Context:  Commerce & Industry Minister Meets Industry Stakeholders on E-Commerce & Data Localization.

Common issues for discussion include opportunities for India in the growing digital economy, value addition in Indian GDP due to advent of e-commerce, understanding data flows from four aspects – privacy, security, safety and free choice, ownership and sharing of data, gains and costs of cross border flow of data and means to monitor use of data.

What does Data Localization mean?

Data localization is the act of storing data on any device that is physically present within the borders of a specific country where the data was generated.

Why data localization is necessary for India?

• For securing citizen’s data, data privacy, data sovereignty, national security, and economic development of the country.
• Recommendations by the RBI, the committee of experts led by Justice BN Srikrishna, the draft ecommerce policy and the draft report of the cloud policy panel show signs of data localisation.
• The extensive data collection by technology companies, has allowed them to process and monetize Indian users’ data outside the country. Therefore, to curtail the perils of unregulated and arbitrary use of personal data, data localization is necessary.
• Digital technologies like machine learning (ML), artificial intelligence (AI) and Internet of Things (IoT) can generate tremendous value out of various data. It can turn disastrous if not contained within certain boundaries.
• With the advent of cloud computing, Indian users’ data is outside the country’s boundaries, leading to a conflict of jurisdiction in case of any dispute.
• Data localization is an opportunity for Indian technology companies to evolve an outlook from services to products. International companies will also be looking at the Indian market, and this will benefit the growth of the local ecosystem.
• More data centres in India could mean new, power-hungry customers for India’s renewable energy market. That means Data localisation could boost India’s renewable energy.

Policies that imply data localization:

1. The Srikrishna Committeewants to localise data for law enforcement to have easy access to data, to prevent foreign surveillance, to build an artificial intelligence ecosystem in India, and because undersea cables through which data transfers take place are vulnerable to attacks.
2. In April, the Reserve Bank of India imposed a hard data localisation mandate on payment systems providers to store payment systems data only in India.
3. Barring limited exceptions, telecom service providers are not allowed to transfer user information and accounting information outside India.
4. Goals set in the Draft National Digital Communications Policy 2018, and the Guidelines for Government Departments for Contractual Terms related to Cloud Storage 2017, draft e-commerce policy and the draft report of the cloud policy panel show signs of data localization.

Concerns / Challenges:

• Several of the recommendations in including the draft e-commerce policy, falter on a key ground like they gloss over the negative economic impact of data localization. This approach exhibits lack of evidence-based policy making.
• Having data in India does not mean that domestic companies will be able to access this data. Localization might aid the growth of the data centre and the cloud computing industry in India, but as matter of wider public policy, such an approach is extremely myopic.
• Mandating localization is less of a solution for data protection and might be less relevant to promote e-commerce.
• Given the comparative trade advantages enjoyed by one section of Indian industry in this context, mandating a strict data localization regime could be perceived as a restrictive trade barrier and spur retaliatory measures.
• There is a possible rise in prices of foreign cloud computing services in case of a data localisation, and its impact on MSMEs as well as start-ups relying on these services.
• The possibility of triggering a vicious cycle of data localisation requirements by other countries as a response to India’s possible data localisation will be detrimental for the global data economy.
• Growth will be restricted if data cannot be aggregated internationally. Infrastructure in India for efficient data collection and management is lacking.

Need of the hour:

• There is an urgent need to have an integrated, long-term strategy for policy creation for data localisation.
• Data localisation needs to integrate a wide range of social, political and economic perspectives.
• Creating an opportunity for local data centres all over the country.
• Devising an optimal regulatory and legislative framework for data processors and data centres operating in the country.
• Adequate infrastructure in terms of energy, real estate, and internet connectivity also needs to be made available for India to become a global hub for data centres.
• Adequate attention needs to be given to the interests of India’s Information Technology Enabled Services (ITeS) and Business Process Outsourcing (BPO) industries, which are thriving on cross border data flow.