The Narendra Modi government wants to reportedly water down the provisions related to data localisation proposed in the draft Personal Data Protection Bill 2018 formulated by the Justice Srikrishna Committee.
The debate on the free-flow and storage of data has assumed significance in the wake of technological developments – such as Artificial Intelligence (AI) – that can harness data to provide better and cheaper services to consumers. The debate on data localisation is now not only a political one, but also a geopolitical one, and a key aspect of trade talks between India and other countries like the US. However, it is important to examine and analyse whether localisation, as defined in the data protection bill, would actually meet its underlying objectives.
Options for India
Simply put, the debate on data localisation concerns the issue of whether data related to Indian citizens can be stored and processed globally or whether it should be stored and processed only within the territorial borders of India. There are, nonetheless, various intermediate options that can be exercised – data could be stored and processed globally with a copy stored in India (mirroring), data could be processed and analysed globally but stored only in India (global processing, local storage – the Reserve Bank of India has mandated this for financial data), or certain kinds of data such as critical data would have to be stored and processed only within India, while all other sorts of data could be freely stored and processed globally. The data protection bill creates a layered framework for data localisation – a copy of all data has to be kept in India and critical personal data cannot be taken out of India, except under certain circumstances.
What proponents of localisation say
Localisation has become an important part of the larger debate on data governance for two primary reasons. First, law enforcement agencies require access to personal data to conduct investigations and maintain national security. This access is constrained by the fact that many social media and e-commerce companies are based in other countries (mainly the US) and are required to comply with foreign privacy laws before such access can be provided. This process is time-consuming and cumbersome. It is believed that mandating the storage of personal data in India would ease such constraints significantly.
Second, proponents of localisation have claimed –including the Srikrishna Committee – that holding data about Indian citizens in India would benefit the economy, as Indian service providers would be able to benefit from locally stored data better than their foreign competition. The Srikrishna Committee report, for example, states that harnessing AI would allow for substantial gains to the economy, and that mandating localisation would lead to the creation of digital infrastructure and trained human capital.
Also read: India, the biggest open data market, has a chance to lead the world on data arbitration
Will it help?
Both these claims are problematic. Law enforcement agencies do face a genuine constraint in accessing personal data from companies that are subject to US laws. The existing Mutual Legal Assistance Treaty (MLAT) that governments use to access such data takes an average of 10 months if successful. However, localisation may not necessarily solve this issue. For one, even if US companies are required to store their data in India, they would still continue to be governed by US laws. Indian law enforcement requests would still continue to be subject to US privacy laws. So, local storage of data may not necessarily enable easier access to data.
In addition, data localisation would not enable easier access to encrypted information required by law enforcement authorities. Access to such communication is essential for law enforcement authorities for both preventing and investigating crimes. However, an independent legal requirement is necessary to compel technology companies to decrypt encrypted communications. As per recent news reports, the Modi government is considering mandating such requirements for social media and messaging services.
The second claim of economic benefits is more complex and challenging. On the one hand, localisation could, in fact, incentivise investments in digital infrastructure in the form of data centres for storing data. However, this is subject to whether other resources necessary for setting up data centres are, or will be, available in India. For example, the availability of reliable electricity supply is critical for developing such infrastructure. Given India’s power supply constraints, this is likely to be an important factor that affects investments in data centres. Also, it is unclear whether the creation of such digital infrastructure would lead to a significant increase in employment. A study of US data centres found that while data centres do constitute a significant capital investment, they produce minimal increases in employment.
Also read: India’s policy on data must focus on access, not physical location
Further, the current benefits India gains from the free flow of personal data have to be factored into any estimation of the costs and benefits of localisation. Given the existing absence of adequate human capital in India to fully exploit Indian data, Indian consumers currently benefit from those who wish to serve Indian consumers using expertise located outside India. Imposing significant restrictions on the flow of data would lead to some loss of such benefits. This is because the costs of accessing Indian data would increase commensurate with the degree of restrictions imposed. On the other hand, whether sufficient expertise in India develops as a result of localisation is, at this juncture, a potentiality that may or may not fructify.
To sum up, the data economy functions on the basis of complex interlinkages of data availability, human capital and technological capability across multiple jurisdictions. The debate on data localisation must factor in this complexity while assessing whether any step towards localisation would benefit India. In order to do this, a higher degree of specificity of the objectives to be achieved, and the alternatives for doing so, have to be examined in greater detail.
This article is part of a series examining The Future of Data in partnership with Carnegie India leading up to its Global Technology Summit 2019 in Bengaluru from 4-6 December 2019. More details about the summit are available here.
The author is an associate fellow at Carnegie India. Views are personal.