Mentor’s Comment
- Define data localisation.
- Give arguments supporting and opposing it. Issues at WTO.
- Suggest how laws can be formulated to secure all stakeholder’s interests.
Answer:
Data localization :-
Data localization is the new trend in the internet world where there is borderless flow of information. In recent years, countries are instructing companies to keep critical data about consumers to be stored and processed within their domestic territories. Laws asking entities to keep data about citizens were enforced by several jurisdictions including the EU. As per the EU’s General Data Protection Regulation (GDPR), important data are to the stored within the EU territory.
Importance of data localization for India :-
For securing citizen’s data, data privacy, data sovereignty, national security, and economic development of the country.
Recommendations by the RBI, the committee of experts led by Justice BN Srikrishna, the draft ecommerce policy and the draft report of the cloud policy panel show signs of data localisation.
The extensive data collection by technology companies, has allowed them to process and monetize Indian users’ data outside the country.
To curtail the perils of unregulated and arbitrary use of personal data.
Digital technologies like machine learning (ML), artificial intelligence (AI) and Internet of Things (IoT) can generate tremendous value out of various data.
It can turn disastrous if not contained within certain boundaries.
With the advent of cloud computing, Indian users’ data is outside the country’s boundaries, leading to a conflict of jurisdiction in case of any dispute.
Data localization is an opportunity for Indian technology companies to evolve an outlook from services to products.
International companies will also be looking at the Indian market, and this will benefit the growth of the local ecosystem.
More data centres in India could mean new, power-hungry customers for India’s renewable energy market. That means Data localisation could boost India’s renewable energy.
Policies that imply data localization :-
When enacted, India’s data protection law will not be the first to recommend data localisation. The Srikrishna Committee wants to localise data for law enforcement to have easy access to data, to prevent foreign surveillance, to build an artificial intelligence ecosystem in India, and because undersea cables through which data transfers take place are vulnerable to attacks
In April, the Reserve Bank of India imposed a hard data localisation mandate on payment systems providers to store payment systems data only in India.
Barring limited exceptions, telecom service providers are not allowed to transfer user information and accounting information outside India.
Goals set in the Draft National Digital Communications Policy 2018, and the Guidelines for Government Departments for Contractual Terms related to Cloud Storage 2017, draft e-commerce policy and the draft report of the cloud policy panel show signs of data localization.
Concerns / Challenges :-
Several of the recommendations in including the draft e-commerce policy, falter on a key ground like they gloss over the negative economic impact of data localization. This approach exhibits lack of evidence-based policy making.
Having data in India does not mean that domestic companies will be able to access this data. Localization might aid the growth of the data centre and the cloud computing industry in India, but as matter of wider public policy, such an approach is extremely myopic.
Mandating localization is less of a solution for data protection and might be less relevant to promote e-commerce.
The $167 billion Indian IT industry is export-driven and deals with data of citizens and companies in the US, the EU and other parts of the world. Given the comparative trade advantages enjoyed by one section of Indian industry in this context, mandating a strict data localization regime could be perceived as a restrictive trade barrier and spur retaliatory measures.
Data localisation increases cost for companies, especially MNCs.
Data localisation restrictions can negatively impact GDP of countries mandating it.
Such policies often reflect an authoritarian regime and are seen as a tool to enable local surveillance.
They also increase the cyber vulnerability and restrict access of SMEs to global services.
Data localisation laws often do not mandate a blanket localisation of data. Europe’s new data protection regime does not introduce localisation requirements but instead puts limits on cross-border data flows to countries that don’t have data protection laws.
The possible rise in prices of foreign cloud computing services in case of a data localisation, and its impact on MSMEs as well as start-ups relying on these services.
The possibility of triggering a vicious cycle of data localisation requirements by other countries as a response to India’s possible data localisation will be detrimental for the global data economy.
Growth will be restricted if data cannot be aggregated internationally.
Infrastructure in India for efficient data collection and management is lacking.
Way Forward
There is an urgent need to have an integrated, long-term strategy for policy creation for data localisation.
Data localisation needs to integrate a wide range of social, political and economic perspectives.
Creating an opportunity for local data centres all over the country.
Devising an optimal regulatory and legislative framework for data processors and data centres operating in the country.
Adequate infrastructure in terms of energy, real estate, and internet connectivity also needs to be made available for India to become a global hub for data centres.
Adequate attention needs to be given to the interests of India’s Information Technology Enabled Services (ITeS) and Business Process Outsourcing (BPO) industries, which are thriving on cross border data flow.
Data needs to be shared with start-ups so that they can have a level playing field in offering innovative services with large and often global data companies.
