What are the arguments in favor and opposition to the data localization norms?

Data localization refers to the process wherein the personal data of a country’s residents should be processed and stored in that country. RBI has now made data localization mandatory for payment systems.

Even the Justice B N Srikrishna on data protection has suggested that all personal data of Indians have at least one copy in India and a subset of that data, labeled as critical personal data must be stored and processed only in India.

Why there is a need to move forward with the data localization policy?

• Data localization provides for the better monitoring and supervisory access to data stored with the system providers. Officials cite when the spate of lynchings across the country was linked to WhatsApp rumors, WhatsApp firm stance on encrypted content formed an obstacle in controlling the rumors.
• Data localization will aid in developing a strong resilience against the foreign attacks and surveillance.
• Data regulation for privacy and security will have little teeth without localization.
• Localization would lead to a larger presence in India with increased number of local offices, and increase tax liability.
• Data is the new oil. National wealth creation relies on in-house data storage.
• Data localization will also aid in harnessing India’s digital economy.

Arguments of those opposing the data localization policy

• Data localization will hinder the free flow of data across the borders. This may have a domino effect as it may be equated as protectionism. The protectionism may back fire India’s young start ups are attempting global growth, or on larger firms that process foreign data in India.
• Data localization would also give state unhindered power for misuse and surveillance of personal data.
• Security and government access is not achieved by localization. Due to encryption the data may still be out of access of the government agencies. Hence the localization may not serve any purpose.

Strong objections have been raised against the data protection norms of RBI in the US and many European countries. Government has to walk on the tight rope to ensure data localization is not equated to protectionism.