IT sector this week: Srikrishna Committee recommendations out, draw praise and flak in equal measure

Representative image (Source: Reuters)

The long-awaited data protection recommendations of the Justice Srikrishna Committee were out as a draft bill on Friday, and drew flak and appreciation in near equal measure.

They were lauded for including the right to privacy and sensitive personal data of Indian citizens, and addressing important issues pertaining to how personal and sensitive data is being processed by different entities.

The criticism stems from some issues not being tackled in a more nuanced way.

Take, for example, the penalties for corporates that are not deterrent enough - if an entity violates sensitive personal data, it may be liable to pay up to Rs 15 crore or four percent of its total worldwide turnover.

In case it violates non-sensitive persona data, it may have to pay up to Rs 5 crore or two percent of its total worldwide turnover.

In comparison, the General Data Protection Regulation (GDPR) of the European Union has a provision for a fine of up to 4 percent of worldwide turnover or 20 million euros (about Rs 133 crore), whichever is higher, if an entity fails to disclose a data breach.

The most contentious, however, is probably the call for data localisation, or asking multinational corporations to set up local servers in India.

"Every data fiduciary shall ensure the storage, on a server or data centre located in India, of at least one serving copy of personal data to which this Act applies," the draft bill reads.

The demand has been a long-standing issue between the Indian government and foreign companies in India, especially those that have large user bases, like Facebook, Google, Twitter, Apple, and the like.

A part of the reason why the government insists on local storage is to be able to access data in case of an investigation, or a legal request for user data. Another is data sovereignty.

However, across the world, it has been seen that localising data is bad for business.

"A copy of all personal data is required to be stored in India. As we have argued, data localization is bad for business, users, and security. Notwithstanding the protections on processing in the interest of the security of the state, it’s hard to see that this provision is anything but a proxy for enabling surveillance," Mozilla said about the draft Indian bill.

There was opposition to this demand even from within the committee that has formulated the draft bill.

Rama Vedasree, the CEO of the Data Security Council of India, argued in her dissent note that restricting cross border flows will be detrimental of the economy, startups and the IT-BPM sector.

"This approach is not only regressive but against the fundamental tenets of our liberal economy. Moreover, the inclusion of such restrictions in a bill that should focus primarily on empowering Indians with rights and remedies to uphold their right to privacy, seems out of place," Vedasree said.

She added that the "free flow of data and talent across borders" is the "foundation of the $167 billion IT-BPM industry" in India.

IT-BPM service providers in India process financial, healthcare and other data of citizens and companies in the US, EU, and elsewhere in the world.

"Mandating localization may potentially become a trade barrier and the key markets for the industry could mandate similar barriers on data flow to India, which could disrupt the IT-BPM industry," Vedasree said.

While this is a draft and is likely to go through some more iterations before it becomes law, it is important to consider these very real problems that could have a detrimental impact on our economy and trade.