Those interested in India’s economic future need to be careful about tying it down with yesterday’s restrictions.
India’s draft data protection bill released in July by the Justice B.N. Srikrishna committee is the most recent contribution to a sprawling debate over electronic data that has been going on in India and elsewhere for some years now.
While the Srikrishna committee report raises legitimate concerns about the protection of personal data, the suggested bill proposes a requirement for data localisation as a remedy – a directive that personal data about residents of India be stored, in some cases exclusively, in India. Other proposals in the past few years include an e-commerce policy that tiptoes up to the edge of localisation; a Cloud Working Group report that proposes localising any data generated in India; and payments rules promulgated by the Reserve Bank of India that would make it nearly impossible for residents of, or even visitors to, India to use credit cards.
This poses two problems: Localisation may not, in fact, protect privacy; and the various proposals under consideration could do great collateral damage to Indian businesses – small and large.
Breaches of data privacy are a legitimate concern. However, these have occurred in many different places. A localisation requirement, even if limited to personal data, would not by itself protect personal data against the kind of unauthorised access that has occurred in recent years.
Moreover, exclusive localisation requirements could make data more vulnerable to loss or damage. Any storage regimen has some vulnerability. Dispersing storage of data actually reduces this risk. People who have undergone equipment failures have found backups and diversified cloud storage essential in protecting themselves against catastrophic data loss.
Localisation requirements would also burden Indian business. It’s hard to overstate the game-changing quality of cloud computing for small and medium enterprises, which account for 45 per cent of India’s manufacturing output and 40 per cent of its manufacturing exports. This is currently an affordable resource even for relatively small companies. Making it more expensive – the inevitable result of required localisation – would put them at a disadvantage. For large businesses, the same logic holds – with the added point that engaging the international market is even more critical. If localisation becomes a local norm, India’s larger companies, like others, will be required to maintain multiple servers to sustain their international business.
India has been an economic growth powerhouse for much of the past 25 years. Free flows of data have contributed greatly to this prosperity. United Nations Conference on Trade and Development (UNCTAD) attributes 4.5 per cent of India’s GDP in 2015 to this factor. Raising the cost of data storage, and putting data into ‘silos’ so they can’t be handled together, won’t make this disappear, but it is bound to have an effect. And the effect could be especially serious for India’s innovation economy, which has a disproportionate reliance on cloud computing and has a global leadership position.
These burdens on Indian business would be much more severe if localisation requirements went beyond personal data. India needs to be concerned about unintended consequences. Would India’s rules require Indian companies to store all their data in India? What if they encountered requirements from other countries that localised data from the parent company’s overseas operations? And what about the reverse case: If a foreign investor is required to store all its data in India, how far does this requirement go, and does it extend to data concerning the investor’s headquarters and other international operations? None of these details have been thought through, and they are potentially very troublesome.
One argument that needs careful thought is that so far developed countries’ businesses have had ‘first mover advantage’ in establishing themselves in the data storage and processing field. It is understandable that Indians and their government would want to avoid being closed out, and data localisation requirements are seen as a tool in this regard. At the same time, it is important not to introduce unintended disincentives for the scientists and companies who might be incubating tomorrow’s technological changes. Those who are interested in India’s economic future need to be careful about tying it down with yesterday’s restrictions.
Ambassador Teresita C. Schaffer is a Senior Advisor with McLarty Associates. During her 30-year career in the US Foreign Service, she served in US embassies in India, Pakistan, and Bangladesh, and served as US Ambassador in Sri Lanka from 1992-1995. Ambassador Schaffer is also the co-author of India at the Global High Table: the Quest for Regional Primacy and Strategic Autonomy.