Reconsider data localisation requirement, remove criminal penalties in proposed law: IAMAI

The Internet and Mobile Association of India (IAMAI) has sought reconsideration of most of the key points in the proposed data protection bill, including rules on data localisation, and demands removal of criminal penalties.

A report, released by the IAMAI on Wednesday, said it has observed a conflict between the Ministry of Communications and the Ministry of Electronics and IT based on a set of recommendations by telecom regulator Trai and suggested that cloud service providers should be the government through the IT ministry.

Expressing concern over data localisation norms, the report, authored by Ikigai Law, said all legislative and policy developments on data governance in the country thus far have advocated the storage of personal data on servers located in India.

"However, there are a number of concerns with operationalising data localisation. First, the storage of all the country's critical data within India runs the risk of creating a 'honeypot' of such data, which is vulnerable to cyberattacks, foreign surveillance and other threats," said the report, titled 'Digital Technology Policy for India's USD 5 Trillion Economy.

The IAMAI-Ikigai report cited a study by the European Centre for International Political Economy which found that economy-wide data localisation laws drain between 0.7 per cent and 1.1 per cent of the gross domestic product from the economy for no benefit.

The report demands removal of proposed criminal penalties for data breach under the Personal Data Protection Bill (PDP Bill).

Offences under the Bill are punishable with criminal penalties that include imprisonment of up to 5 years.

"Such penalties are excessively harsh and disproportionate, particularly since the civil penalties themselves function as effective deterrents against data breaches and other violations of the PDP Bill," the report said.

It said the criminal penalties would disincentivise small- and medium-sized enterprises from participating in the digital economy