\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={Data Protection Laws Trends: Practice and Debate},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2021-03-15 (revised: 15 March 2021)}
\def\TheID{\makeatother }
\def\TheDate{2021-03-15}
\title{Data Protection Laws Trends: Practice and Debate}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Hedaia-T-Allah Nabil Abd Al  Ghaffar}

\renewcommand\Authands{ and }

\date{\small \em Received: 6 February 2021 Accepted: 28 February 2021 Published: 15 March 2021}

\maketitle


\begin{abstract}
        


Technological advancement changed the way everything is being done, providing extraordinary benefits and low costs. People and governments are increasingly adopting new technologies to achieve better performance and financial savings. However, those benefits do not come at no cost; technological advancements (such as Cloud Computing, Artificial Intelligence, Robotics, Internet of Things,..etc) involve several security challenges that may expose countries? national securities. The touchstone in this is data. Data has always been central to national security throughout different historical periods. Intelligence agencies? core of work has always been data; however, the mechanisms of getting and securing data evolved throughout history. Nowadays, the applications of different technologies generate enormous amounts of data that are stored in data centers located in different countries. Data could be traveling across countries and between data centers in a routine process so as to balance loads between data centers of the company. This process contains several security risks because countries lose control and sovereignty over the data generated or collected inside their territories, which exposes the core of nation?s sovereignty and national security.

\end{abstract}


\keywords{data protection, data localization, general data protection regulation}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
ata has always been an important resource and the main focus of countries' national security. In an extremely connected world, data generated by new technologies became even more important and in great need to be protected. On the other hand, D II. 
\section[{Mapping Data Protection Worldwide Trends a) The European Model (GDPR)}]{Mapping Data Protection Worldwide Trends a) The European Model (GDPR)}\par
The European Union has been regulating data protection in a very strict way over the years. The General Data Protection Regulation (GDPR) is the current law regulating data protection in EU. It came into effect on the 25 th of May 2018 after being approved by the EU Parliament on the 8 th of April 2016. By approving GDPR, the predecessor Data Protective Directive, which was regulating data protection in EU since 1995, was consequently obsolete \hyperref[b1]{[2]}. Even though the Data Protective Directive was doing well-protecting data in the EU, the European data was prone in the last years to several violations, which led to developing the GDPR.\par
The new GDPR aims at empowering European citizens to control their personal data in a more effective way, in addition to unifying laws regulating data transfer and protection among all European countries, given the fact that the predecessor Data Protection Directive was today's technologies, which contribute greatly to the worldwide economy, are based on the generation of data that is the basis for the Internet and for the growth of Artificial Intelligence, Big Data, Internet of Things, Cloud Computing and other technologies. Balancing between protecting national security while benefiting from new technologies is an extremely difficult task, especially in light of the security risks presented by new technologies that require transferring data across borders. One of the methods countries resorted to in order to achieve both targets is drafting data protection laws and regulations to protect national data from breaches and disclosure. However, countries took several ways and developed different models of data protection laws, some of which infused international debate. Building upon previously published research about government cloud computing and national security \hyperref[b0]{[1]}, the paper tries to answer a simple research question revolving around how do countries differ in protecting their data and national security. The paper tackles the topic of data protection trends between practice and debate; mapping international models and trends of data protection, shedding light on current debates in this regard, and finally presenting some broad guidelines that can help countries choose the most suited data protection alternative.\par
? Increased territorial scope: Increasing the law's territorial scope is considered one of the major changes that affected the EU data regulatory framework. This goes back to the fact that the new GDPR applies to all companies working with storing and processing personal data of individuals residing in the EU, irrespective of the place of the company.\par
In fact, this came as a remedy to the situation created by the predecessor Data Protection Directive, which was silent and vague about the territorial applicability of the directive. This led to filing many suits about whether to apply the directive or not in different cases. Therefore, the GDPR came out much stronger, compulsory and very clear regarding the territorial applicability of the law. Additionally, non-European data controllers and processors* 1\par
? Penalties: One of the most important modifications that were introduced by the GDPR is imposing penalties for the violators; the penalty could reach a maximum of 4\% of annual revenue or 20 million euro (whatever is greater), which is the maximum penalty imposed for the strong violations. The penalties system created by the GDPR follows a tiered approach to fines, according to the type of violation. (Article 83) who process or store European citizens' data are obliged to nominate a representative of the EU, as per Article 3-3 (Official Journal of the European Union: 32,33).\par
? Consent: The consent of users is firmly regulated in the GDPR, so that the wording of the terms of the agreement should be readable and easily written. Also, the reason for processing data should be clearly stated as well. Most importantly, according to the GDPR, users should have the right to withdraw their consents whenever they want. (Article 7) ? Breach notification: The GDPR considers breach notification, within a maximum of 72 hours of finding out 'without undue delay', as a compulsory activity that should be carried out in response to witnessing data breaches, as it endangers users' data integrity and security. (Articles 33,34)\par
On a side note, it is worth mentioning that the GDPR regulates personal data in the EU. Meanwhile, there is the Regulation on the Free Flow of Non-Personal Data that regulates non-personal data in the European Union. Both of the regulations are being applied side by side to create a unified digital single market. 
\section[{b) The United States Model}]{b) The United States Model}\par
The Snowden revelations showed an unstable relationship between IT giant companies and the American security apparatus, based on imposed obligations on IT giant tech companies to reveal users' data so long as data centers are located on the American lands or processed by American companies located outside American territories. This activity is done by means of judicial approval by relevant courts.\par
These acts led many countries to consider the American companies as untrusted and that their citizens' data are unsafe in their hands. Several counterreactions have been taken by countries, as will be clear later in the paper. Additionally, disputes were raised between giant tech companies and the American security apparatus, as companies were trying to find ways out of the diminishing trust they are suffering from, creating pressure on American authorities to amend the laws in this regard. Some tech companies, such as Microsoft, sued American authorities for obligations to reveal users' data in Ireland. Also, following the Snowden revelations scandal, IBM started investing billions of dollars for building more than 15 data centers around the world. \hyperref[b4]{[5]} No doubt that the American data protection laws are considered loose in comparison to the EU GDPR. In fact; as it is the case with many areas, there is no one common law that all states should be following, but several laws and acts on the federal level, in addition Data Protection Laws Trends: Practice and Debate *It is worth mentioning that the cloud computing environment allows third parties to work with the data, so the data controller may be the same as the data processor and may be a third party. For more information about the cloud computing environment, please revise previous research published by the author. not compulsory to EU countries, but more of a nonbinding framework. This situation witnessed change with the GDPR, which is binding and compulsory to all EU countries. The GDPR is not only compulsory to European countries but to all other companies and institutions in whatever place, so long as they deal with European citizens' data. The following summarizes main rights guaranteed to European citizens through the GDPR: \hyperref[b2]{[3]}, \hyperref[b3]{[4]} ? Right to access: The GDPR guarantees the right of the users to get a confirmation from the data controller if their data is being processed or not, and for what reasons. This is in addition to guaranteeing users' rights to get an electronic version of their personal data at the data controller, without any expenses, which is considered a new form of empowering users and securing data. ? Right to be forgotten/Data erasure: The GDPR guarantees the right of users to force the data controller to erase their personal data and to stop collecting more data about them whenever the purpose of collecting data comes to an end, whenever the users withdraw the consent they gave in before collecting their personal data and processing it. to regulations of states pertaining to data protection of citizens inside those states. Some states are considered stricter than others with firm regulations in data protection, such as Massachusetts, which has strong legislation requiring each institution collecting data to provide a detailed plan of securing data. New York has also passed cybersecurity legislation that imposes a minimum requirement of security level. California is also one of the states known for protecting privacy throughout its history. The California Consumer Act has been recently passed and was put in action in 2020. The Act imposes new obligations on companies related to data protection, such as personal data tiering, clarifying how the data will be used, as well as putting restrictions on sharing personal data. The Act involves data subjects' rights such as the right to access data, the right to be forgotten and the right to refuse to share data with a third party. \hyperref[b5]{[6]} To sum up, in the United States of America, there is no one independent entity responsible for protecting data, and there is no one framework for data protection to resort to as well. This has resulted in a loose data protection environment in the USA, which completely contradicts with the strict data protection environment in the European Union. To close this gap between the USA and the EU, the European Union has regulated protecting European data when transferred, processed or stored in the USA in a separate way, through the Safe Harbor Agreement that was in effect in 2000. However, the EU Court of Justice declared the Safe Harbor Agreement obsolete in October 2015, in the wake of the Snowden revelations and the Max Schrems case (the Austrian activist who sued Facebook for disclosing European data to the US security apparatus). These incidents proved the Safe Harbor was not capable of protecting the European data and was therefore replaced by a new law, which is the EU-US Privacy Shield Law in July 2016, to guarantee the maximum data protection for European data.\par
The main difference between both laws lies in the mechanisms of European data transfer to the USA and the related rights and obligations. Main differences can be outlined as follows: \hyperref[b6]{[7]}, \hyperref[b7]{[8]},  {\ref [} It is becoming a matter of fact that the great development in new technologies is imposing threats on national security, and especially with the data revelations cases and incidents. Countries resorted to several ways to protect their data. One of the widest spread techniques is the data and infrastructure localization. Data localization implies passing laws and regulations that confine storing and processing data inside a specific land or geography, or allowing some specific companies to store and process data. \hyperref[b0]{[1]} Even though the European model is considered one form of data localization, the author prefers to consider the data localization as a separate trend; because it contains several versions and iterations. And despite the fact that the EU GDPR is part of the data localization model, the author believes that the GDPR can be considered as a separate trend given the fact that it is the most looked-upon model and many countries around the world drafted their data protection laws after the GDPR model.\par
Data localization comes in different degrees and forms. Data localization trends can be classified according to the following criteria: \hyperref[b9]{[10]} i. Scope of Application Some countries impose a clear data localization policy, including all data of the nation, with a 'general scope of application' such as the EU, Russia \hyperref[b10]{[11]}, \hyperref[b11]{[12]}, \hyperref[b12]{[13]}, \hyperref[b13]{[14]} and some Latin American countries, that impose data localization obligations on all citizens data (i.e. all data should be stored and processed inside the borders of the country). Other countries applied data localization on data of specific sectors that would harm national security, such as the United States that requires storing sensitive data inside its territories, as well as Canada \hyperref[b14]{[15]}. This last case is closely attributed to the data tiering mechanism that some countries, such as the United Kingdom and the UAE, resort to in order to mitigate the level of data localization; so that data that are classified as highly sensitive would be localized, while data categorized as less sensitive would move  Kingdom and the UAE impose data localization obligations on health data, for example, as they classify it as highly sensitive data. Other data and infrastructure localization regulations impose obligations on the importing of IT equipment and require them to be locally produced. 
\section[{ii. Level of restrictiveness}]{ii. Level of restrictiveness}\par
Countries are classified according to the restrictiveness they impose on the transfer of data to several categories, from the strictest to less strict. Studies differ in the number of categories; some classify them into three categories \hyperref[b15]{[16]}, while others classify countries on a continuum of 5 categories \hyperref[b17]{[17]}. Despite the difference in the number of categories, the core is very similar. The paper adopts the \hyperref[b4]{5}  
\section[{A light-touch approach implies that all data, including personal data, can generally flow freely across borders with minimal regulatory requirements (if any). The USA is the prominent advocate of this approach.}]{A light-touch approach implies that all data, including personal data, can generally flow freely across borders with minimal regulatory requirements (if any). The USA is the prominent advocate of this approach.}\par
A prescriptive regulatory approach entails that cross-border data flows are subject to rigorous compliance requirements. The prescriptive approach falls in the middle of the regulatory spectrum, and typically comprises conditional transfer requirements. The EU is the prominent advocate of this approach. A restrictive regulatory approach means a complete or partial ban on cross-border data flows for reasons of national security and establishing political control over the domestic Internet. A guarded approach focuses on regulatory measures directed towards economic gains and considerations. Both the restrictive and guarded approaches tend to focus primarily on localization regulations, although their predominant policy rationales are quite different.\par
In a data-driven world, where technological products and applications produce huge amounts of data, and with the increasing incidents of data revelations, especially from the side of giant tech companies dominated by the USA, countries are held in a tight position trying not to lose neither the economic benefits and power of new technologies and data-driven economy, nor their sovereignty and control over their people and resources. Countries are being overwhelmed by manifestations of neocolonialism in the technological world. From here, countries resorted to data protection laws and data localization obligations in a way to keep their control over their data and resources. Reasons behind data localization stipulations are fear of dependence, fear of losing control and sovereignty as well as technical concerns emanating from the security breaches, especially when breaches occur outside the territory \hyperref[b0]{[1]}. One of the strong reasons is the absence of a strong international framework, augmented by frequent breaches scandals from U.S. giant tech companies.\par
However, data localization laws and regulations led to a wide debate, skewed towards the idea that data localization is an undesirable trend, leading to negative impacts on the global economy and the development of the Internet. On the one hand, the advocates of the trend believe that through confining storing and processing data within the country borders, nations will be able to protect their data from spying and disclosure and would thereby protect their national security. \hyperref[b4]{[5]} On the other hand, proponents of this trend believe that these laws usually fail to meet the announced goal and gradually turn to governments spying on their citizens, which impacts democracy and transparency. Most importantly, proponents argue that these kinds of laws negatively impact the growth of the global economy, impede the growth of other technologies that are based on the free flow of data (such as IoT \hyperref[b18]{[18]}, AI and Big Data), as well as threatening the development of Internet and relevant applications. Proponents are afraid that the prevalence of such laws may lead to fragmenting the global Internet infrastructure, which would be a major retreat in the development of the Internet society. \hyperref[b19]{[19]} In this regard, Internet Society has recently developed some critical principles upon which the foundations of Internet freedom were based. Internet Society provides training in different countries to support the idea that data localization laws hit the critical principles of the freedom on Internet; precisely Critical Property 1 -An open and accessible infrastructure with a common protocol, Critical Property 3 -Decentralized management and a common distributed routing system and Critical Property 5 -A Technology Neutral, General-Purpose network. \hyperref[b20]{[20]} IV. 
\section[{Where to Stand}]{Where to Stand}\par
Given this hot debate, and the wide diversity of data protection trends worldwide, studies developed some guidelines that can work as assessment criteria for countries to assess where to stand in this wide diversity in practice and controversial debates. The paper presents two frameworks for assessing data protection regulations, fulfilling both contradicting views about data localization; protecting national security and allowing for freedom of the Internet, and allowing for assessing the country's specific particularity and III. interests as well. Countries are supposed to make the most suitable mix and match from all variables, according to each one's interests, views and strategies. 
\section[{Debate about the Trends}]{Debate about the Trends}\par
The first is a group of elements to be assessed regarding data protection stipulations to ensure de jure privacy control and national security. Countries are expected to draft strong data protection regulations so that the following benchmarks apply: \hyperref[b21]{[21]} ? Severity of requirements in the law that ensure i) Control: individuals have control over their data. ii) Safety: Personal data is safe in the hands of the organizations.\par
? Severity of compliance mechanisms that ensure i) Enforcement: mechanisms that increase the likelihood of detection ii) Sanctions: strong penalties that deter violations On the other hand, countries can assess to what extent will data localization benefit the economy through an assessment framework for different localization options. The assessment tool uses scored methodology and takes into consideration several factors for each localization alternative to finally reach a total score for each alternative so as to help the decision-making process \hyperref[b22]{[22]}. Put simply and concisely, the model measures the impact of data localization alternatives on economic growth and data access, through the following sub-factors: ii) Speed of access: Since speedy access to personal data is very crucial in crime investigations, speed of access is important in this analysis, since delays can drastically reduce the likelihood of success.\par
IV. 
\section[{Conclusion}]{Conclusion}\par
Data protection regulations and data localization trends are some of the most debatable issues in the international arena. The twinning between data protection in the current technological environment and national security is on top of most countries' agendas. The paper presented a mapping of the worldwide trends in data protection, presented the two points of view in this regard, and tried at the end to provide some kind of guidelines for countries to assess the best-suited alternative of data protection. As shown, choosing the optimum level of data security is a tough task, requiring achieving an accurate balance between economic and political considerations to achieve security without harming the economy.   \begin{figure}[htbp]
\noindent\textbf{} \par 
\begin{longtable}{P{0.85\textwidth}}
? The third-party who gets the data transferred to or\\
works with processing European data is totally\\
responsible for data and should undergo the same\\
whole process of accreditation, just as the original\\
party.\\
c) Data Localization Model\\
9]\\
? Increasing the European citizens' rights; the Privacy\\
Shield provides several ways for EU citizens to file\\
complaints and cases about violations of data\\
protection. The Privacy Shield Panel could be a\\
second resort to file complaints and cases if nothing\\
was reached using the traditional ways.\end{longtable} \par
  {\small\itshape [Note: ? Intensifying the rigidity of requirements from American companies to be approved to work with EU data; where companies should get approvals, on individual company basis, to work with EU data according to a list of specifications evaluated by a specific panel. According to the Privacy Shield, Data Protection Laws Trends: Practice and Debate]} 
\caption{\label{tab_0}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{P{0.2231947483588621\textwidth}P{0.04463894967177243\textwidth}P{0.21389496717724285\textwidth}P{0.20087527352297593\textwidth}P{0.1673960612691466\textwidth}}
\tabcellsep \tabcellsep \tabcellsep Conditional\tabcellsep \\
Strict data\tabcellsep Partial data\tabcellsep Conditional transfer:\tabcellsep transfer:\tabcellsep Free flow of\\
localization\tabcellsep localization\tabcellsep Hard\tabcellsep Intermediate/\tabcellsep data\\
\tabcellsep \tabcellsep \tabcellsep soft\tabcellsep \\
\multicolumn{2}{l}{Restrictive /Guarded approach}\tabcellsep \multicolumn{2}{l}{Prescriptive approach}\tabcellsep Light-touch approach\\
\multicolumn{2}{l}{China}\tabcellsep Algeria\tabcellsep Azerbaijan\tabcellsep Australia\\
India\tabcellsep \tabcellsep Argentina\tabcellsep Bahrain\tabcellsep Canada\\
\multicolumn{2}{l}{Indonesia}\tabcellsep Armenia\tabcellsep Belarus\tabcellsep Mexico\\
\multicolumn{2}{l}{Kazakhstan}\tabcellsep Brazil\tabcellsep Ghana\tabcellsep Philippines\\
\multicolumn{2}{l}{Nigeria}\tabcellsep Colombia\tabcellsep Japan\tabcellsep Singapore\\
\multicolumn{2}{l}{Pakistan}\tabcellsep Cote D'Ivoire\tabcellsep Kyrgystan\tabcellsep United States\\
\multicolumn{2}{l}{Russian Federation}\tabcellsep Egypt\tabcellsep New Zealand\tabcellsep \\
\multicolumn{2}{l}{Rwanda}\tabcellsep European Union\tabcellsep Republic of Korea\tabcellsep \end{longtable} \par
 
\caption{\label{tab_1}Table 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{} \par 
\begin{longtable}{P{0.85\textwidth}}
? Economic growth i) Demand for goods and services: Assessing if building the infrastructure for local storage would create additional demand for goods and services (such as building data centers and the related components) which would consequently lead to creating direct and indirect job opportunities and therefore boost economic growth. However; demand could be affected by the value of imported equipment required for data centers. The overall impact on economic growth would depend on whether the demand would be met through domestic goods or through importing. Weighing those variables would give insights to decision makers about the best option of data protection regulations. ii) Competitive advantage of national firms vs. multinational firms: Countries should assess the costs of data localization from several perspectives. Mandating data localization would require more capital expenditure as a result of the costs of data storage and processing capabilities. Operational expenditure would also increase as a result of the costs of renting or operating data-related infrastructure. ? Data access i)\end{longtable} \par
 
\caption{\label{tab_3}}\end{figure}
 			\footnote{Data Protection Laws Trends: Practice and Debate} 		 		\backmatter   			 
\subsection[{Acknowledgements}]{Acknowledgements}\par
This paper and the research behind it would not have been possible without the valuable contributions and support of my dad and supervisor, Dr. Nabil Abd Al Ghaffar, PhD in Political Science (Faculty of Economics and Political Science -Cairo University). In the loving memory of my beloved dad who contributed greatly in preparing the original text from which this paper is extracted. 			  			  				\begin{bibitemlist}{1}
\bibitem[/679 Of The European Parliament and of The Council on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of such Data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union (2016)]{b3}\label{b3} 	 		‘/679 Of The European Parliament and of The Council on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of such Data, and repealing Directive 95/46/EC (General Data Protection Regulation)’.  		 \url{https://gdpr-info.eu/}  	 	 		\textit{Official Journal of the European Union}  		2016. 27 April 2016. p. .  	 
\bibitem[Lovells ()]{b11}\label{b11} 	 		\textit{Asia-Pacific Data Protection and Cyber Security Guide},  		 			Hogan Lovells 		.  		 \url{https://www.hoganlovells.com/\textasciitilde /media/hogan-lovells/pdf/2018/ab-data-protection-and-cybersecurity.pdf}  		2018.  	 
\bibitem[Chander et al. ()]{b14}\label{b14} 	 		‘Breaking the Web: Data Localization vs. the Global Internet’.  		 			Anupam Chander 		,  		 			P Uyen 		,  		 			Le 		.  		 \url{http://ssrn.com/abstract=2407858}  	 	 		\textit{UC Davis Legal Studies Research Paper Series}  		2014.  (378) .  	 
\bibitem[COMPARISON Safe Harbor Vs. The EU-US Privacy Shield OTAVA ()]{b7}\label{b7} 	 		‘COMPARISON Safe Harbor Vs. The EU-US Privacy Shield’.  		 \url{https://www.otava.com/reference/how-does-safe-harbor-compare-to-the-eu-us-privacy-shield/}  	 	 		\textit{OTAVA}  		2019.  	 
\bibitem[Cross-border data flows: The impact of data localization on IoT GSMA ()]{b18}\label{b18} 	 		‘Cross-border data flows: The impact of data localization on IoT’.  	 	 		\textit{GSMA}  		2021.  	 	 (cross\textunderscore border\textunderscore data\textunderscore  flows\textunderscore the\textunderscore impact\textunderscore of\textunderscore data\textunderscore localisation\textunderscore on\textunderscore IoT\textunderscore Full\textunderscore  Report.pdf (gsma.com) 
\bibitem[Terpan ()]{b6}\label{b6} 	 		‘EU-US Data Transfer from Safe Harbour to Privacy Shield: Back to Square One?’.  		 			Fabien Terpan 		.  		 \url{http://www.europeanpapers.eu/en/e-journal/eu-us-data-transfer-safe-harbour-privacy-shield}  	 	 		\textit{European Papers}  		2018. 2018. 3 p. .  	 
\bibitem[Al Ghaffar et al. ()]{b0}\label{b0} 	 		\textit{Government Cloud Computing and National Security. Review of Economics and Political Science, ahead of print},  		 			Abd Al Ghaffar 		,  		 			-T-Allah Hedaia 		,  		 			Nabil 		.  		 \xref{http://dx.doi.org/10.1108/REPS-09-2019-0125}{10.1108/REPS-09-2019-0125}.  		2020.  	 
\bibitem[Burman and Sharma ()]{b22}\label{b22} 	 		\textit{How would data localization benefit India?},  		 			Anirudh Burman 		,  		 			Upasana Sharma 		.  		 \url{https://carnegieindia.org/2021/04/14/how-wo}  		2021. Carnegie India.  	 
\bibitem[Savvas ()]{b13}\label{b13} 	 		\textit{Internet Iron Curtain Comes Down Across Mother Russia},  		 			Antony Savvas 		.  		 \url{https://data-economy.com/internet-iron-curtain-comes-down-across-mother-russia/}  		2019.  	 
\bibitem[Internet way of networking use case: Data localization Internet Society ()]{b20}\label{b20} 	 		‘Internet way of networking use case: Data localization’.  		 \url{https://www.internetsociety.org/wp-content/uploads/2020/09/IWN-Use-Case-Data-Localization-EN.pdf}  	 	 		\textit{Internet Society}  		2020.  	 
\bibitem[Eu Gdpr and Org]{b2}\label{b2} 	 		\textit{Key Changes with the General Data Protection Regulation},  		 			Eu Gdpr 		,  		 			Org 		.  		 \url{https://eugdpr.org/the-regulation/}  		 	 
\bibitem[Fti Consulting ()]{b10}\label{b10} 	 		\textit{Localization to Fragment Data Flows in Asia},  		 			Fti Consulting 		.  		 \url{https://www.fticonsulting-asia.com/insights/articles/localization-to-fragment-data-flows-in-asia}  		2017.  	 
\bibitem[Privacy Shield website ()]{b8}\label{b8} 	 		 \url{https://www.privacyshield.gov/Program-Overview}  		\textit{Privacy Shield website},  				2019.  	 
\bibitem[Nieuwesteeg ()]{b21}\label{b21} 	 		‘Quantifying Key Characteristics of 71 Data Protection Laws’.  		 			Bernold Nieuwesteeg 		.  		 \url{https://www.jipitec.eu/issues/jipitec-7-3-2016/4510/nieuwesteeg\textunderscore quantifying\%20key\textunderscore characteristics\textunderscore of\textunderscore 71\textunderscore data\textunderscore protection\textunderscore laws\textunderscore jiptec\textunderscore 7\textunderscore 3\textunderscore 2016\textunderscore 182.pdf}  	 	 		\textit{Journal of Intellectual Property, Information Technology and Electronic Commerce Law}  		2016. 2016. 7 p. .  	 
\bibitem[Sauvelyev ()]{b12}\label{b12} 	 		‘Russian's New Personal Data Localization Regulations: A Step Forward or a Self-Imposed Sanction?’.  		 			Alexander Sauvelyev 		.  		 \url{https://www.sciencedirect.com/science/article/pii/S0267364915001685}  	 	 		\textit{Computer, Law and Security Review}  		2016. 32 p. .  	 
\bibitem[School]{b16}\label{b16} 	 		 			Harvard Kennedy School 		.  		 \url{https://www.belfercenter.org/publication/sovereignty-and-data-localization}  		\textit{\#:\textasciitilde :text=Data\%20localization\%20is\%20 used\%20to\%20assert\%20data\%20sovereignty\&text =Generally\%2C\%20governments\%20want\%20to\%2 0claim,by\%20whom\%20it\%20is\%20stored.\&text=It \%20is\%20generally\%20a\%20policy},  				20 p. .  	 
\bibitem[Ferracane ()]{b17}\label{b17} 	 		‘South Africa and Data Flows: How to Fully Exploit the Potential of the Digital Economy’.  		 			Martina F Ferracane 		.  		 \url{https://www.gegafrica.org/publications/92-south-africa-and-data-flows-how-to-fully-exploit-the-potential-of-the-digital-economy}  	 	 		\textit{Global Economic Governance Africa, Discussion Paper}  		2018.  	 
\bibitem[Wu ()]{b15}\label{b15} 	 		‘Sovereignty and data localization’.  		 			Emily Wu 		.  	 	 		\textit{Belfer Centre for Science and International Affairs}  		2021.  	 
\bibitem[Hill and Force ()]{b4}\label{b4} 	 		‘The Growth of Data Localization Post-Snowden: Analysis and Recommendations For U.S. Policymakers and Industry Leaders’.  		 			Jonah Hill 		,  		 			Force 		.  		 \url{https://papers.ssrn.com/sol3/papers.cfm?abstract\textunderscore id=2430275}  	 	 		\textit{Lawfare Research Paper Series}  		2014. 2  (3)  p. .  	 
\bibitem[Unctad ()]{b9}\label{b9} 	 		 			Unctad 		.  		 \url{https://unctad.org/system/files/official-document/der2021\textunderscore en.pdf}  	 	 		\textit{Cross-border data flows and development: For whom the data flow},  				2021. 2021.  	 
\bibitem[Understanding Data Localization Laws Big Bang]{b19}\label{b19} 	 		‘Understanding Data Localization Laws’.  		 \url{https://www.bigbangerp.com/blog/data-localization-laws/}  	 	 		\textit{Big Bang},  				 	 
\bibitem[Chabinsky and Pittman ()]{b5}\label{b5} 	 		\textit{USA: Data Protection},  		 			Steven Chabinsky 		,  		 			F Paul Pittman 		.  		 \url{https://iclg.com/practice-areas/data-protection-laws-and-regulations/usa}  		2019. 2019.  	 
\bibitem[Lord ()]{b1}\label{b1} 	 		\textit{What is the Data Protection Directive? The Predecessor to the GDPR},  		 			Nate Lord 		.  		 \url{https://digitalguardian.com/blog/what-data-protection-directive-predecessor-gdpr}  		2018.  	 	 (Digital Guardian, available at) 
\end{bibitemlist}
 			 		 	 
\end{document}
