RBI's Stance on Data Localisation Rules

Why in news?

The government and the RBI are firm on the October 15 deadline for compliance on data localisation standards.

What was RBI's order on data storage?

• Data localisation is storing of data on a device physically present within the borders of the country where the data was generated.
• RBI, in April, 2018, gave 6 months time to global payment companies to store transaction data of Indian customers within India.
• The data should include the full end-to-end transaction details, information collected/carried/processed as part of the message/payment instruction.
• The requirements apply as those mentioned in the draft data protection bill and draft national e-commerce policy framework.

What was the demand?

• Global financial technology companies have reportedly sought an extension to the October 15 timeline, with demands to adopt a soft stance on data localisation.
• But the RBI and the government did not favour any extension of the deadline.
• The government has also ruled out data mirroring as an option.
• Foreign payment companies had asked the RBI to allow data mirroring which would allow them to store a copy of the data overseas as well.

Why is it being opposed?

• Any move to restrict all cross-border data flows could be counterproductive, on becoming a trade barrier.
• The norms could have negative impacts on the ability of companies to do business in India.
• Especially, the U.S. warned that India's policy on the issue will adversely affect American businesses in the country.
• It may undermine India's own economic goals and may not likely improve the security of Indian citizens' data.
• It could also break up the Internet if every country in the world insists on keeping data within its territory.

What is RBI's rationale?

• The move was to ensure better monitoring of payment service operators.
• Data localisation would offer supervisory access to data stored with these system providers.
• It also gives access to data stored by their service providers/ intermediaries/third party vendors and other entities in the payment ecosystem.
• National security and data sovereignty are other reasons for data localisation rules.
• As, it is possible that data could be indicted if it is stored on American servers and India faced US sanctions.

What are the limitations to data localisation?

• Global players like banks, e-commerce majors, fin-tech service providers and credit card companies prefer to store and process data at one or two global centres.
• So moving processes implies higher costs and disruption for them.
• New teams must be hired and trained, and security procedures have to be reviewed and modified.
• Local infrastructure in India suffers from severe deficiencies.
• Indian data-transmission speeds are slow by global standards.
• Server capacity is low and costs are high, and likely to rise as demand is artificially boosted.
• So RBI’s insistence may lead to a situation where smaller payment companies stop offering services in India.
• It will also impose higher costs on the start-up ecosystem since any Indian start-up will pay higher costs to include payment options.

• Legal - The Srikrishna Committee recommendations on data protection are now only open for public feedback.
• So as of now, India neither has a functioning data protection law nor adequate security standards in practice.
• Evidently, there have been instances of massive leaks and hacks of sensitive information, including payment records.
• Surveillance - Law and order departments and security agencies currently operate in a legal vacuum, making surveillance another grey area.
• They can search and survey all sorts of digital data without any checks or balances.
• Indeed, there is evidence that foreign intelligence agencies also collect a massive amount of Indian data and meta-data.

How is it elsewhere?

• Data localisation is not a new concept but has picked up pace after 2013.
• It is when America's National Security Agency contractor Edward Snowden leaked classified documents.
• It showed how the US government had accessed data to conduct surveillance on foreign allies.
• Since then, countries like Germany have taken steps to ensure that sensitive data stay within their borders.
• Many other countries like Russia and China have very stringent laws around data localisation.
• It is largely driven by the fear of losing critical data to hackers and spy networks of rival countries, as well as systemic risks during times of conflict.

What lies ahead?

• RBI's firm stance on sticking to the deadline is a welcome move.
• It should now send a stronger signal by imposing stiff penalties for non-compliance.
• Sectors - However, India should be careful in imposing data localisation across all sectors.
• Adopting data localisation in few sensitive sectors like financial services and relaxing on e-commerce and cloud computing is valid.
• E.g. in Australia and Canada, data localisation rules are applied only to specific sectors like healthcare, telecom and finance
• Law - Data localisation rules must be backed up by a strong data protection law to clearly define and limit surveillance powers.
• Policy measures to encourage the creation of higher server capacity and enabling cheaper and faster data transmission are essential.
• Multinational companies, on their part, should take a more proactive role in following local rules.

Source: Economic Times, BusinessLine, Business Standard