The recent move of the RBI to ban Mastercard from onboarding new customers in India in light of non-compliance with data localisation norms has shifted the focus back onto the topic of data localisation mandates. Earlier this year in April, the RBI had also taken similar actions against the American Express and Diners Club International for non-compliance. Further, in June of this year, they pulled up several multinational banks operating in India for non-compliance with its localisation norms. However, it fails to encapsulate the cascading impact it has on the broader economy.
Over the last couple of years, various regulations and policies have focused on data localisation measures to store data in India, be it the draft PDP Bill or the RBI mandate. The thinking behind this move is to encourage data sovereignty, though, in practicality, access over data does not depend on local storage but on the ability of nations to access data through legal instruments and cooperation.
Impact on Card Ecosystem
A ban on entities that fail to comply will have an impact on the banking ecosystem at large. At present several key banks and NBFCs like ICICI Bank, RBL Bank, Axis Bank, Bajaj Finserv, etc all work with Mastercard for the issuance of credit cards. In the aftermath of this ban, such entities will be forced to move their business to other service providers in India which is a time-consuming process taking over eight-ten weeks to begin services again. Simple services like the issuance of debit cards will also be required to be put on hold or revamped, thus bringing a halt in services such as these by banks. In such a situation, consumers i.e. regular citizens and businesses will be impacted in the aftermath of the move. Such bans will also increase card spend and new card issuance will be impacted. The ban might also lead to a fall in the transaction volumes, and might stress the payments network further, impacting India’s payments economy.
In such a situation, consumers i.e. regular citizens and businesses will be impacted in the aftermath of the move. It is imperative to note that the Indian credit card industry is pegged to grow at 25 per cent during the 2020 and 2025 period due to the increasing popularity of credit cards. In 2019, India had over 52 million credit card users which is indicative of the large market.
Rather than banning a provider of important consumer services, alternatively a fine or other methods to ensure compliance would be a wiser move to mitigate larger impact on the industry.
Ban may impact investor sentiments
The decision to bar multinational card providers to add new customers is a stringent move that might discourage big players from setting foot in India. Instead, it would have been more prudent to levy heavy fines for non-compliance. The focus must remain on a more proportionate response towards regulating entities and RBI could have levied fines or issued directions to entities for ensuring compliance. Ban must be the option of the last resort.
Recently, a US state department report stated that “India remains a challenging place to do business”. Quite a significant chunk of investments into India come from international investors, and with India reducing its dependency on China due to strategic reasons, it is crucial that our policy climate provides equal opportunities to both domestic and multinational players. This is especially true for investors that belong to like-minded nations such as the US, with whom we share a close, strategic partnership. It is crucial for India to provide a level playing field for companies to operate to help drive domestic economic growth and deliver on jobs.
Data transfer agreement between India and the US is critical
Ultimately circling back to the motivation behind localising data i.e. to carry out effective law enforcement requirements due to the fact that data access for law enforcement purposes has been a challenge for authorities in India. It is important to ask the question if hard localisation mandates will effectively achieve that purpose. Mere localisation of data does not create effective and quick access to data for law enforcement, whereas it concurrently impacts India’s payments ecosystem and economy in a myriad of ways.
To achieve the ends of law enforcement and to help facilitate the free flow of data for commerce, it is imperative to move beyond the present systems in place such as the MLAT (Mutual Legal Assistance Treaty) which often prove slow and ineffective. The government must shift its focus to exploring a system that is based on bilateral treaties on data transfers with like-minded partners such as the USA, the UK, and the European Union. Such an approach will allow for room to negotiate and ensure that a system is put in place for effective and timely access of data for law enforcement agencies, while allowing data flows to foster innovation and trade between different countries in the tech ecosystem. Precise operative instruments to facilitate such data flow will better serve purposes of security and trade in today’s globalised world. For India to be a part of the global supply chain, it is crucial to allow the free flow of data.
One such example of an instrument is the CLOUD Act (“Clarifying Lawful Overseas Use of Data Act”) in the United States. The CLOUD Act provides a framework where foreign Law enforcement agencies can directly request/ access American service providers’ data. This framework becomes operative after signing an executive agreement with the US government by the foreign country. Agreements concluded are built with procedural safeguards for crimes covered under the agreement. The CLOUD act model proposes an alternative to the cumbersome MLAT process and addresses the capacity problems that the States are subjected to. Moreover, the model also allows for privacy-respecting data flows for identified purposes between countries that sign the executive agreement. Moving away from a mandatory localization regime, which is premised on enhanced access to law enforcement, the CLOUD Act model proposes a balance between legitimate state interests, commercial interests, and the privacy of citizens.
In the view that localisation mandates contribute to making the IT sector less competitive, stifling innovation, or acting as a barrier for foreign investment in India, it is time to consider alternatives that help facilitate the motivations without hindering growth. Lessons may be taken from India itself in the past, wherein it reaped the benefits of cross-border data flows considering that the IT-BPM industry has a large share in India’s exports and contributed to 7.7 per cent to India’s GDP (2020).
(The author is the founder of the policy think tank, The Dialogue)
(ThePrint ValueAd Initiative content is a paid for, sponsored article. Journalists of ThePrint are not involved in reporting or writing it.)