Data localisation is no solution (New data policy 2018)

Excellent study material for all civil services aspirants - begin learning - Kar ke dikhayenge!

Data localisation is no solution (New data policy 2018)

---

Read more on - Polity | Economy | Schemes | S&T | Environment

---

• Calls for data localisation: The Justice Srikrishna Committee in its report alongwith the draft Personal Data Protection Bill says that 8 of the top 10 websites in India are owned by Americans. That makes law enforcement a nightmare, as crime investigation processes become very tedious.
• Store a copy locally for sure: The Bill wants a copy to be kept here, hoping it boosts access for law agencies to speed up investigations. In parallel, the RBI too has been demanding local storage of financial data.
• Is location = access? The question whether Indian law agencies can access data if it is stored in India is not answered by this provision as US law prohibits US firms from sharing user data with foreign law enforcement.
• So how do we get data? Indian authorities rely on an old MLAT (Mutual Legal Assistance Treaty) to request for data from US and then a federal warrant does the rest. Data localisation doesn’t change any of it 
• Localisation will create a claim: The Committee accepts the above weakness, and hopes that a local copy will create a strong claim of Indian authorities.
• Only for Indian citizens: The local data is to be stored only for Indian citizens! So crimes committed in India where both the perpetrator and victim are Indians, can be within its ambit. But transnational crimes may not be. Examples – money laundering, cyber crimes, global terrorism.
• The CLOUD Act: The Clarifying Lawful Overseas Use of Data Act passed by US Congress in 2018 tries to de-monopolise control over data from US authorities. It will allow tech companies to share data directly with other governments. Only condition is an agreement of that Govt. with the US on privacy protections, respect for due process, rule of law etc.
• CrPC Section 91: The Draft Bill should have tackled the S.91 of CrPC of India that allows Police “to access any document or thing”.
• Use the CLOUD Act: India can use this to access data of all kinds, not just of Indians in India. Today, India is the highest user of American technology offerings.   [A matter of shame, not pride!]
• Bill doesn’t give procedural protection to data: It has instead suggested that the Parliament must legislate another comprehensive surveillance reform law.
• Summary : The draft Personal Data Protection Bill has failed to see the big picture in data localisation, and it could have used the CLOUD Act properly.

Read more on - Polity | Economy | Schemes | S&T | Environment

Join UPSC Self Prep course | Online Course (PT Gurukul)  | Covid Special Course | Join PT courses

* Content sourced from free internet sources (publications, PIB site, international sites, etc.). Take your own subscriptions. Copyrights acknowledged.