The Australian government has been urged to drop data localization from its national data security action plan by “big tech” companies like Telstra, Optus, and their contemporaries.
Optus [pdf] compares localization to the federal government’s ongoing attempt to remove departmental data from the Global Switch facility in Ultimo in opposition to the premise that Australians’ data should be preserved here.
Optus stated that the ongoing removal of Australian government data from the Global Switch Ultimo (GSU) facility will have taken more than ten years and cost hundreds of millions of dollars to accomplish.
According to Optus, the cost of the GSU project would be greatly outweighed if the government mandated “transferring data from an overseas to a domestic location.”
Instead, Telstra [pdf] advocates risk-based recommendations, which is also backed by Optus’ contribution.
Telstra said that guidelines that help data custodians comprehend the proper level of security and potential hazards in other countries would be a suitable method to protecting data sovereignty while allowing flexibility.
Telstra, Optus, and other carriers raised worry about the mounting costs associated with conflicting data security legal frameworks.
Adding to this collection will only increase confusion, according to Telstra, which highlighted the Protective Security Policy Framework (PSPF), the Information Security Manual (ISM), and the Digital Transformation Agency’s (DTA) Secure Cloud Strategy.
The Privacy Act, which is under reviewed and may result in tighter restrictions on access to personal information, and the Consumer Data Right, which “is premised upon wider access,” are two examples of laws whose objectives are at odds, according to Optus.
While Optus recognises the need for robust data security regulation and the
handling of personal data, it is more challenging to accomplish this with the
development of redundant requirements that aren’t always appropriate, according to the carrier.
The Communications Alliance says that the action plan should be delayed because of how other national frameworks interact with one another and are “still in flux” themselves.
Given the uncertainty surrounding the Privacy Act, Security of Critical Infrastructure Act, and Consumer Data Right, “it is important to give Before beginning new, significant projects in related and overlapping sectors, it is important to give these processes enough time to be finished and settled.
