What is India’s stand on data storage?

Editorial Analysis:

Larger Background:
  • Facebook’s Mark Zuckerberg recently expressed apprehension about nations wanting to store data locally.
  • According to him, it gave rise to possibilities where authoritarian governments would have access to data for possible misuse.
  • In an earnings call with investors in late April 2019, he reiterated his stance against data localisation, without mentioning a country.
  • Earlier that month, the U.S. criticised India’s proposed norms on data localisation as ‘most discriminatory’ and ‘trade-distortive’.
  • It is important to note that India is at a juncture where various bills are ready to be signed into law that will set data localisation and protection regulations in stone.
What is data localisation?
  • Data localisation laws refer to regulations that dictate how data on a nation’s citizens is collected, processed and stored inside the country.
Does it matter where data resides?
  • Among reasons supporting data localisation put out by the Justice Srikrishna Committee report last year (2018), a few key ones are:
  • Data localisation is critical for law enforcement.
  • Access to data by Indian law agencies, in case of a breach or threat, cannot be dependent on the whims and fancies, nor on lengthy legal processes of another nation that hosts data generated in India.
  • If data generated in India is stored in the U.S., for example, it is dependent on technology and channels such as the undersea fibre optic cable network.
  • Such reliance can be debilitating in the case of a tech or physical breakdown.
  • The report recommends that hence, at least a copy of the data must be stored in India.
  • It is important to note that technology playfields are not even. A developing country such as India may be playing catch-up with a developed nation, which may be willing to offer liberal laws.
  • It may not be wise for India to have the liberal rules as other nations would.
  • A key observation of the report is that it is ideal to have the data stored only locally, without even having a copy abroad, in order to protect Indian data from foreign surveillance.
Does India have rules in place for data protection?
  • Currently, the only mandatory rule on data localisation in India is by the Reserve Bank of India for payment systems.
  • Other than this, there are only reports or drafts of bills that are yet to be signed into law.
  • Among material available in the public domain on data localisation is the white paper that preceded the Jusitce Srikrishna Committee report, inviting public comments.
  • The second piece is the Draft Personal Data Protection Bill, 2018 itself which has specific requirements on cross-border data transfers. This is seen as being more restrictive than the recommendations of the Srikrishna Committee.
  • The draft e-commerce policy also has clauses on cross-border data transfer. For example, it suggests that if a global entity’s India subsidiary transfers Indian users’ data to its parent, the same cannot be transferred to a third party even with the user’s consent.
Shouldn’t the level of protection vary according to the nature of data?
  • The Justice Srikrishna Committee report has made a point about not treating all data alike.
  • The data protection bill too differentiates between ‘critical’ and other data.
Why are companies reluctant to comply?
  • The disadvantage for a company compelled to localise data is obvious — costs, in the form of servers, the UPS, generators, cooling costs, building and personnel.
  • Companies feel that infrastructure in India is not yet ready to support this kind of ecosystem.
  • For any large e-commerce player in India, costs may go up between 10% and 50% depending on how stringently the final law is worded.
  • The big daddies of e-commerce and social media may not find it too difficult to comply.
  • However, small companies providing services in India will find compliance tough.
  • In fact, one of the objectives of data localisation is to give a fillip to the start-up sector in India, but stringent norms can make it costly for small firms to comply thereby defeating this objective.
  • While this places small entities in a difficult position, the spirit of the Justice Srikrishna Committee report seems to imply that this is not reason enough to avoid compliance.
  • While granting that the data protection bill comes after a lot of homework, observers feel it is still not comparable to the EU General Data Protection Regulation (GDPR), which took a few years to draft, adding scholarly and academic depth to the consultations, inputs and the final wording of the law.
Experience from other countries:
  • It is well known that Canada and Australia protect their health data very carefully.
  • Vietnam mandates one copy of data to be stored locally and for any company that collects user data to have a local office, unlike the EU’s GDPR; citing national interests, China mandates strict data localisation in servers within its borders.
  • International reports refer to data protection laws in Vietnam and China as being similar, in that they were made not so much to protect individual rights as to allow government to control data.
  • For the EU, it is clear that customer is ‘king’.
  • Their GDPR is agnostic to technology and sector. Interestingly, the U.S. has no single data protection law at the Federal level. It does, however, have individual laws such as the HIPAA (Health Insurance Portability and Accountability Act of 1996) for health care, another for payments, and the like. Brazil, Japan, Korea and New Zealand have put in place data protection laws.
  • Chile has recently announced the setting up of an independent data protection authority, while Argentina is currently reforming its privacy legislation.
How has India’s policy on data localisation been received globally?
  • In September 2018, the EU had said in its response to India’s data protection draft bill that “data localisation requirements appear both unnecessary and potentially harmful as they would create unnecessary costs, difficulties and uncertainties that could hamper business and investments”.
  • It added that if implemented, “this kind of provision would also likely hinder data transfers and complicate the facilitation of commercial exchanges, including in the context of EU-India bilateral negotiations on a possible free trade agreement”.
  • For companies from one country doing business in another, it becomes cumbersome to have two different compliance levels.

Comments

Post a Comment

Popular posts from this blog

Space Programmes: Spin-offs for Humanity

Image
Space Programmes: Spin-offs for Humanity Though the Indian space program started nearly 20 years later than in developed countries, today it has emerged as one among six nations i.e. USA, Russia, Europa, China and Japan having total indigenous capability in building satellites for earth observation communication and scientific research as well as launch them into orbits around Earth and even taken them to Moon or Mars. Indian launch vehicles like PSLV, GSLV have proven track record and cost-effectiveness such that even developed countries are approaching ISRO for launching their satellites. What should be the focus for future space programmes? Important developments related to the human space flight are the Crew module, life support system, Crew escape system and improvement in the overall reliability of the launch vehicle. Once in orbit, the capsule will be in almost zero G condition and hard vacuum and will be subjected to heavy radiation. Creating living conditions inside
Read more

UPSC Final Results of 2018 are out: Kanishka Kataria , from IIT Bombay tops the list.

Image
Kanishka Kataria Rank-1 , Kanishak Kataria, a B. Tech graduate from IIT Bombay has topped the civil services final exam, the UPSC announced on Friday as it declared the results. Mr Kataria, who belongs to the SC Category, qualified the examination with Mathematics as his optional subject, Union Public Service Commission or UPSC said. Srushti Jayant Deshmukh is topper among women. She secured the fifth rank overall. Ms Deshmukh has graduated with B.E.(Chemical Engineering) from Rajiv Gandhi Proudyogiki Vishwavidyalaya, Bhopal, a press release said. Of the top 25 candidates, 15 are men and 10 are women . 759 candidates, comprising 577 men and 182 women, have been recommended for appointment to Indian Administrative Service, Indian Foreign Service, Indian Police Service and Central Services, Group 'A' and Group 'B'. The top 25 candidates have graduated in subjects like Engineering; Sciences; Economics; Law; Mathematics; History; Political Science; Publ
Read more

ISC Marking Scheme 2019 ISC Class 11, 12 Marks Distribution/Blueprint

ISC Chemistry Paper 1 (Theory) Blueprint For Class 11 (XI) S. No Unit Marks Distribution 1 Some Basic Concepts of Chemistry Physical Chemistry 32 Marks 2 Structure of Atom 3 Classification of Elements and Periodicity inProperties 4 Chemical Bonding and MolecularStructure 5 States of Matter: Gases and Liquids 6 Chemical Thermodynamics 7 Equilibrium 8 Redox Reactions  Inorganic Chemistry 15 marks 9 Hydrogen 10 s -Block Elements 11 Some p -Block Elements 12 Organic Chemistry: Some basic Principles and Techniques  Organic Chemistry 23 marks 13 Hydrocarbons 14 Environmental Chemistry Total 70 marks ISC Chemistry Paper 1 (Theory) Blueprint For Class 12 (XII) S. No Unit Marks Distribution 1 Solid State  Physical Chemistry 25 Marks 2 Solutions 3 Electrochemistry 4 Chemical Kinetics 5 Surface Chemistry 6 General Principles and Processes of Isolation of Elements Inorganic Chemistry 20 Marks 7 p -Block Elements 8 d -and f -Block Elements 9 Coordination Compounds
Read more