Data Localisation: Google, Et Al, Need To Search For The Word ‘Sovereignty’

Google, which can, in a jiffy, find almost anything for us, should maybe do a search for the word “sovereignty”. And share the results with the US Chamber of Commerce, the US-India Business Council, the Japanese Electronics and Information Technology Association and Digital Europe, among other industry bodies.

The various meanings that one gets with this Google search are the following: “supreme power or authority”, the “authority of a state to govern itself or another state”, and “a self-governing state”.

When we last checked, India was a sovereign state, capable and entitled to govern itself and its citizens. Google, Apple, et al, are not sovereign states, even if they think they are, and though they do rule over our lives in ways we could not have imagined earlier.

The above entities have sent a letter to the Union Minister for Electronics and IT, Ravi Shankar Prasad, seeking exemption from a proposed law that will force them to house the data of their Indian customers in servers in India. They want India’s market and customers, but not the laws that govern them. Since these associations are essentially batting for the likes of Google, Apple, Microsoft, Canon, Fujitsu, Uber and Nokia, who are their members, one can be sure that these tech giants are behind this pressure tactic.

Unless these global companies and industry associations plan to locate their global data centres in Indian embassies or consulates – which are inviolable sovereign spaces based in various countries, and hence immune to intrusions and scrutiny by other states – they are essentially demanding that India curtail its own sovereignty and those of its courts.

According to a report in The Economic Times (4 October), the companies and associations mentioned above have told Prasad that “data localisation requirements in the draft (Bill) will have significant negative effects on the ability of companies to do business in India, do not serve to further privacy protection, and are likely to undermine the security of Indian citizens’ data.”

This is bunkum. While it is true that housing data servers in India is no guarantee against leaks, in the context of the huge data breaches at Facebook, where 50 million users’ data could have been potentially compromised, it is a joke to pretend that keeping Indian data in India is somehow riskier from the point of view of data security. If a security breach were to happen in India, users would at least have recourse to Indian courts. But this is doubtful if the breach happens abroad, and the one invading the servers is Uncle Sam himself. Indians then have almost no remedy, for this data is often clandestinely shared with the US government, as Apple and Google have been known to do in the past.

Sovereignty means Indian courts having the last word, and not Uncle Sam. Sovereignty also means India deciding who not to share the Indian data with.

The letter to Prasad also makes another dubious claim. “We believe that once India develops strong privacy protections through a data privacy law with legal conditions for cross-border transfers — such as globally recognised transfer mechanisms like standard contractual clause — then data do not need to be localised.”

Well, Sirs, thank you for this gratuitous suggestion. But your argument does not mean you can keep our data where you want to. India needs strong data protection and privacy laws for its own sake, and to protect its own citizens. They have nothing to do with where the data must be stored.

If you are going to make money from Indian consumers and their data, surely the least you can do is invest in keeping the data here and create the related jobs and security infrastructure.

Access to data based on the orders of Indian courts cannot be subject to the limitations of “globally recognised transfer mechanisms like standard contractual clause”; it has to be unconditional compliance with Indian laws.

The absence of a local presence often also allows global companies doing business here to claim they are not taxable here. Locating their servers here will end this ambiguity for sure.

Again, it is about sovereignty.

The tech giants who are resisting the Indian government efforts to localise data need to be told a simple thing. India cannot be bullied into toeing their line. It is not in our national or citizens’ interest.