Indian Draft Data Protection Bill: Data Localisation Mandate Unnecessary & Harmful, Says EU

The European Union (EU) has expressed reservations about the draft Personal Data Protection bill 2018 that is currently being proposed by the Indian government.

The bill, which calls for data localisation, is being described as India’s very own General Data Protection Regulation (GDPR) — an EU framework of data protection norms that went live in May.

In an online submission to the Ministry of Electronics and Information Technology (MeitY), Bruno Gencarelli, who serves as the head of the International Data Flows and Protection Unit at the European Commission (EC), listed seven detailed reservations about the draft bill. The submission, dated September 29, came a day before MeitY’s deadline for feedback submissions on the bill.

Gencarelli, who has played an important role in the roll out of the GDPR, expressed concern over the provisions in the draft Bill that leave it to the discretion of the central government or the Data Protection Authority (DPA) to decide on key matters rather than dealing with them in the Bill itself, which could create some uncertainties.

The other provision that drew detailed criticism from the EC is one that mandates every data fiduciary (a person, state, company, or any entity that decides why data should be processed and how it should be processed) ensure storage of at least one copy of a user’s personal data on a server or data centre located in India.

He was referring to the costs for companies — in particular, foreign ones – for setting up additional processing/storage facilities in India.

“If implemented, this kind of provision would also likely hinder data transfers… contrary to what is sometimes suggested, India’s striving tech industry does not need this type of forced-localisation measures,” wrote Gencarelli.

Gencarelli also wrote if the draft bill in its current form were to be finalised, it would not only have far-reaching negative consequences for businesses but on politics as well.

Such measures might deter foreign investments in India and would also likely hinder data transfers and complicate the facilitation of commercial exchanges in the context of EU-India bilateral negotiations on a possible free trade agreement, Gencarelli added.

He offered an alternative solution to this provision and acknowledged that the EU too is preparing a legislation to enable law enforcement authorities to obtain (legitimate) access to electronic evidence, irrespective of whether it is stored in the EU or not. – inc42