Registration
Thank you!
You will receive an email confirming your registration.
KnowledgeTransfer@CarnegieIndia is an initiative that aims to provide a platform to facilitate the genuine exchange of ideas and knowledge among students, practitioners, subject-matter experts, and other interested audiences.
The debate surrounding data localization has continued to gather momentum in India. Localization mandates that companies collecting critical data store and process it within the borders of the country. While advocates of localization point to the importance of data as a commodity, skeptics point to the potential fracturing of the internet if countries adopt protectionist policies.
As part of the Global Technology Summit 2019, Carnegie India hosted workshop on the opportunities, costs, and challenges that lie in the way of adopting data localization in India. This workshop was facilitated by Anirudh Burman, an associate fellow at Carnegie India.
DISCUSSION HIGHLIGHTS
- Understanding Localization: Participants stated that localization includes measures that specifically inhibit the transfer of data across countries and may include regulations that prohibit information from being sent offshore. They noted that it has several variants, particularly hard localization, soft localization, sectoral localization, conditional localization, and unconditional localization, they added. Participants explained that while hard localization means that data must be stored exclusively within a mandated territory, soft localization refers to the mirroring of data. This, they elaborated, is the real-time operation of copying data as an exact copy, and storing the data in multiple locations, so that the original data is stored in one location and the copy is stored in another. Participants further explained that sectoral localization refers to the localization of a particular sector’s data. To illustrate this, they pointed out that health and financial data in many countries has been localized. In India, they highlighted that this applies to telecom, internet service providers, and payment firms. Finally, participants explained that while conditional localization refers to the cross-border flow of data between countries that uphold the same security standards and meet certain adequacy standards, unconditional localization refers to no transfer of data in any circumstances. While all these variants can be adopted unilaterally, participants also examined the possibility of bilateral and multilateral arrangements. Bilateral and multilateral arrangements allow participating countries to easily share and transfer personal information with each other, participants explained. They added that, currently, these include the G20, US–EU agreements such as the EU-US Privacy Shield, and Asia Pacific Economic Cooperation Cross Border Privacy Rules (APEC CBPR)
- Motivations for Localization: Participants traced the international conversation advocating for localization and noted that it stems from three major concerns. They stated that these are the requirement for speedier access to personal data for investigations by law enforcement agencies, combating terrorist activities and serious crime, and economic growth. Participants highlighted that India shares similar concerns. They further explained that in India, the widespread fake news, resulting in lynchings and panic, has given rise to demand from law enforcement agencies to access encrypted data on platforms such as WhatsApp. Participants stated that this access is hampered since many global data service providers store their data on servers outside India, mostly in the United States. They added that this is further complicated by the existing mechanism to share data between countries, which is the Mutual Legal Assistance Treaty (MLAT). India currently has MLATs with 38 countries, including the United States, participants noted. Participants highlighted that the average time taken to access the data requested by Indian law enforcement agencies through the MLAT pprocess is 10 months. Therefore, they agreed, localizing data would allow for much speedier access to data for law enforcement purposes.
- Objectives of Localization: Broadly, participants delineated four objectives, stated by the government, for localization. These include the hypotheses that localization would increase access to data for law enforcement agencies, boost economic growth, prevent foreign surveillance, and enhance enforcement of data protection laws through the creation of a Data Protection Authority (DPA). Participants agreed that speedier access to encrypted data would allow law enforcement agencies to monitor for possible offenders to prevent crime. Participants concurred that faster access to data will speed up investigation of crimes. Some participants argued that localization would lead to economic benefits and create job opportunities in India. Participants further maintained that the locally stored data would inform scientific progress leading to further innovation. However, some participants also felt that localization was not the only way to achieve the government’s objectives, raising questions on the economic cost of localization and its implications for India. Participants argued that the costs of hard localization could be detrimental to India’s economy and that the country should pursue a less intensive alternative to ensure easy access to data, such as mirroring or entering into a bilateral and/or multilateral agreements. Finally, participants felt that while the costs of localization can be borne by the big tech companies, it will be most detrimental to small and medium scale enterprises, for whom the localization requirements will impose a significant cost.
- Looking Ahead: Participants discussed the future of localization in India. They agreed that this would be largely based on the Personal Data Protection Bill, 2019. They discussed the localization mandates in the Draft Personal Data Protection Bill, 2018 which stated that a copy of all data must be stored within India and “critical personal data” cannot be taken out of India. Participants suggested weighing both localization and its various alternatives against specific criteria to evaluate the best way to achieve the stated objectives of localization. Participants agreed that placing restrictions on cross–border flows of data entails many risks, but emphasized that the correct alternative could benefit the country.
This event summary was prepared by Upasana Sharma, a research assistant at Carnegie India
