India won’t back down on its plan for mandatory data localisation

The Indian government will remain firm on its proposal for mandatory data localisation by companies based abroad despite rising concerns in the US over such a move and fears that this could escalate the trade war between New Delhi and Washington, a person familiar with the matter said on condition of anonymity.

Still, India will try and build some nuance into its position, other people familiar with the matter said, also on condition of anonymity. For starters, it has sought to buy time by pointing out to the US that consultations with the industry and other stakeholders in India are still going on to finalise India’s position. New Delhi has also expressed its opinion that the global data regime should be discussed at the World Trade Organization. Foreign secretary Vijay Gokhale told reporters in Osaka (on the sidelines of the G20 meet) that India wants “international rule-making on data to be done within the WTO context because movement of data is one form of trade”. These negotiations shouldn’t be done in groupings outside the WTO and rule-making must be done in a manner that latitude is given to developing countries, he added.

None of this means a change of position, the first person added. “We won’t blink on the issue of data localisation. There were pressures on us in the past and there is pressure on us now. But, there is no question of a climbdown on matters of national interest,” the personal quoted above said. “We, however, admit that a certain data flow has to happen. We are ready for it. It can be worked out.”

This was the reason why India joined Indonesia and South Africa in not signing on for the “Osaka declaration on digital economy” at the recent G20 Summit in Osaka. This was a pet project of Japanese Prime Minister Shinzo Abe, who has spoken in recent months about efforts to allow the “free flow of data under rules we can all count upon”.

The Osaka Track, as Japan’s initiative has come to be known, was supported by the European Union and 23 countries, including key allies and trade partners of India such as the US, the UK, France, Germany, Russia and Singapore.

India’s decision to agree on talks to address trade differences, including data localisation, during the meeting between Prime Minister Narendra Modi and President Donald Trump in Osaka was aimed at ensuring that there is adequate time to discuss such issues domestically before negotiations with the US side, the people said.

India’s new data localisation provisions make it mandatory for foreign companies to store personal data of their users and customers in India within the Indian territory. Many US companies like Google, Mastercard, Visa and Amazon have raised concerns over the issue of data localisation and its impact on their operations.

“A situation where the data of millions of Indian users is stored outside the country, with government having no access to them, can’t be allowed now — especially not when the number of such users have grown rapidly in the last decade,” the first person explained.

Several US-based MNCs are lobbying for a liberal e-commerce policy that allows them autonomy in possessing and using private data, a tricky area that Indian authorities want to regulate.

According to the draft Personal Data Protection Bill, 2018, every data fiduciary has to ensure the storage, on a server or data centre located in India, at least one copy of personal data. Further, personal data determined to be critical will be subject to the requirement of being processed only in India with a prohibition of cross border transfer. The draft bill also suggests that the government will determine categories of sensitive personal data, which are critical to the nation — from the perspective of protecting its interests and meeting the needs of modern law enforcement.

A report by the Data Protection Committee of the Ministry of Electronics and Information Technology said in 2018 that storing personal data locally would help law enforcement agencies access information required for the detection of crime and evidence for prosecution.

In April last year, the Reserve Bank of India issued a directive on Storage of Payment System Data.