At cross purposes?

The draft Indian Personal Data Protection Bill 2018 appears to be in conflict with the very ideas on which it is based

Vinoba Bhave is one person to whom I would give singular credit for my being what I am today —— an international lawyer and a globalisation expert. When I was growing up in the 1960s, I heard him extolling the Indian politicians: “15 years ago the slogan was ‘hail India’, today’s slogan is ‘hail the world’.” He always described himself as a global citizen. That sowed the seeds of a global mindset in me. He was light years ahead of most politicians then and even today. It’s a little sad now; countries are thinking backwards. The recent proposed data localisation and control on data transfer is one such example.

Data is now being touted as the “new oil”, and countries are trying to create trade barriers based on data. Recently, I reviewed the proposed Indian Personal Data Protection Bill 2018 (draft Bill); especially the provisions on data localisation, data transfer, and extra-territorial applicability. In my view, they are excessive when you take into account individual autonomy, the object sought to be achieved and a sustainable digital economy. The Srikrishna Committee, which drafted the report, has itself recognised that India should shape the global digital landscape in the 21st century, and that ensuring protection of personal data and facilitating growth of the digital economy are not in conflict. But the draft Bill works at cross purposes with this thought process.

Extra territorial applicability: The draft Bill makes the law applicable to offshore entities providing goods and services to Indians. The Supreme Court of India has recognised the validity of extra-territorial provisions only when events outside the territory of India have some impact on the interests, welfare or security of India or Indians. In short, there must be a reasonable nexus not just peripheral. In this context, over-prescriptive extra-territorial laws would not fall within this ambit. If for any reason some countries require some protection, international comity requires that it would be preferable to develop a treaty network on the lines of TRIPS, where countries arrive at minimum protection benchmarks. 

Data localisation: I agree that certain critical data may be required to be processed only within India, taking into account security concerns. However, the requirement of the entire set of personal data collected to be mirrored in India sounds excessive. I’m not sure how my shopping history is critical for the security of India unless I am purchasing guns to be brought in to India.

If all countries start mandating localisation, there will be no cloud left.  Further, requiring data centres to be in India could increase costs, especially for users and start-ups. They would stand to lose access to globally available resources and cloud infrastructure. Indian residents would also lose out on unique services being provided by foreign companies, such as DNA analysis or certain kinds of artificial intelligence tasks. Some of those entities may not have the wherewithal to localise their data in India. 

Data transfer: In the case of data transfer from India to abroad, one of the alternatives the draft Bill provides is that the Indian transferor can only use clauses approved by the Data Protection Authority in its data transfer contracts. There will be thousands of legal agreements which will have to be approved. This provision is taking us back to the licence raj. Rather, since the data fiduciary in India is any case liable for violations, it should be left to the data fiduciary to ensure compliance by foreign parties. The DPA may suggest model clauses for the industry, but they need not be made mandatory and require approvals. 

Let us not forget India has been one of the biggest beneficiaries of global data flows, making it the world’s largest destination for IT and outsourcing services. This has had a ripple effect, causing private sector companies to employ millions of people and increasing service exports multi-fold. Global data flows together have raised the world GDP by 10.1 per cent over what may have resulted in a world without any cross-border data flows. If India sets an example of putting artificial barriers on the basis of data, others will reciprocate the same way. 

Over the last several decades, I have witnessed the tussle between businesses wanting to globalise freely and countries trying to impose trade barriers. Everyone recognises the end benefits of minimising barriers, leading to sarvodaya, but most don’t want to suffer the temporary pains of the journey. I hope the draft bill is suitably modified to effectuate the true tenor of the Srikrishna committee report.

The author is founder and managing partner, Nishith Desai Associates