SHARE >>>  
/// PUBLICATIONS
Indian Flag

India’s ‘Data Sovereignty’ problematic for EU

By Antti Tulonen

2 March 2020

India’s Prime Minister Narendra Modi visits Brussels on 13 March to discuss expanding relations between the two largest democratic blocs in the world. The two sides will sign agreements on the environment, security and with Euratom. They will also agree to establish a high level economic and trade dialogue that could pave the way for a resumption of the stalled FTA talks. This will also be the first summit involving the new EU leadership and both sides will showcase it as an affirmation that the EU and India are two staunch pillars of the multilateral system.

Modi’s visit will be portrayed as a success but there are a couple of problematic issues that will need careful handling. The first is India’s new citizenship law that has sparked serious violence in Delhi and elsewhere. The law was criticised in the European Parliament but will not feature directly on the summit agenda.

The second is India’s proposed data protection bill. When presented to the Indian parliament, the EU had little to complain about as it was modelled largely on the EU’s General Data Protection Regulation (GDPR). This would have led the EU to issue an adequacy decision for India, which would allow for the free flow of data between two (sub) continents.

But the parliament has now included so-called data localization provisions to its draft law. In their current form, data localization rules require that any sensitive (as defined by the Indian government) including personal data of Indians must be held on servers in India. Therefore, any European company looking to offer full service to Indians would have to set-up or rent data centres in India, essentially duplicating their infrastructure. This would be required regardless of the quality of their security in Europe. With this built-in lack of reciprocity the EU is unlikely to grant India an adequacy decision. Indeed, the EU stated to the parliament that the data localization requirements “are both unnecessary and potentially harmful as they would create unnecessary costs, difficulties and uncertainties that could hamper business and investments.”

There is clearly an element of protectionism here. The chair of Reliance Industries has called on the government to shelter the digital sector from international competition allowing it to nurture its own tech companies. Many foreign companies, mostly from the US, have come to dominate the Indian digital market and currently benefit from the personal data of Indian citizens they have amassed. However, no studies have appeared to show that data localization would have the effect the Indian government desires and studies show there could be annual loss of 0,37% of GDP growth, or more as digitization of the economy continues.

With the economic case for data localization shaky at best, the India’s policy should be understood in the context of ‘data sovereignty’. Nominally data sovereignty would mean Indian data controlled by Indians for the benefit of Indians. But the draft bill exempts government agencies from its requirements and provides an explicit unrestricted access to personal data held by private entities for government agencies. Some NGOs believe that India’s policy appears to be following in the footstep of Russia, which has had data localization laws in force since 2016 to ensure access to its citizens data for its law enforcement and intelligence agencies. The prominence of national security concerns on a data protection bill is seen by civil society as part of a worrying trend to increase State control at the expense of civil rights in the world’s largest democracy. Civil society has already criticised the new country wide surveillance network using AI-driven facial recognition technology; and the Unlawful Activities (Prevention) Act (UAPA) to empower government security agencies to designate individuals as terrorists without a due process. The use of UAPA to target human right defenders, journalists and government critics reported by Human Rights Watch has raised further concerns in India and abroad.

The Indian government may want to talk trade, digital or otherwise, with the EU, but it might find that its domestic policies will increasingly have repercussions on such discussions. Modi’s BJP party rose to power in part on promises of economic progress – it remains to be seen how he can fulfil those promises if the governments other policies start to undermine them.