US, Japan Agree For Cross-Border Data Flow As India Calls For Data Localisation

While India may be focussed on data localisation and the personal data protection bill, but it has found opposition from many high-profile quarters. Adding further pressure on the government is the latest move by the administrations in the US and Japan. Both countries have signed a digital trade agreement, wherein they have renewed their stand against data localisation, and doubled down on the message of free flow of data through internet services .

Through the agreement, the US and Japan have called for increased cross-border data flows to protect innovation and against data localisation, which usually leads to stifled growth for international businesses. According to the agreement, there will be an open access to government data.

With this move, there will be no data localisation requirements on either country’s internet or financial service providers as long as the financial regulatory authorities have access to, for regulatory and supervisory purposes, information stored in servers located outside the country, says a media report.

This brings in freedom for electronic cross-border transfer of data, including user data with no restrictions levied on the same beyond the usual checks and balances to block criminality. Custom duties will not be levied on digital products, including content (e-books, videos, music, software) transmitted electronically.

In regard to consumer protection, the agreement says that countries have to adopt or maintain consumer protection laws to block fraudulent online activities that adversely affect customers. Both countries will have measures so that recipients can prevent getting unsolicited commercial electronic messages, and senders of such messages must seek consent.

Will The Indian Government Change Its Stance?

While the agreement broke new grounds for the US and Japan, it could have an impact on India as well where the government has been stern about data localisation in spite of opposition from all quarters. India Prime Minister Narendra Modi in fact stressed on the importance of data localisation while speaking at the ‘Howdy, Modi’ in the US recently by referring to data as the “new oil” and “new gold.”

The Indian government has taken an uncompromising stand on country’s data sovereignty till now. The draft data protection bill from July 2018 remains under consultation with the central government and the the ministry of electronics and information technology (MeitY).

The bill states that “every data fiduciary shall ensure the storage, on a server or data centre located in India, of at least one serving copy of personal data to which this Act applies”. This means that when it comes to personal data, the master version of the data abroad should have another copy in India.

Ecommerce and social media companies have been showing displeasure over the proposed bill. They had claimed that they might have to change their entire business model to adopt to the new bill. The foreign portfolio investors (FPI) dealing in securities traded in the Bombay Stock Exchange also expressed their displeasure in the new bill recently, since it requires them to keep a copy of financially sensitive ownership-related data, including the details of ultimate beneficiaries and their offshore banking accounts locally.

The proposed law, however, is slowly finding little support from social media giants. “We share and understand the concerns the government has over protecting the privacy and security of citizens. I think it is important. At Google, we have always viewed the privacy and security of our users as a fundamental value, so we understand that. We think there are areas where there may be right things to be done that way, but you have to balance with benefits we all get from a shared internet, which works globally,” said Google CEO Sundar Pichai.

However, with the US taking a stand against data localisation as part of the trade agreement with Japan, it has to be seen the next move from India. Meanwhile, MeitY also had said in August that ecommerce data is community data and hence won’t be governed by the personal data protection bill. It has also been reportedly planning to release a report on the regulation of public data, including data of technology companies such as Uber, Facebook and Amazon.