Introduction

• Earlier this week, companies around the world scrambled to try and meet a RBI-mandated deadline to store Indian users’ financial data in India, reigniting conversation about “data localisation”.
• Across ministries and sectors, the government has firmed up its stance on storing data of Indian users in the country, to the discontent of international players and the delight of domestic ones.

What is data localisation?

• Data localisation is a concept that the personal data of a country’s residents should be processed and stored in that country.
• Some directives may restrict flow entirely, while others more leniently allow for conditional data sharing or data mirroring – in which only a copy has to be stored in the country.
• As of now, much of cross-border data transfer is governed by individual bilateral “mutual legal assistance treaties” (MLATs).

What has happened now to bring this into focus?

• The recurring data localisation agenda has bubbled up in a number of government directives or drafts.
• In early April, the RBI issued a circular mandating that payment data be stored only in India by October 15.
• This covered everyone from Mastercard and Visa to WhatsApp Payments and PayTM.
• Currently, the RBI has not instituted any fines for those who have missed the deadline but is seeking schedules of pending data transfers to India.
• In late July, a data protection draft law by a committee headed by retired Justice B N Srikrishna recommended that all personal data of Indians have at least one copy in India.
• A subset of that data, labelled critical personal data, must be stored and processed only in India.
• A draft report of a cloud computing policy recommended localisation of Indians’ data.
• Cloud computing, a service offered by the likes of Amazon and Microsoft, allows customers’ data to be stored on remote data centres.

Who is for it?

Security agencies, domestic born technology companies like PayTM, Reliance Jio, etc. companies whose rivals are giants from US, etc. are supporting the data localisation.

Arguments in favor of data localisation

• A common argument of government officials is that localisation will help Indian law enforcement access data.
• The April RBI circular stated that “to ensure better monitoring, it is important to have unfettered supervisory access to data stored with these system providers”.
• When a spate of lynchings across the country was linked to WhatsApp rumours, WhatsApp’s firm stance on encrypted content frustrated government officials.
• In addition, proponents highlight security against foreign attacks and surveillance, which opponents consider a weak argument in cases of data mirroring.
• Concerns also rose when Facebook declared that its Cambridge Analytica controversy had affected Indian users as well.
• Tech companies especially condemn the large tax differences between international companies operating in India and those with a permanent establishment in the country.
• Many argue that localisation would lead to a larger presence in India overall, such as local offices, and increase tax liability.
• “Data is the new oil” also provides a backbone to much of the localisation drive.
• In the home of the largest open Internet market in the world, companies like PhonePe claim that national wealth creation relies on in-house data storage.
• The e-commerce policy took on a similar stance, championing domestic innovation, and the data protection report also mentioned harnessing India’s digital economy.

Who is against it?

Industry bodies, especially those with significant ties to the US, have slung heavy backlash.

Arguments against data localisation

• Many are concerned about a fractured Internet (or a “splinternet”), where the domino effect of protectionist policy will lead to other countries following suit.
• Much of this sentiment harkens to the values of a globalised, competitive internet marketplace, where costs and speeds, rather than nationalistic borders, determine information flows.
• Opponents say that this, in turn, may backfire on India’s own young start-ups that are attempting global growth, or on larger firms that process foreign data in India, such as Tata Consulting Services and Wipro.
• Critics not only caution against state misuse and surveillance of personal data, but also argue that security and government access is not achieved by localisation.
• Even if the data is stored in the country, the encryption keys may still remain out of the reach of national agencies.

What do other countries do?

• The think tank European Centre for International Political Economy has found a surge in data localisation measures worldwide over the last decade.
• Russia has the most restrictive regulation for data flow with strict localisation and high penalties.
• The European Union’s General Data Protection Regulation (GDPR) does not mandate all data to be localised, but rather restricts flow to countries with a strong data protection framework.
• The China government mandates localisation for all “important data” held by “critical information infrastructure” and any cross border personal data transfer must undergo a security assessment.
• The United States leaves regulation up to the state and sector. Earlier this year, President signed the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) which established data sharing with certain countries.

Conclusion

• The Indian data localisation wave is the latest digital battleground of ongoing power wars between government and industry.
• There is a need to strike a balance between national security, economic interests and individual rights.