Data Localisation

Data Localisation Bill India

• The revised data protection Bill, called Digital Data Protection Bill, is expected to allow transfer of data and its storage in “trusted geographies”.
  • The government will define “trusted geographies” from time to time.
• Other changes proposed:
  • Scrapping of penalties: Criminal penalties proposed to be imposed on employees of companies involved in data breach will be scrapped.
    • Financial penalties of as much as Rs 200 crore, multiplied by the number of users impacted, will be imposed per breach.
  • Data Protection Board: A Data Protection Board will be set up to adjudicate the consequences of any data breaches and decide on the penalty to be imposed.

Data Localisation Laws India: Osaka Track

• Osaka track is a framework by G-20 countries to promote cross-border data flow. India, Indonesia and South Africa refused sign.
• It aims to standardize rules in global movement of data flows with better protection in personal information, intellectual property and cyber security.

What is Data Localisation

• Data localisation is a practice of storing data within the region it originated from. Data can be moved to another jurisdiction only after getting assent from concerned parties.
• Implementation: Data localisation is implemented in multiple ways. In some cases, firms are required to store a local copy of all data, even though this data can be taken and analyzed outside the country.
• In other cases, firms are not allowed to take any data outside a country’s territorial jurisdiction. The Osaka track of G-20 framework is opposed to data localisation.

Advantages of Data Localisation

• • Data privacy: Data localisation will avoid data going to other jurisdictions, which prevents third parties to analayse and use data.
  • National security: Locally stored data can be accessed in cases concerning National security.  This is not possible for data stored abroad and governed by different rules.
  • Boost local economic activity: Data localization will require setting up of data centres in the home country, which will boost economy and create new jobs.
  • Data protection laws: Data protection laws will only be applicable in case data is stored locally. To ensure personal data protection, localisation is necessary.
  • Scientific innovation: Easy data availability could help lower barriers to scientific innovation for smaller Indian companies.

Concerns with Data Localisation

• • Affects efficiency: Data localisation forces companies to create new data storage infrastructures in all countries they operate. This will affect their efficiency and cost.
  • Exit of business: Many firms that store data beyond a country’s border will be forced to exit business for not complying with data localisation.
  • Prevents collaboration: Collaboration between multi-regional companies will be affected as data flow will be severely restricted.

Data Localisation Highlights of the Personal Data Protection (PDP) Bill, 2019

• Applicability: The bill governs entities handling data such as government, companies incorporated in India, and foreign companies dealing with personal data of individuals in India.
• Obligations: The bill puts certain obligations on entities processing personal data, such as certain purpose, collection and storage limitations.
• Grounds of processing: The Bill allows processing of data by entities only if consent is provided by the individual. However, in certain cases, personal data can be processed without consent.
• Transfer of data outside India: Sensitive personal data can be transferred outside India for processing if explicit consent is obtained by the individual, and subject to certain additional condition.
• Exemptions: Certain central agencies have been given exemptions from the provisions of the Act, especially in cases involving national security.

• Sharing with government: The central government may direct data entities to provide it with non-personal data and anonymised personal data for better targeting of services.
• Criticism of the bill:
  • Criminal penalty, non-personal data and social media regulation along with provision on data localisation were some the most contentious clauses in the old draft.
  • There were also concerns about excessive powers given to central agencies to freely obtain data under certain conditions.

Sharing is caring!