An unsecured asset

An unsecured asset

India has been lax in treating data as an invaluable national asset, this has to change.

With rapid advances in information and communication technology, data is an asset whose value keeps increasing over time. India, unfortunately, has been lax in thinking about the strategic implications of this asset. Consequently, use of data is subjected to a loose and fragmented regulatory architecture which has cost us in terms of potential economic benefits. In an attempt to change the state of play, Modi government last year set up a committee of experts under the leadership of BN Srikrishna to frame principles which will form the basis of legislation on data protection.

The most recent milestone in the growing body of data protection regulation is the European Union General Data Protection Regulation (GDPR). Two aspects of it are relevant in the Indian context. One, there is a strong emphasis on data localisation – requiring certain customer data to remain within the borders of a particular region or country. Two, companies that do not have a direct relationship with EU but support firms with customers there are subject to the regulations. It is an example of yet another jurisdiction acknowledging the strategic importance of data and, thereby, striving to keep control over its usage. This principle should be the foundation of data protection legislation in India.

Indian legislation needs to be in sync with emerging global practices. This makes it essential to keep privacy – now recognised as intrinsic to the right to life and liberty – at the heart of the planned law. The law’s aim will not be confined to securing personal data but will include striving to enhance economic opportunities in India on account of increasing digitalisation. Data serves as a fungible asset for many strands of economic activities. To nurture and grow these activities there should be clear guidelines for data localisation in the planned legislation.

A Srikrishna committee white paper has looked at different dimensions of data localisation. While there is no doubt about its need, the tricky part is deciding how far to go. Localisation does have upfront costs for businesses. In addition, any law on data protection must preserve the economic gains accruing on account of the ITES/ BPO industry. The law, therefore, must tread a fine line between minimising upfront costs and promoting India’s strategic and economic interests. As the looming trade war between the US and China proves, economic powerhouses use all tools to protect their assets and interests. So should India.