Data Localisation

In News 

• The global politics of data is rapidly evolving as leading and emerging digital economies like the European Union (EU), the U.S,India, Indonesia, and South Africa strive to protect, monetise, and leverage data collected within their territories for domestic purposes. 

Data localisation

• It means restricting the flow of data from one country to another. It means that the personal data of a country’s residents should be processed and stored in that country. 
• As of now, much of cross-border data transfer is governed by individual bilateral “mutual legal assistance treaties” (MLATs).

Need of Data localisation

• Accessibility: If it is stored outside India, access to this data will be restricted by local laws and Indian agencies will be dependent on the whims and fancies of the host-country governments for access. It gives local governments and regulators the jurisdiction to call for the data when required. 

• Privacy and security concern: It may also enable the better exercise of privacy rights by Indian citizens against any form of unauthorised access to data, including by foreign intelligence.
• Avoiding foreign surveillance: It aims to protect the personal and financial information of the country’s citizens and residents from foreign surveillance. In the case of data being stored in countries hostile to India, say China, it can become a tool for mass surveillance.
• Law enforcement benefits: This will be beneficial for law enforcement agencies in particular as they can scavenge it for proof in case of breach or threat. 
• Economic benefits: Increasing economic interests have compelled governments to institute rules that restrict cross-border flows with implications for negotiations on global trade and commerce. The economic benefits will accrue to local industry in terms of creating local infrastructure, employment and contributions to the AI ecosystem.

Issues 

• Foreign firms are unwilling to comply as it would require them to spend money  on compliance activities such as hiring data-protection officers or maintaining systems to get the government approvals to transfer data
• Barriers to the free flow of data may hurt businesses by increasing delays and higher costs of collaborative research or partnerships outside India. 
• Entities would need multiple separate processing centres if they serve consumers both within India and outside when a single centre would suffice.

Global Efforts 

• Indeed, the sheer amount of data being generated and shared globally has necessitated governments to exert more control over the use, sharing, and cross-border flow of data. 
• According to the Information Technology and Innovation Foundation (ITIF), data localisation laws have more than doubled from 2017 to 2021, indicating that states seek and want increasing levels of regulatory control over data.
• The US administration recently issued an executive order on promoting competition in the American economy that pushed for the use of antitrust policy to meet the challenges posed by the rise of dominant platforms, and surveillance.
•  European policymakers have introduced a bevy of digital rules that place individual users centre-stage, and enhancing their data security. 

•  The Chinese government mandates localisation for all “important data” held by “critical information infrastructure” and any cross border personal data transfer must undergo a security assessment.

India’s Efforts 

• Since 2017, India has attempted to incubate governance of non-personal data, personal data, e-commerce regulation and artificial intelligence (AI) with a preference to harness “India’s data for India’s development.” 

• These policies, including the recently withdrawn Personal Data Protection Bill, are works in progress but this does not take away from the vast ecosystem of actors — including experts, civil society, and industry actively engaging with and attempting to shape digital policy-making.

• In 2018, based on the recommendations of the Justice Srikrishna Committee, the Reserve Bank of India (RBI)  mandated companies to locally store and process sensitive data belonging to Indian users of various digital payment services. 

• Until then, most data from India was being stored on a cloud database outside the country

Conclusion and Way Forward 

• To underscore political rhetoric and drive global data discussions at the G20, the Indian government should present a holistic agenda that embeds data collection and sharing within a broader framework that prioritises digital security, innovation, and citizen rights.
• For instance, the Reserve Bank of India’s data localisation directive has been in place for four years now.
  •  An empirical assessment of how this has impacted both start-ups, big technology companies, and users could serve as a useful example.
•  India’s digital economy stewardship must transcend data localisation by highlighting best practices on data protection, competition law, data stewardship, and responsible artificial intelligence both in India and other G20 countries.
• The ongoing effort to redraft the Personal Data Protection Bill and embed it within a ‘more comprehensive framework’ that addresses related concerns like cybersecurity must serve as an urgent domestic priority, and could lend weight to India’s G20 data approach.