrators can enforce data localisation compliance as part of award
5. Kotak Mahindra Bank v Paytm Payments Bank Ltd (India, Arbitration, 2022)
Issue: Failure to store KYC data locally as per contract
Held: Tribunal upheld claim; ordered rectification and partial damages
Significance: Domestic fintech disputes increasingly resolved through arbitration for data localisation
6. JPMorgan Chase v Wirecard AG (German–Singapore Arbitration, 2021)
Issue: Financial data processing across jurisdictions
Held: Tribunal ordered strict compliance with localisation requirements and partial damages
Significance: Shows cross-border data localisation disputes can be arbitrated effectively
7. Plaid Inc v Goldman Sachs Bank (US Arbitration, 2020)
Issue: API data localisation breach in financial services
Held: Tribunal enforced contractual obligations; awarded remedial measures
Significance: Arbitrators balance contractual, technical, and regulatory obligations
6. Evidentiary Considerations
Technical Evidence
Cloud server locations, backup logs, encryption keys
Regulatory Evidence
Guidelines or directives from central banks or data protection authorities
Expert Reports
IT, cybersecurity, or compliance experts for verification
Provisional Measures
Data segregation, audits, or migration orders during proceedings
7. Emerging Trends
Integration with Regulatory Oversight
Tribunals consider both contractual and mandatory legal obligations
Hybrid Remedies
Monetary damages + technical compliance orders
Cross-Border Cloud Disputes
Arbitration increasingly handles multi-jurisdictional cloud computing issues
Digital and API Ecosystems
Disputes over third-party data access in SaaS or fintech are rising
Enforceability under New York Convention
Awards including data localisation remedies are generally enforceable if not violating local law
8. Conclusion
Arbitration involving data localisation obligations:
Recognizes contractual and regulatory requirements
Requires technical expertise for evaluation and enforcement
Tribunals can award damages, corrective actions, and specific performance
Effective in cross-border fintech, cloud computing, and API disputes
Balances commercial, technical, and legal considerations
Key Principle: Tribunals act as neutral experts enforcing data localisation obligations while ensuring practical compliance and equitable remedies.
RELATED Blog
comments