India’s policy on data must focus on access, not physical location

To address strategic concerns, Narendra Modi government can create a whitelist of countries that can be trusted to store and process Indian data.

Representational image | Andrey Rudakov/Bloomberg

In recent times, India, Japan and the United States have found themselves on the same side of the table, more often than not. So, when India declined to participate in the Osaka Track, the Japanese prime minister’s favourite initiative at the G-20 summit last month, it was something of an aberration.

Shinzo Abe wants to create a group of countries that will allow free flow of data across international borders. India declined, taking the view that such a conversation ought to take place under the WTO.  The real stumbling block was the Indian government’s seriousness on data localisation.

Staying out of the Osaka Track was a prudent decision, but the Narendra Modi government’s presumption that data localisation is in the national interest requires a thorough reconsideration.

Very often, the way an issue is framed shapes people’s attitudes and government policies towards it. More so, if the framing is pithy and clever. Therefore, when the phrase “data is the new oil” gets tossed around social media, op-ed pages, board rooms, keynote speeches and international summits, it is normal to expect that people and governments will begin to guard data much like they would do oil wells. Facepalm.

Clive Humby, the British number cruncher credited with having come up with the phrase in 2006, merely argued that “data is just like crude … but if unrefined it cannot really be used…(it) must be broken down, analysed for it to have value.”

Things were relatively quiet for a decade, but in May 2017, The Economist, whose covers often evince appreciating smiles at the time and embarrassed ones years later, stated — rather dramatically — that “the world’s most valuable resource is no longer oil, but data” while calling for new ways to manage the market dominance of big technology companies.

That set things off. People missed the subtle and latched onto the direct analogy: if data is a commodity like crude oil, we’d better put ringfences around all the data we have before someone else stakes a claim on it. This zealous greed was soon accompanied by fear, after Kai-Fu Lee, a former Microsoft and Google executive, declared that if “data is the new oil, China is the new OPEC”.

Facepalm again. Why? Because unlike crude oil, data is not a zero-sum good.

If I give you a barrel of oil, you have a barrel and I have none. If I give you the music album that I recorded, both you and I have the album and I can give or sell it to as many others as I wish (heaven help them). While I could restrict who could listen to the music by encrypting it, my cost of making additional copies is negligible.

So, it is wrong to guard data sources as if they were oil wells. The mental model that the oil metaphor creates must be dismantled if we wish to make sensible policies around it. Yes, data can be used to make money, but not by hoarding, selling and consuming it like we do with oil.

It is in this context that we must see the current debate over data localisation in India. The Reserve Bank of India (RBI) essentially wants to ensure that all data relating to financial transactions involving Indians is stored and processed in India. The Union government is embracing data localisation too, triggering differences with the United States and other trading partners. With data localisation being wrapped in the language of ‘data nationalism’, there is a risk that the oil metaphor will cause serious damage to the national interest.

There are two aspects to this.

First, Indian citizens, firms and the economy benefit immensely from being connected to the global technological mainstream. Consumers benefit in myriad ways. For instance, a research laboratory in the United States could discover treatments for diseases and disorders that affect Indian population if it has access to health data. It is morally repugnant to block such data transfers by insisting that the foreign company invests in India first. Similarly, India’s technology companies process data from every sector, aerospace to credit card transactions to advanced bioinformatics, for clients around the world. If the “world is broken up into fragments by narrow domestic walls”, the Indian economy will suffer and our quality of life degraded.

Second, it is quite possible that ownership of data will be extremely valuable in the future because artificial intelligence algorithms need data to become better at things. One reason why people expect China to be a leader in AI is because it has lots of data. If it intends to take an “OPEC of data” approach, then it is not prudent for India to take a laissez-faire approach, lest we give away a potential source of strategic advantage. It is not about hoarding data because it is like oil, it is about not gratuitously giving away data that might give foreign companies and governments an advantage over us.

The upshot is that it is possible to reconcile the two, once you realise that physical location of data is less relevant than access to it. Instead of insisting that the data is stored and processed on Indian soil and nowhere else, the RBI could mandate that regulators and data auditors must always have access to it; and further, that no other unauthorised entities should. This could form the basis of a more general national policy, wherein firms are obliged to provide access to legitimate demands from government authorities, and also obliged to protect it against unauthorised access by other governments and firms.

Note that data localisation by itself neither assures the Indian government access, nor protects against unauthorized access by others. So, policy ought to focus on access, not location. To address strategic concerns, the government can create a whitelist of countries that can be trusted to store and process Indian data. The onus will thus be on foreign governments to satisfy New Delhi’s requirements to be on the whitelist.

The author is the director of the Takshashila Institution, an independent centre for research and education in public policy. Views are personal.