India's Ill-Advised Pursuit of Data Localization
As the second largest digitally oriented country in the world, India should rightfully be competing with the duopoly of the United States and China as a leader in internet-based industries where market size plays a significant role. India, with an impressive resource of knowledge in the technology sphere, should also be pioneering in regulations that balance the demands for innovation, competition, and the protection of individual rights to privacy in the data sphere. But India risks falling short in these areas for reasons that provide a case study of how smart policymakers pursue dubious priorities.
In 2002, only 16 million people in India had access to the internet, compared to 166 million in the United States. By 2022, the number of connected Indians is projected to reach 840 million, more than the sum of internet users in the United States and the European Union. Even then, growth potential will remain vast, with roughly 500 million people still offline.
While confronting this remarkable growth, the government in New Delhi appears to be favoring solutions that combine the acknowledgment of digital rights for citizens, such as the right to privacy, with elements inspired by economic nationalism, including a drive for data localization. The former component is positive both in terms of the values affirmed and the potential economic consequences. The latter risks harming innovation and placing one more obstacle to progress in already-difficult international negotiations on digital trade.
A unique battleground
The Indian digital sector is not merely growing, it is booming. The McKinsey Digital Adoption Index, a composite measure of information and communications technology (ICT) use by individuals, businesses, and governments, nearly doubled between 2014 and 2017—only Indonesia posted a better performance. This creates remarkable opportunities for new employment and creation of wealth. The World Bank recently remarked that public investment in technical universities has been successful in fostering world-class innovation capabilities, although inequality in access to education remains an issue.
India’s potential as an innovator, however, has come up against the wall of US and Chinese dominance. Home-grown companies attuned to local preferences are born every day and are sometimes able to make significant inroads, but they struggle to remain independent. When ecommerce platform Flipkart became large enough to compete with Amazon India, it was acquired by Walmart. Roughly 40 percent of the popular payment app Paytm is owned by Chinese technology giant Alibaba. In social media, domestic offerings fail to catch up with Facebook and TikTok.
The combination of these factors results in strong demand for measures that will keep the abundant fruits of digitalization behind the border. But the effort to protect Indian national identity has been misguided and risks doing more harm than good.
The draft National e-Commerce Policy of February 2019 is eloquently subtitled “India’s Data for India’s Development.” The policy aims to address concerns that are widely shared around the world, such as the excessive market power of technology titans and the need to leverage the potential of data both in the interests of individual data subjects and the public good.
In the wake of the takeovers of Indian startups by outside companies, the Indian government has emphasized sovereignty, stating that “The data of a country […] is best thought of [as] a collective resource, a national asset, that the government holds in trust, but rights to which can be permitted,” making an analogy to natural resources.
This principle translates into prospective restrictions on cross-border transfers of data generated in India on ecommerce platforms, social media outlets, and search engines, or harvested by Internet-of-Things devices installed in public spaces. Some information collected in India may still be stored abroad, but it may not be shared with foreign third parties—such as advertisers—even with the data subject’s consent.
While the draft policy does not give implementation details, it appears to imply the possibility of so-called “hard data localization,” or a requirement to store most data on servers in India, which already applies to financial services. Localization has prominent advocates also outside of public institutions, including one of the people who stand to gain personally from such an approach—business mogul Mukesh Ambani, who chairs the top industrial conglomerate of India.
Localization is described by its supporters as ensuring data security and privacy, while maximizing the economic return from the digital economy for a country’s citizens. But its effectiveness is dubious. When it comes to security, it is not clear why the physical location of data should be a factor. Arguably, leading multinational cloud computing providers adhere to cyber defense standards that most businesses would have trouble replicating on their own servers. Localization laws can either result in higher storage costs with no effects on security, as those same providers remain dominant but must install more capacity in India, or loss of security, as domestic businesses move data back on their own hardware.
Privacy does not depend unconditionally on the location of the data. Jurisdictions that are in the lead in this field, such as the European Union, Canada, and Japan, adopt an extraterritorial digital rights approach whereby data on their citizens can be transferred to countries that guarantee adequate protection. If the government’s actual goal is to prioritize the privacy of Indians over the profit opportunities for non-Indian data collectors, adhering to this model—by reflecting it without adding extra restrictions into the data protection bill that has been in the works for a long time—would be more than enough.
Finally, it is not clear at all that localization is conductive to the growth of the domestic digital ecosystem. It cuts into the revenues of foreign corporations, chiefly by preventing them from pooling data from multiple countries when training artificial intelligence algorithms and by forcing them to limit the geographic scope of services such as content targeting. This approach is unlikely to eliminate barriers to entry in platform-based businesses, an aim that would be served better by antitrust action. It is also unlikely to translate into ordinary internet users being compensated for the value of the data they share with companies.
But what localization certainly accomplishes is giving a country’s government broader access and possibly tighter rein over the data sphere, since information collected in its territory must stay within direct reach of its law enforcement and national security apparatus. Under Prime Minister Narendra Modi, the Indian state has become increasingly intolerant of dissent. If this is what the Indian authorities are shooting for, they should clarify their goals both domestically and at multinational negotiating tables.