Personal Data Protection Bill: A Critical Analysis of Data Localization
Introduction
A right that is had by a person or by a company to have absolute rights to utilize its own plans, ideas, or other intangible advantages without the worry of competitions, at least for specific period of time. Some of the rights can include copyrights, patents, trademarks and trade secrets. The reasoning for intellectual property is to encourage the business without the apprehension of other competitors of stealing their idea or take the credit of it.
The need for a total data protection scheme has been finally recognized by the authorities of India and the bill has been able to seize most of the concerns and scrutiny around data privacy and data protection in India. Basically data protection can be defined as the set of privacy laws, policies and procedures that focuses to reduce the infringement into one’s privacy and dissemination of personal data.
There is a drastic change to privacy and data protection related issues in past few years. Data has now been considered to be most important strong point that is playing a fundamental role in upliftment of Indian economy.
Right to Privacy and Data Localization
Right to privacy is not present in constitution of India. But courts have recognized that right to privacy is embedded in under article 19(1) (a) and article 21 of constitution of India which talks about freedom of speech and personal liberty respectively. Further, in case of justice kS puttuswamy and Anr. V union of India and ors, the bench of honorable Supreme Court has held right to privacy subject to certain reasonable restrictions.
The world has been a global village ever since the internet has been invented. Because of the internet the data can flow freely all over the world. Basically data localization means the way of stockpiling the data within the visible boundaries of a country i.e the data of India should be in the boundaries of India only.
There are many pros and cons of data localization on one hand it is beneficial and on other hand it is believed that it will destroy the free flow of internet. Most important pros of data localization is protectionism, taxation and foreign surveillances. And secondly the disadvantages are the end of internet and government surveillances. India, till now dearth a dedicated data protection law that addresses its concerns as a expand data based economy.
The laws which are already present under Indian law i.e. the information technology act 2000, and the rules under Indian penal code 1860 and other sectorial rules are insufficient. For identifying the defects in the present day Indian data protection law, government of India appointed a committee of experts and drafting a new comprehensive data protection law for India.
The analysis on data localization under the data protection committee report and the bill: here the free flow of data is the nom and to restrict as an exception likewise right to privacy is fundamental right with some certain restriction on it.
Importance of data localization
Data localization is important to secure the personal data of the country from foreign surveillance. The importance of it is to protect the personal information of the country and its citizens from outsiders. Data localization is very important for national security. If the data is stored locally then it is easy for law enforcement to detect and collect the evidence for any criminal incidents. In some areas where data is not localized there they have to depend on MLATs to obtain access, ultimately delaying investigation.
Data localization under the committee’s report and the data protection bill:
Committee recognized that a ban on data crossing borders as restrain personal liberty of people. Committee also recommended should also be recorded locally as well as on which the Indian laws are applied.
Government also decided that there are some data which should not crass the boarders of the country. It should only be processed within the country.
Therefore there are certain paints to be taken into consideration in which government has divided the data into two parts: i.e. critical data and non-critical data. Where, critical data are sensitive in nature and these types of data should only be processed in India. On other hand non-critical data will be allowed subject to one serving copy of it being stored in India.
Other than critical personal data, cross border transfers of personal data will be through model clauses with the data transferor being directly proportional to data principle.
Mandatory data localization- different aspects.
1- Data mandated by RBI:
Here RBI directed that all the payment system should be stored in the system situated in India only. This direction by RBI has been given before the report of committee and the data protection bill. RBI released its notification of mandated data localization on 9th April, 2018 and said that the RBI includes “full extremity-to-extremity transaction details “payment instructions, and other information’s, collected processed etc.
2- Mandated data under the national e-commerce policy.
E-Commerce localizes several categories of data involved in it, for promoting India’s digital economy through various means and measures.in the recent time the localization under the draft amendment to drugs and cosmetics rules, 1945 has also being uplifted for the betterment and development of pharmacies.
It states that there should be the establishment of e-pharmacies web portals in India. By these portals e-pharmacies business will be conducted in India and data to be stored locally. It was said that any data of e-pharmacies, drugs or cosmetics should not be stored or sent by any means or measures from outside the country.
Data centers in India
In today’s time the major issue with personal data is cyber security. For storing the data locally and to reduce the cyber security attacks, there is a need for establishment of data centers, regulations and function under the law. There was the analysis which was done by cyber security report, 2017 released by Telstra and evaluated that business in India were most at risk to cyber security attacks. It is the duty of central government to give the types of personal data for which the data centers have to be developed in India and the authority to be developed under the laws to be responsible for compliance.
Cost benefit analysis
By the report of the committee they analyzed some detail advantages and disadvantages for taking up mandatory data localization in India.
There is a cost which arises during the enforcement of India’s own law. Mandatory data reduces such cost because of easily availability of data.
Secondly, there is a cost which arises while coordinating with foreign agencies; therefore it reduces that cost and time.
Thirdly, the data which is transferred overseas by the fiber cable are venerable to security attacks, therefore due to localization of data, these security attacks has been reduced.
Fourthly, by the committee’s report the critical data has to be stored in India only locally. So due to this any foreign country cannot interfere in internal matter of India.
Fifthly, there should be copy of data with India, which will boost the infrastructure and capture lots of data.
If data localization is having some benefits, on other hand it has some disadvantageous cost also which arises.
There is a burden on domestic enterprises, because of mandatory data localization. It is a cost for small and medium scale businesses. Very few businesses have expertise to establish the Centre for data localization in India.
Due to mandatory data localization there is a huge impact on economy widespread data localization, draw the boundaries for the business to choose from limited data storing location.
Data localization in other countries
1- In last few decades European center for international political economy has found a surge in data localization measures.
2- Russia is the country having most strict data localization systems and having high penalties. It is also having most restrictive formation of data flow.
3- Not all data is mandated localized in GDPR, but has restricted the flow of data to other countries with the high protection framework
4- In china government has mandated the flow of all data in restricted sense and also the flow of data to outside countries has to pass a high security assessment.
Conclusion
In conclusion the three major sets of arguments have been examined.
1- It has been recognized that data localization will enhance security and privacy by believing that a level of protection is given to data.
2- It was in question that the interference of government into data delays the law enforcement.
3- There is an economic benefit that will lead in terms of creating the local data infrastructure, employment and contribution to the al ecosystem.
By analyzing all these points and above evaluation it was evaluated that cost of sweeping data localization norms and introducing boards are likely to be greater its benefits. So it can be said that in some cases data localization can be qualified and in some cases does not.
There are some steps that should be considered while policymaking.
Identify the problems along with the evidence indicating the gravity of problem.
Evaluate the various options regarding the issues, and consider the cost in each of them and benefits of each alternative. This evaluation should consider all functioning of the state and economic, measures on civil liberties.
Choose the least intrusive measures among the various data localization options.
The whole process should be done in transparent and open manner.
Shrikrishna committee has proposed a protection bill to be drafted; therefore the above process can be built into the proposed laws and regulation for the data localization. Suggestion has been given that this process should be follow till the time new laws and regulation are not conducted. For the future development in data localization India should also enter into various multi trade agreements, which focuses more on protection of personal data.
Government wants country to be digital India so data localization should be weighed against its aspirations.
Author's opinion
For protecting personal data, for the security of the information, for the safeguard of the critical data, for development of digital India, for building strong competencies in artificial intelligence and protecting the data of citizen is now becoming mandatory. It is a challenge for the government to provide vast availability of land, power supply to data centers. Now it has to be seen that hoe government of India develop such things.
A right that is had by a person or by a company to have absolute rights to utilize its own plans, ideas, or other intangible advantages without the worry of competitions, at least for specific period of time. Some of the rights can include copyrights, patents, trademarks and trade secrets. The reasoning for intellectual property is to encourage the business without the apprehension of other competitors of stealing their idea or take the credit of it.
The need for a total data protection scheme has been finally recognized by the authorities of India and the bill has been able to seize most of the concerns and scrutiny around data privacy and data protection in India. Basically data protection can be defined as the set of privacy laws, policies and procedures that focuses to reduce the infringement into one’s privacy and dissemination of personal data.
There is a drastic change to privacy and data protection related issues in past few years. Data has now been considered to be most important strong point that is playing a fundamental role in upliftment of Indian economy.
Right to Privacy and Data Localization
Right to privacy is not present in constitution of India. But courts have recognized that right to privacy is embedded in under article 19(1) (a) and article 21 of constitution of India which talks about freedom of speech and personal liberty respectively. Further, in case of justice kS puttuswamy and Anr. V union of India and ors, the bench of honorable Supreme Court has held right to privacy subject to certain reasonable restrictions.
The world has been a global village ever since the internet has been invented. Because of the internet the data can flow freely all over the world. Basically data localization means the way of stockpiling the data within the visible boundaries of a country i.e the data of India should be in the boundaries of India only.
There are many pros and cons of data localization on one hand it is beneficial and on other hand it is believed that it will destroy the free flow of internet. Most important pros of data localization is protectionism, taxation and foreign surveillances. And secondly the disadvantages are the end of internet and government surveillances. India, till now dearth a dedicated data protection law that addresses its concerns as a expand data based economy.
The laws which are already present under Indian law i.e. the information technology act 2000, and the rules under Indian penal code 1860 and other sectorial rules are insufficient. For identifying the defects in the present day Indian data protection law, government of India appointed a committee of experts and drafting a new comprehensive data protection law for India.
The analysis on data localization under the data protection committee report and the bill: here the free flow of data is the nom and to restrict as an exception likewise right to privacy is fundamental right with some certain restriction on it.
Importance of data localization
Data localization is important to secure the personal data of the country from foreign surveillance. The importance of it is to protect the personal information of the country and its citizens from outsiders. Data localization is very important for national security. If the data is stored locally then it is easy for law enforcement to detect and collect the evidence for any criminal incidents. In some areas where data is not localized there they have to depend on MLATs to obtain access, ultimately delaying investigation.
Data localization under the committee’s report and the data protection bill:
Committee recognized that a ban on data crossing borders as restrain personal liberty of people. Committee also recommended should also be recorded locally as well as on which the Indian laws are applied.
Government also decided that there are some data which should not crass the boarders of the country. It should only be processed within the country.
Therefore there are certain paints to be taken into consideration in which government has divided the data into two parts: i.e. critical data and non-critical data. Where, critical data are sensitive in nature and these types of data should only be processed in India. On other hand non-critical data will be allowed subject to one serving copy of it being stored in India.
Other than critical personal data, cross border transfers of personal data will be through model clauses with the data transferor being directly proportional to data principle.
Mandatory data localization- different aspects.
1- Data mandated by RBI:
Here RBI directed that all the payment system should be stored in the system situated in India only. This direction by RBI has been given before the report of committee and the data protection bill. RBI released its notification of mandated data localization on 9th April, 2018 and said that the RBI includes “full extremity-to-extremity transaction details “payment instructions, and other information’s, collected processed etc.
2- Mandated data under the national e-commerce policy.
E-Commerce localizes several categories of data involved in it, for promoting India’s digital economy through various means and measures.in the recent time the localization under the draft amendment to drugs and cosmetics rules, 1945 has also being uplifted for the betterment and development of pharmacies.
It states that there should be the establishment of e-pharmacies web portals in India. By these portals e-pharmacies business will be conducted in India and data to be stored locally. It was said that any data of e-pharmacies, drugs or cosmetics should not be stored or sent by any means or measures from outside the country.
Data centers in India
In today’s time the major issue with personal data is cyber security. For storing the data locally and to reduce the cyber security attacks, there is a need for establishment of data centers, regulations and function under the law. There was the analysis which was done by cyber security report, 2017 released by Telstra and evaluated that business in India were most at risk to cyber security attacks. It is the duty of central government to give the types of personal data for which the data centers have to be developed in India and the authority to be developed under the laws to be responsible for compliance.
Cost benefit analysis
By the report of the committee they analyzed some detail advantages and disadvantages for taking up mandatory data localization in India.
There is a cost which arises during the enforcement of India’s own law. Mandatory data reduces such cost because of easily availability of data.
Secondly, there is a cost which arises while coordinating with foreign agencies; therefore it reduces that cost and time.
Thirdly, the data which is transferred overseas by the fiber cable are venerable to security attacks, therefore due to localization of data, these security attacks has been reduced.
Fourthly, by the committee’s report the critical data has to be stored in India only locally. So due to this any foreign country cannot interfere in internal matter of India.
Fifthly, there should be copy of data with India, which will boost the infrastructure and capture lots of data.
If data localization is having some benefits, on other hand it has some disadvantageous cost also which arises.
There is a burden on domestic enterprises, because of mandatory data localization. It is a cost for small and medium scale businesses. Very few businesses have expertise to establish the Centre for data localization in India.
Due to mandatory data localization there is a huge impact on economy widespread data localization, draw the boundaries for the business to choose from limited data storing location.
Data localization in other countries
1- In last few decades European center for international political economy has found a surge in data localization measures.
2- Russia is the country having most strict data localization systems and having high penalties. It is also having most restrictive formation of data flow.
3- Not all data is mandated localized in GDPR, but has restricted the flow of data to other countries with the high protection framework
4- In china government has mandated the flow of all data in restricted sense and also the flow of data to outside countries has to pass a high security assessment.
Conclusion
In conclusion the three major sets of arguments have been examined.
1- It has been recognized that data localization will enhance security and privacy by believing that a level of protection is given to data.
2- It was in question that the interference of government into data delays the law enforcement.
3- There is an economic benefit that will lead in terms of creating the local data infrastructure, employment and contribution to the al ecosystem.
By analyzing all these points and above evaluation it was evaluated that cost of sweeping data localization norms and introducing boards are likely to be greater its benefits. So it can be said that in some cases data localization can be qualified and in some cases does not.
There are some steps that should be considered while policymaking.
Identify the problems along with the evidence indicating the gravity of problem.
Evaluate the various options regarding the issues, and consider the cost in each of them and benefits of each alternative. This evaluation should consider all functioning of the state and economic, measures on civil liberties.
Choose the least intrusive measures among the various data localization options.
The whole process should be done in transparent and open manner.
Shrikrishna committee has proposed a protection bill to be drafted; therefore the above process can be built into the proposed laws and regulation for the data localization. Suggestion has been given that this process should be follow till the time new laws and regulation are not conducted. For the future development in data localization India should also enter into various multi trade agreements, which focuses more on protection of personal data.
Government wants country to be digital India so data localization should be weighed against its aspirations.
Author's opinion
For protecting personal data, for the security of the information, for the safeguard of the critical data, for development of digital India, for building strong competencies in artificial intelligence and protecting the data of citizen is now becoming mandatory. It is a challenge for the government to provide vast availability of land, power supply to data centers. Now it has to be seen that hoe government of India develop such things.
Comments
Post a Comment