Data localisation

The importance and use of data in today’s techno-driven world are immense. Hence, data localisation is an important thing.

The crossborder data flow has proven to be an essential strength for established and growing businesses.
In their Digital Economy Report, the United Nations Conference on Trade and Development found that businesses using the internet for global trade have a higher survival rate than those that do not.
Therefore, it becomes essential for economies [significantly growing economies] to protect data during crossborder transfers.

It is the practice of storing data on any device physically present within the borders of the country where the data is generated.

Protect the personal and financial information
The primary intent behind data localisation is to protect the country’s citizens’ and residents’ personal and financial information from foreign surveillance.
Accessibility
If the data is stored outside India, access to this data will be restricted by local laws, and Indian agencies will depend on the host-country governments’ whims and fancies for access.
National security

Storing data locally is expected to help law enforcement agencies to access information that is needed for the detection of a crime or to gather evidence.
On top of that, the confidential information related to citizens stored domestically would help national security.
Economic benefits
The economic benefits will accrue to local industry in terms of creating local infrastructure, employment and contributions to the artificial intelligence (AI) ecosystem.

Restricting service providers to use the infrastructure within a limited geographical territory increases the threats to data security.
This is because the internet enables centralised data storage and processing, taking advantage of economies of scale and a seamless, global internet.
Data Localisation cannot stop foreign surveillance.

Several foreign governments are reported to use sophisticated malware for data surveillance.
Thus, physical access to data storage or processing facilities is not technically necessary to conduct surveillance activities.
Cost of Localisation
Policymakers have yet to grapple with the substantial costs of reorganising and relocating data and operating new data centres, which could discourage, if not bar, investment, especially from small and medium enterprises.
Reduced quality of services
Data localisation could significantly reduce the quality of the services Indian consumers receive by depriving companies of the scale and efficiencies of global networks and restricting the volume of data from which companies can extract insights to improve their services.

Higher cost
Maintaining multiple local data centres may lead to significant investments in infrastructure and higher costs for global companies.
It may reduce efficiency.
Forced data localisation can create inefficiencies for both businesses and consumers. It can also increase the cost and reduce the availability of data-dependent services.
Oppositions from Global Internet Giants
Facebook founder recently expressed apprehension about nations wanting to store data locally. According to him, it gave rise to possibilities where authoritarian governments would have access to data for possible misuse.
Opposition from the US
The US Electronic Communications Privacy Act bars US-based service providers from disclosing electronic communications to law enforcement agencies of any country unless US legal requirements are met.

General Data Protection Regulation
The European Union’s General Data Protection Regulation (GDPR) does not mandate all data be localised but restricts flow to countries with a robust data protection framework.
The United States
The United States has no single data protection law at the Federal level. It does, however, have individual laws such as HIPAA (Health Insurance Portability and Accountability Act of 1996) for health care, another for payments, and the like.
China
China mandates strict data localisation in servers within its borders.

It recommends that at least one copy of personal data be stored on servers within India.
Critical personal data will only be stored and processed in India.
Data Protection Bill 2018
This Bill lays out a framework for data protection and limits how personal data will be used, collected, and processed.
Draft National E-Commerce Policy Framework
It recommended data localisation and suggested a two-year sunset period for the industry to adjust before localisation rules become mandatory.

Infrastructure
Adequate infrastructure and adequate attention need to be given to the interests of India’s Information Technology enabled Services (ITeS) and Business Process Outsourcing (BPO) industries, which are thriving on cross-border data flow.
Data localisation is critical for law enforcement.
Access to data by Indian law agencies, in case of a breach or threat, cannot be dependent on the whims and fancies nor on lengthy legal processes of another nation that hosts data generated in India.
Need a level playing field
All the players involved, including banks, telecom companies, financial service providers, technology platforms, social media platforms, e-commerce companies and the government, need to play a responsible role in ensuring innocent citizens do not undergo the trauma of suffering losses.

Content Source: The Hindu