Data localisations claims first victims - RBI bans foreign card companies

RBI is strictly enforcing data localisation norms, forcing some card firms to shut new business in India.

 Data localisations claims first victims - RBI bans foreign card companies

---

• The story: Who will hold the data of users of financial services, and where, is the billion dollar question for sovereign states. While India had no specific data localisation norms earlier, it brought is a slew of new rules a few years ago. Foreign firms (social media, data centres, financial services etc.) were asked to comply, and keep all data inside India only. Naturally, there was resistance.
• July 2021 update: The RBI has so far barred three foreign card payment network companies [Mastercard, American Express and Diners Club] from taking new customers on board, over the issue of storing data in India. These had not built the requisite infrastructure so far in India, citing cost and logistics issues.
• What do restrictions entail: The RBI imposed restrictions on Mastercard Asia Pacific Pte Ltd., which is now kept from onboarding new domestic customers (debit, credit or prepaid) in India. The RBI cited as reason the non-compliance with guidelines for storage of data in India, and said it had given almost 3 years for Mastercard to comply with the regulatory directions. The RBI had imposed restrictions on American Express Banking Corp and Diners Club International Ltd, over the same issue earlier. Existing customers using credit or debit cards of these firms can continue using the same, but banks and non-banking finance companies planning to use these payment networks will now not be able to use these platforms to enrol new customers. That is a big shock.
• Only players left: This now leaves only Visa Inc and homegrown NPCI’s RuPay as payment providers under no restrictions, currently. They can expect a surge in business!
• Data localisation guidelines: Funds transferred using debit or credit cards are routed through platforms such as Mastercard, Visa and NPCI, which operate under the Payment and Settlement Systems (PSS) Act, 2007. Under it, the RBI is the authority for the regulation and supervision of payment systems in India. As part of this came the RBI circular on Storage of Payment System Data, dated April 6, 2018.

1. These guidelines on data storage were to be adhered to within 6 months. All system providers were to ensure that the entire data relating to payment systems operated by them is stored in a system only in India.
2. It applied to full end-to-end transaction details, information collected or carried or processed as part of the message or payment instruction. They were also required to report on their compliance to the RBI.
3. They should also submit a board-approved system audit report conducted by a CERT-In empanelled auditor within the timelines specified. [CERT-In - Indian Computer Emergency Response Team, is a government-mandated information technology (IT) security organization.]

• Logic: Data access for law enforcement purposes has for long been a challenge, so this will ensure effective law enforcement. In the wake of the rising use of digital transactions, the RBI is particular that the payment systems need closer monitoring.
• Compliance problems: Credit and card firms with global operations have been resisting the RBI move, citing as reasons the costs, security risk, lack of clarity, and timeline. The RBI had stipulated that data should be stored only in India, and no copy [or mirroring] should be stored in other countries. But payment firms like Visa and Mastercard currently store and process Indian transactions outside the country, due to centralised systems. They expressed the fear that transferring the data storage to India will cost them millions of dollars. Once it happens in India, there is a possibility of similar demand from other countries also.
• Alternatives: Possibly, hard localisation may impact India’s payments ecosystem. India may need to move beyond the slow and ineffective MLAT (Mutual Legal Assistance Treaty), and to a system based on bilateral treaties on data transfers with the EU, UK and the US. This will ensure that Indian law enforcement requirements of access to data are met in a timely manner. It will also allow data flows to foster innovation and trade in the tech ecosystem. But the RBI is against the suggestion that a copy of data stored outside be brought to India.

Join PT courses | PT Youtube | PT App | Contribute |  Testimonials