How cybersecurity and data storage laws could pull the plug on Southeast Asia’s digital economy

Southeast Asia is one of the most diverse regions in the world, a handful of countries with thousands of languages and cultures, yet all having one thing in common – bold ambitions for their digital economies.

From the establishment of digital agencies like Malaysia Digital Economy Corporation in Malaysia and the Digital Economy and Promotion Agency in Thailand, to charting impressive road maps such as Thailand 4.0 and Making Indonesia 4.0, many governments in the region are prioritising capturing as much of the region’s US$200 billion digital economy opportunity as possible.

What isn’t clear is how these bold aspirations will be achieved.

Despite the inherent benefits of digital technologies and the internet, many governments are pursuing policies that will limit the use of these technologies. Driven by pressure to address specific and immediate challenges including cybersecurity, data protection, privacy and misinformation, governments fail to consider the long-term impact of these laws on economic growth, jobs and investment.

Vietnam’s recent Law on Cybersecurity and Indonesia’s Government Regulation 82 are examples of this, with provisions including restrictions on data flow and content, requirements for foreign companies to set up local offices and local data storage requirements. Meanwhile, proposed rules in Thailand subject over-the-top (OTT) service providers to tax, security and content regulations.

Suspected culprits behind massive Singapore hack attack revealed

The impact of these regulations goes far beyond the information and communications technology industry, given that virtually every business today uses the internet and digital technology.

For foreign businesses, restrictive, too broad and unclear regulations create uncertainty and an unfriendly investment climate. Multinational companies unable to make long-term financial decisions are likely to shift their investments to countries with more flexible regulatory environments that support the development of a digital ecosystem.

Local businesses, like small and medium-sized enterprises and entrepreneurs that comprise 95 per cent of Southeast Asia’s economy, will bear the brunt of poor policies. Restrictions on cross-border data flows, digital tax and local data storage, will prove difficult to comply with.

Many small businesses depend on digital services and platforms such as cloud for data storage and collaboration, online marketplaces for e-commerce, social media for communication and marketing, and OTT platforms to reach customers at scale. Such laws will increase the cost of doing business, create barriers for expansion beyond borders and are likely to block small players from competing in the global marketplace.

Why countries fencing themselves in won’t help cybersecurity

For example, if a neighbouring country enacted similar provisions to Vietnam’s cybersecurity law, a Vietnamese software start-up would be unlikely to be able to afford data storage facilities and local offices in locations outside Vietnam – curbing regional or global expansion plans.

With significant economic prospects at stake, and the challenges of security, privacy, data and misinformation in mind, governments must find better ways to manage risk without hampering growth.

Southeast Asian governments can learn from how larger, developed economies manage emerging technology. For example, Thailand has looked towards the European Union’s implementation of the General Data Protection Regulation as a basis for their data protection laws.

On taxation, intergovernmental organisations such as the Organisation for Economic Co-operation and Development provide useful guidance in key areas such as the need to create consistency between countries on cross-border digital taxes. Unilateral moves like Australia’s goods and services tax in July 2018 on low-value imported goods is likely to pose compliance challenges and higher costs for small businesses in the long run.

Instead, a cross-sectoral range of agencies, ministries and industry players could together craft comprehensive policies that manage risk and promote growth. A good example of this is Singapore’s approach to digital taxation and preventing misinformation.

The digital economy is uncharted territory for most. There is a small window of opportunity now to ensure smart regulations and policies are in place to secure future growth. Technology companies and industry groups can work with governments, ensuring that the opportunities and benefits of the digital economy are realised and not wasted.

Jeff Paine is managing director of the Asia internet Coalition