Regulation of Cross-Border Flow of Data under India's Proposed Data Protection Law
[Sibasish is a student at National Law University, Odisha.]
If data is the new oil of the world economy, trade is the vehicle it needs to provide impetus to. National restrictions that impede companies from sharing data across borders affect their ability to operate in the overseas market. In view of supporting cross-border trade, several countries are now seeking to balance the policies regarding cross border flow of personal data along with their erstwhile beliefs in data localization. In doing so they need to assuage the security and privacy risks that come with it. Digital trade clauses in foreign trade agreements (FTAs) are increasingly being considered as a tool to reduce friction caused by domestic regulations of cross-border data flows. Thus, a comprehensive data protection law will have rippling effects on the country's domestic as well as international trade. Through this blog, the author analyses the provisions regarding the cross-border transfer of data in the draft Digital Personal Data Protection Bill 2022 (Draft Bill) released by the Ministry of Electronics and Information Technology, Government of India.
Data Localization under the Draft Bill
Localization of personal data or personally identifiable information has been deemed necessary as its movement can raise concerns around privacy. It can also meet different regulatory objectives, help develop domestic capacity in digital intensive sectors and relate to national security, some of it is sensitive. The Draft Bill has relaxed provisions regarding data localization and moved away from hard data localization, as was seen under the now repealed Personal Data Protection Bill of 2019 (Repealed Bill). The Draft Bill seeks to promote cross-border transfer of data by a data fiduciary, in accordance with the prescribed conditions, to such countries or territories outside India as the Central Government may notify upon due assessment.
The data localization provisions in the Repealed Bill had also invited significant inputs from foreign technology companies and the US and the European governments, aside from the Indian start-ups. Some policies such as the National Data Sharing and Accessibility Policies of 2012 advocate the physical storage of data within the borders of India. Though such hard policies may not be appreciated now considering the rising significance of data flow vis-à-vis trade, the Draft Bill’s failure to address data localization must be balanced with the need for increased cross-border trade and data security.
Cross-Border Flow of Data vis-à-vis Trade
In this evolving world of the internet and the AI, cross-border flow of data and trade agreements go hand in hand. Data itself being an asset enables the coordination of various international policies through global value chains, and global markets and promotes the trade of goods and services at a low cost. There has been no multilateral consensus on the same but several discussions are paving the way for the bigger picture. This effect of data flow on trade, however, raises various security and privacy concerns among nations. These concerns have, as a result, led several countries to enforce combative measures.
India, in February 2022, signed a comprehensive economic partnership agreement with the United Arab Emirates for the regulations concerning data protection to be in line with international standards. India has also negotiated FTAs with SAARC, Singapore, Japan, and South Korea, which deal with data protection. While the FTAs with Japan and Singapore have clauses specifying the ‘non-restriction on free flow and transfer of personal data’, the FTAs with South Korea and SAARC discuss privacy and protection of personal data as a general exception to the rules on provision of services. There have been talks about India and the European Union also entering into a broad-based trade and investment agreement since 2007. Considering the context of trade, India must continue to frame comprehensive policies regarding cross-border flow of data that can contribute to trade and boost the economy.
JPC Report and the Draft Bill
The Draft Bill, in compliance with one of the suggestions of the Joint Parliamentary Committee report on the Repealed Bill (JPC Report), provides that personal data can be processed without the permission of the Central Government, outside the territory of India according to any contract entered into with any person outside the territory of India, enforcing any legal right, claim, judicial or quasi-judicial function, provided they are not against public order among other things such as the interests of sovereignty, integrity, security of the state, etc.
The Way Forward
With India engaging in FTAs, the government not only needs to have a liberal view regarding data localization as has been welcomed in the Draft Bill but also should regulate cross-border flow of data with adequate safeguards.
Experts have lauded the conciseness and simplicity of the Draft Bill. Though the Draft Bill has shown a drift from the EU's General Data Protection Regulation (GDPR), some of the provisions that it can inculcate is that of the binding corporate rules under Article 47 of the GDPR, which enable all future intra-group transfers with territories, once approval from the relevant authority is obtained. There can also be in place standard contractual clauses that provide sufficient safeguards for the transfers. The JPC Report had also recommended approval of each contract for data transfer to be done on a model basis by the authority.
At an international level, developing consensus-based regulations muddled with stringent adequacy policies is rather intrinsic to cross border flow of data. The role of the government when it comes to cross-border data flow involves prioritizing the digitalization of trade, along with the protection of privacy of the citizens. India has a say in bilateral arrangements wherein the most optimum and efficient route can be chosen without compromising the sectoral regulations or industrialization goals. The Draft Bill forges a path through which India can derive benefits from trade agreements by retaining its aspirations of data industrialization and obtain benefits from cross-border flow of data as well.