DATA PROTECTION AND LOCALIZATION

Description

Disclaimer: Copyright infringement not intended.

Context

The government has withdrawn the Personal Data Protection Bill from Parliament.
It is looking for coming up with a “comprehensive legal framework” for regulating online space including separate legislation on data privacy, the overall internet ecosystem, cybersecurity, telecom regulations, and harnessing non-personal data for boosting innovation in the country.

Importance of data

Data usually refers to information related to messages, social media posts, online transactions, and browser searches. It has become an important source of profits.
Companies, governments and political parties find it valuable because they can use it to find the most convincing ways to advertise online.
Much of the future’s economy and law enforcement will be predicated on the regulation of data, introducing issues of national sovereignty.

Handling of data

Data is stored in a physical space similar to a file cabinet of documents and transported across country borders in underwater cables. Data is collected and handled by entities called data fiduciaries.
While the fiduciary controls how and why data is processed, the processing itself may be done by a third party, the data processor.
The physical attributes of data — where data is stored, where it is sent, where it is turned into something useful — are called data flows.

What is Data Localization?

Data localization refers to the act of storing data on any physical device that may be present within the territorial borders of a country where the data has been generated. Some governments often restrict free-flowing data and the data that could impact government operations in a region. Many governments attempt to protect and promote security across the borders to encourage data localization.

Advantages of Data Localization

In today’s time, data is considered to be the new oil, and this makes it very valuable. If the data is analyzed accurately, then it can form the backbone for any successful business.
Governments looking to implement data localization might be seeking to give their local corporations a competitive edge. The national government can prevent the flow of data to external countries and thus, this data can be made available for the internal use by the domestic companies only. The informational asymmetry caused will prove to be beneficial for local companies.
Data is a national resource,and thus the government holds a right on the revenue that is generated from the data. Similar to the inflow and outflow taxation of goods and services, the movement of data can also undergo taxation. The government can use the additional taxes generated from data for developing newer programs.

Disadvantages of Data Localization

Foundation of the Internet lies with the free movement of data. In case the free flow of data is affected by imposing taxes or extreme protectionism, this will eventually destroy the Internet.
Most companies prefer using the Internet as a medium to reach their customers is because it is cheaper and free of excessive regulation. When robust data localization and protection laws are implemented, then there is a high possibility that the Internet may face an abrupt end leading to its ‘death’.
Another disadvantage that data localization holds is the security problem that is associated with the storage of dataat a single location. The concept of storing data in a single geographical region is entirely opposite to the diversification approach followed by the MNCs. Also, the citizens of the country are not willing to allow the government to spy on their data. If all the data is stored within the geographical boundaries, then the government can collate all this data and even invade an individual’s privacy, if needed.

Challenges to Data Localization in India

Presently, India doesn’t have any infrastructure to support the security of data being generated in the country. Without a secured infrastructure, the data remains prone to all kinds of cyber-attacks, and also there is a severe risk involved. With laws being implemented, it remains a challenge to develop an efficient infrastructure at a quick pace.
The storage of data in India includes higher operational costs for payment system operators. In the case of cross-border transactions, data has to be stored in two places, which could increase the costs, and there is a high chance that these extra incurring costs will fall on to the consumers.
Data localization can also be viewed against the intellectual property rights of an individual. This is because the individuals use their intelligence to form a system that can benefit from the data it has generated. Though, in the end, the consumers are deprived of these benefits, and a third-person might use the data in their favour.

Why has High Reluctance Shown by Companies?

Most of the companies in the Indian market are not willing to adopt data localization as of now. The major reason why the companies are reluctant to comply with data localization is due to the costs involved.
The costs can be in various hardware forms such as- servers, USPs, generators. It could also include the cost of infrastructure.
Some companies hold the belief that India is not ready to have such an infrastructure and ecosystem that supports data localization.
Large e-commerce players in the industry feel that there might be an increase of about 10-50% in the costs, depending on the strictness and rigidness of the final law.
However, the big e-commerce and social media players are not going to be affected by this. The smaller businesses in the economy will be the ones who’re going to be at the suffering end.

Global Effects of Data Localization

On the global scale, data localization regulations have created a significant impact on the economy in an era where economic growth is driven by the Internet.
Internet is also the key enabler for trading taking place across several industries. With restrictions added on data storage and transfer, data localization holds a key threat to the free-flow of information taking place across the borders and maintenance of global supply chains.
Due to the imposed regulations, there is a great impact that takes place on email communication, personal records, and social media services, adding to the limited access of information on which the manufacturing and service economies are heavily dependent.

Present Data Laws in Effect in India

As of now, there is only a single mandatory rule for data localization in India.This is governed by the Reserve Bank of India (RBI) and is meant for payment systems. Besides this, other bill drafts are yet to take the form of a law.
The other prominent evidence present in this context is the Data Protection Bill of 2018. The bill itself has got a fixed set of requirements on the data transfer that takes place across the borders. The draft e-commerce policy has clauses on the cross-border transfer of data.

Need for data localization

Will help law-enforcement access data for investigations and enforcement.
Proponents highlight security against foreign attacks and surveillance, harkening notions of data sovereignty.
Many domestic-born technology companies, which store most of their data exclusively in India, support localisation.
Reliance Jio has strongly argued that data regulation for privacy and security will have little teeth without localisation, calling upon models in China and Russia.
Instances of cyber attacks and surveillance will be checked. Recently, many WhatsApp accounts were hacked by an Israeli software called Pegasus. Social media is being used to spread fake news, which has resulted in lynchings, national security threats, which can now be monitored, checked and prevented in time.
Data localisation will increase the ability of the Indian government to tax Internet giants.
Strong data protection legislation will also help to enforce data sovereignty.

Final Thoughts

Data Privacy will require a balancing act between personal liberty and sovereign securitiessuch as prevention and investigation of crime and National security threats. Another legitimate concern of the State that needs to be balanced with the Right to Privacy, recognized in Puttaswamy, is social welfare measures.
The illegitimate commercial gainsbeing enjoyed by enterprises at the cost of privacy of individuals are also likely to vanish due to data localization.
But Data protection is a complex exercise, and the law will need amendments from time to time depending on the problems that crop up. Thus, it must be brought into the Statute book expeditiously.