13 ms·

India bans MasterCard from adding new customers

215 points by Garbage 5y ago

kyrra 5y ago
FYI, American Express and Diners Club have already been banned from adding new customers in India due to the same thing. https://www.reuters.com/article/india-banking-american-express-idINKBN2CA26T https://www.reuters.com/article/india-banking-american-expre...
- vishnugupta 5y ago
  > the subscriptions are now required to be paid monthly by people I have a bunch of subscriptions (App Store, JetBrains, AWS etc.,) which continue to seamlessly go through without me having to explicitly authorise each month. I suspect there is a fine print/subtext to that subscriptions rule that isn't accessible to public.
  - kyrra 5y ago
    Sorry, I deleted that part of the comment as it didn't apply to this topic at hand. Multiple companies have dropped subscription support in india or changed things due to the recent RBI rules around mandates. https://gadgets.ndtv.com/apps/news/amazon-prime-membership-one-month-subscription-cancel-free-trial-discontinue-rbi-mandate-2442183 https://gadgets.ndtv.com/apps/news/amazon-prime-membership-o... https://help.ads.microsoft.com/#apex/ads/en/52003/3 https://help.ads.microsoft.com/#apex/ads/en/52003/3 EDIT: Another useful one: https://support.google.com/pay/india/answer/10710851?hl=en https://support.google.com/pay/india/answer/10710851?hl=en It looks like existing subscriptions were grandfathered until Sept 30, which is why you haven't seen a change. But new accounts cannot use subscriptions until the company has properly implemented e-mandates.
    - vishnugupta 5y ago
      You are right in that I haven’t seen any Indian merchants offer subscriptions anymore. And yes that e-mandate, I believe that UX is not ideal so there’s not much adoption. E-Mandates were launched as part of UPI 2.0 but there are hardly any merchant offering them. I wonder what’s holding them back besides bad UX. But I have a gut feeling that international merchants are exempted from this rule. Because I can go to JetBrains even now and subscribe to their products.
- r-w 5y ago
  Third paragraph from the bottom in the post you're literally commenting on :)
bserge 5y ago
Is this hard to implement for MasterCard? Otherwise, it seems reasonable to me, but I'm not that knowledgeable in this area.
- kyrra 5y ago
  Yes, it is. You either need to entirely fork your operation to have it operate entirely within India, or be extremely careful with how you store your data, and store the data only in India, but process it in other data centers without ever having it touched disk. Which I believed means you can never even log the data.
  - ntrz 5y ago
    The rule[0] says that you can process the data abroad, including storing it on disk temporarily for purposes of processing, as long as it is deleted within 24 hours. So it's not quite as strict as requiring it be kept in memory the whole time without ever writing to disk, but it does sound like you probably couldn't keep detailed logs. [0] https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id=2995 https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id...
    - KineticLensman 5y ago
      > but it does sound like you probably couldn't keep detailed logs. Or backups.
      - toomuchtodo 5y ago
        Backups for India can be kept in India. It is a big country.
  - BitwiseFool 5y ago
    As difficult as this will be to implement, I suspect it will be a boon for the Indian IT industry. I suspect MasterCard and others will comply with the new law in due time simply because the Indian market is so vast and full of revenue potential.
sudhirj 5y ago
I can't make out if these rules are specific to India. Doesn't the EU have the same data residency rules as well? Why are Mastercard and Amex struggling with this?
- ntrz 5y ago
  The Indian rule seems to require all data be stored strictly inside India, without any of it being stored outside the country. The EU permits data to be transferred outside the EU under a number of circumstances: e.g. if the other country has equivalent data protection laws, if the non-EU company you're transferring the data to has promised to abide by the EU rules, stuff like that. Take this with a grain of salt, of course, because I'm not a lawyer, but that's how I understand it.
  - rjzzleep 5y ago
    Actually the European courts struck down Privacy Shield. So any company transferring data to the US is doing it illegally. Plenty of active lawsuits against google. But as much as HN likes to bash google, people here are pretty submissive when one is asking for advice on legal options against these companies. https://www.bbc.com/news/technology-53418898 https://www.bbc.com/news/technology-53418898
    - ntrz 5y ago
      As far as I know it's still possible to transfer data from the EU to the US under the GDPR if the companies involved have signed a ``standard contractual clause''[0] (the article says this was also a target of the Privacy Shield suit but the courts chose to continue to allow it). [0] https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en https://ec.europa.eu/info/law/law-topic/data-protection/inte...
      - johncolanduoni 5y ago
        Right, which Google[1], Amazon[2], and Microsoft[3] even offer to third parties on their cloud platforms. That ruling was mostly just a quibbling about the legal particulars, it didn’t change anything on the ground. [1]: https://support.google.com/adspolicy/answer/10042247?hl=en https://support.google.com/adspolicy/answer/10042247?hl=en [2]: https://aws.amazon.com/blogs/security/customer-update-aws-and-the-eu-us-privacy-shield/ https://aws.amazon.com/blogs/security/customer-update-aws-an... [3]: https://docs.microsoft.com/en-us/compliance/regulatory/offering-eu-model-clauses https://docs.microsoft.com/en-us/compliance/regulatory/offer...
ntrz 5y ago
So, the reason is that the entirety of the customer data must be stored locally in India, rather than on a server located elsewhere[0]? Does anyone know why the rule in India is so much stricter than the equivalent GDPR rule[1], which allows transfer of data outside the EU in various circumstances (basically if it's assured that it won't lead to the data being subject to much laxer standards of protection)? According to the article, the banks are saying the reason it's much stricter than the equivalent EU data residency requirements is to ensure the Indian government can spy on customer data. Is there a more reasonable, less malicious reason they may have written the requirements this way? [0] https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id=2995 https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id... [1] https://gdpr.eu/article-44-transfer-of-personal-data/ https://gdpr.eu/article-44-transfer-of-personal-data/
- frabcus 5y ago
  If I was running a large country, I'd want transactions to be entirely local for national security reasons. Generally, in the event of a world war, I wouldn't want it to be trivial for other countries to remotely cut off my whole economy.
  - ntrz 5y ago
    From the text of the rule: > There is no bar on processing of payment transactions outside India if so desired by the PSOs. However, the data shall be stored only in India after the processing. The complete end-to-end transaction details should be part of the data. So this only applies to the customer data, not the actual systems that do the transaction processing and verification. The systems that actually do the work could still be cut off from India, leaving them with nothing but a database of customer transactions.
  - seunosewa 5y ago
    How about just avoiding wars? Global interdependence of countries is beneficial for this reason. Also, India's military is no match for and unlikely to have any reason to fight the external countries where MasterCard's data is likely to be stored (US, UK, etc).
obiwanpallav1 5y ago
What are/was the effects of GDPR in EU? Also, did it lead to a huge increase in the spendings for MasterCard?
- mtmail 5y ago
  I'd imagine a bigger loss for MasterCard was the EU capping their interchange fees to 0.3% with a regulation in 2015. "At present, credit card interchange fees in the UK are typically around 0.85% per transaction" (https://www.theguardian.com/money/2015/jul/27/cap-on-card-fees-retailers https://www.theguardian.com/money/2015/jul/27/cap-on-card-fe...). After Brexit MasterCard will increase it to 1.5% (https://www.theguardian.com/money/2021/jan/25/mastercard-to-raise-fees-to-eu-firms-by-500-percent-for-online-sales-to-uk-shoppers https://www.theguardian.com/money/2021/jan/25/mastercard-to-...) Loosing out on 0.55% fee on every transaction is significant at MasterCard's scale.
  - IshKebab 5y ago
    I agree that will have a bigger effect, and boo Brexit. But it's actually only transactions on EU shops by UK cards that face higher fees, which is a really small percentage of purchases. Definitely not every transaction. I'm sure they'll raise the other fees later though. Probably just dipping their toes.
    - toomuchtodo 5y ago
      Even more reason to accelerate instant payment system rollouts to avoid private payment systems that charge interchange fees.
      - IshKebab 5y ago
        What instant payment systems? Are there actually viable competitors to Visa/MasterCard?
        toomuchtodo 5y ago
hnbad 5y ago
I find it interesting that the card companies are concerned storing the data in India could allow the government access to it when the data apparently currently resides in the US. Either they're doing something with the data in the US that prevents the US from accessing it the way India could or they're just accepting the US being able to access it as a given and don't see why Indian customers wouldn't want that.
debacle 5y ago
It is good to see India growing as a world power as the largest democracy in the world.
- pavs 5y ago
  They have been "growing" and "becoming" the next world leader for a while now. Anyone who have lived in india long enough will tell you how far from the truth this is. The only Stick India has, besides their nuclear arsenal, is the size of their domestic market (aka population). I dont think the purchasing power of their domestic market is that lucrative compare to actual superpowers (Economic or Military). Buy just large enough for International companies to bother to invest. The whole political platform for Modi is religious fanaticism, nationalosm and jingoism. Any sane, rational Indian leader would not be so Anti international investment. (I am not only talking about the incident mentioned in this article, but generally speaking). If you can look past the billionaires and the prosperous cities of India (however few), it eirily feels like the whole country is for most part still stuck in the 80s. Most people tout india as the largest democracy with diverse relious population. The reality on the ground could not have been farther from truth. In reality the country feels like its always in the state of experiment by their political leaders, competing with each other to find the best way to fuck things up without actually blowing up the country. Yet.
  - addicted 5y ago
    To be fair, there was a strong bull case to be made for India till the early 2010s, especially in how well it recovered from the financial crisis. The problem is that Modi has brought an insane blend of pre liberalization economic policy, centralized authoritarian control, and british inspired religion based divide and conquer policies that have set India back a couple of generations at least, possibly permanently if he remains in power and continues down this path.
  - eklavya 5y ago
    Yeah Modi is pretty anti international investment, just look here since he got into power FDI has dropped in India by almost -100% https://www.macrotrends.net/countries/IND/india/foreign-direct-investment https://www.macrotrends.net/countries/IND/india/foreign-dire... Also all the PLI schemes for companies are pretty anti international investment, so companies from Samsung to Apple are all investing big.
asaddhamani 5y ago
Data from Indian transactions should be stored and ideally even processed in India. This seems fair and reasonable to me.
- zohch 5y ago
  What makes it fair and reasonable and does whatever rationale you use here not open up the door to further nativism? I mean if it is fair and reasonable that Indian transactions should be stored and processed in India, is it not also fair and reasonable that goods sold in India should be made in India, that movies that show in India should be made in India, that all news consumed in India should be written in India? I get these are not the same, but what is the real difference here? Where does it become unreasonable in my examples and why?
  - herbst 5y ago
    There is a huge difference to your other examples. The US does not actually have a good track record with protecting their customers with proper privacy laws.
    - thayne 5y ago
      I'm not sure what that has to do with this. There could be laws requiring that the data be kept secure and private without specifying that it has to be kept in a certain location. Besides which, India doesn't have a good track record of protecting privacy either.
      - herbst 5y ago
        True, but if it's not hosted under your own control it basically is fully out of your control. Doesn't the US gov / the 3 letter agencies basically have access to everything hosted within the US? Sure there are other ways, but India seems to like to go for the most radical solutions at times
        5y ago
kspacewalk2 5y ago
The obsession with where data physically sits at rest is so amusing to me. Not limited to overzealous governments and financial data; healthcare is singularly obsessed with this. It makes no sense whatsoever, of course. I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. I would understand if they demanded both storage and processing be done in India. Then it's just about control, and the ability to sever MC's India operations from the mother ship in case things go really sour and the US tries to cut India off from the global financial system or something. But since it's just about data at rest, it's nonsensical. Or am I missing something?
- phoe-krk 5y ago
  > I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. What do you mean by "properly encrypted"? MasterCard is not going to let you be the sole holder of your encryption keys. And if you aren't holding them, then they they hold it, and then they must be holding in at least one given country. And that country has the power to force them to turn these keys over. The power to do this is the goal of this game.
  - kspacewalk2 5y ago
    That country already has the power to force them to turn these keys over (or use the keys to decrypt data of interest). Every non-tax-haven country which regulates its financial sector does (so, every country). It's unclear what is added by forcing them to store data locally.
    - phoe-krk 5y ago
      In most cases you can't easily tell that company to hand over data that is held in another country though.
- ko27 5y ago
  > I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country That encryption is pointlesss. North Korea can just demand the key and decrypt your data (assuming the company has presence in that country). Very few services have true end to end encryption. Currently it's not even feasible for healthcare data (homomorphic encryption is not practical yet).
redandblack 5y ago
The regulations on this has been in play for a while - I remember discussions in fall 2019 on this on asks by indian regulators to all multinational banks, payment processors, etc. The push to segregate local data within national boundaries needs to be addressed soon. Local data meaning transactions between 2 parties within the same country
nazrulmum10 5y ago
The South Asian market’s central bank said the new restrictions will go into effect on July 22
bloniac 5y ago
All the tech people in this thread arguing how it makes no difference technically where the data resides etc etc. really guys can you not think further than that? It’s simple and obvious the Indian government is exercising total control over its affairs. Naming technical distinctions completely misses the point. This is not a technical issue and has zero to do with tech. It’s political.
- lou1306 5y ago
  Data residency absolutely makes a difference, and I find it stunning that people don't see it. Ok, so you decide to store your nation's sensitive data in another country, $nation. If things get awry, there is a (pretty remote) risk that $nation will break your encryption. But there's also a much less remote risk that $nation will simply block all connections from your country and prevent you from accessing your own data. How do you deal with such a threat?
  - draw_down 5y ago
    Agreed, it’s also also just such an arrogant attitude to take. People are so steeped in a globalized worldview that they’re unable to appreciate that not everyone considers themselves a “citizen of the world”, and that geopolitics actually do exist.
IG_Semmelweiss 5y ago
we have known for some time since well before the Tiktok ban in the US, that the world wide web was heading to the fractured web. It started with china. The moment the world accepted their firewall conditions, it was the moment that we said we are OK with letting you earn the benefits of the web, without the cost of openness. Open countries could set a marker on this issue. Either you are open or your are not. And if you aren't , you will be dooned to rot in your protectionist web. We didnt set the marker, so here we are.
- eunos 5y ago
  I argue that Snowden's disclosure accelerated the trends.
rowland66 5y ago
There has been alot of innovation in digital payments in India over the last 10 years. There are a number of local alternatives to traditional card brands. This might be a combination of protectionism to support local payment alternatives, and international card network unwillingness to invest in India given declining market share.
whall6 5y ago
Same thing happened to Amex
ramshanker 5y ago
Let us not forget, rules were formulated in 2018. Planned to be implemented by Dec 2018. Companies kept requesting extension of deadline. Finally RBI had enough. They have been given substantial time. At this point, non-compliance simply means un-willingness. Whether for political or technical reason. It is not a surprise-everyone move. Indian central bank is following consistent long term policy. I feel overall it is good.
fukd 5y ago
Netbanking and UPI is so popular here. I last used debit card about 3 years ago. I do not think its not even concern if MC is entirely banned
darth_avocado 5y ago
It is really interesting that there's even a debate over this. US and EU have long had similar policies in the name of "national interest" or "protecting the consumers", but if other countries have similar policies, it suddenly becomes a negative thing. I think the hard reality of it is data needs to be localized, to ensure companies comply with local laws. Every country has independent authority on how they want to run things, and whether it turns out to be good or bad, companies need to follow them.
- throw998877123 5y ago
  It would have been okay if the country had a good privacy protection law. And a not-so-broken justice system. The legal system wears you out starting right from the troubles of filing a police report (when needed). Having worked with the govt, they are pretty lame on security and high on convoluted regulations and harassment. The rules are applied selectively. As a fact, the govt (unintentionally) leaks the citizen's data and then they absolutely deny and cover up stuff. And there is zero accountability. Their departments regularly access stuff without proper authorisation and then store/move it insecurely elsewhere.
  - darth_avocado 5y ago
    But data localization means the data is in a specific country, but the ownership still remains with the company. And I understand that the judicial systems can be flawed in different countries, but as a company, if you want to do business in a country, you still need to follow the law. To give you an example, companies operate in China, despite not having great labor laws or environmental protection laws, or the threat of facing the govt.'s wrath any moment. That's because they want to do business in that country. It's the same with any company or country.
lazyninja987 5y ago
MC & Amex are so small, nobody cares. Its probably the reason why they did not even bother to implement the new guidelines.
yawaworht1978 5y ago
I don't see the problem. When in Rome... It will create job in India. The government doesn't allow multinational companies to get away with having all the market access and data control while evading taxes.
naruvimama 5y ago
Let us imagine a scenario where Mastercard holds EU or US citizens data in China or Russia and refuses to move it to EU/US. If it is a bit hard to digest, perhaps one needs to extend the same respect to India's sovereignty.
- 8note 5y ago
  Generally HN thinks highly of that, and will never visit the EU so they don't have to face punishments for GDPR violations
  - decadancer 5y ago
    How real are these laws at all, by the way? Is it really a case when one company has to store their data separately and (inaccessible from other places). What do these laws enforce, networking-wise only?
- draw_down 5y ago
  “One”? MC likely hasn’t done this because it’s kind of a huge undertaking. I say this only as explanation, not as an excuse. India warned firms of this years ago so there is no excuse. It doesn’t really have anything to do with respect.
beezischillin 5y ago
This is just a few thoughts I came up with while reading this, they might not be completely accurate and are probably very sloppy but here goes... In the grand scheme of things these news are kind of interesting to read. I see multiple ways to characterise these events but it's a bit tough to because the only words I'm able to use kind of project a moral judgement onto the sides which I do not intend to make because history will have to be the judge of that. Needless to say, though, that I assume extreme selfishness from all sides as a given. With that said, you could say that this a fight between: - freedom and authoritarianism /banning things -or- giving people the freedom to trade by allowing foreign companies to pave the way/, - globalism and nationalism /promoting the interests of the local government -vs- a foreign one/ - or simply a battle of political interests. Probably a strange mix of all of the above, in reality.. I have a hard time figuring out who to root for, though, as these western multi-nationals can act pretty maliciously, too. And so do governments that turn authoritarian. I'd kinda prefer neither with the freedoms of all myself, but I am being unrealistic, sadly.
naruvimama 5y ago
Banking is highly regulated, AFAIK the government even gets to audit you server deployment and security measures. Nothing but yet another American company that would like India to behave like a colony.
vxNsr 5y ago
India’s been on a tear lately, first sci-hub, then Twitter now this… seems they’re growing up.
deleted 5y ago
[deleted]
guacathrowaway 5y ago
I am with mastercard on this one. Either they were asked to pay bribe and refused, which is good, or they genuinely care about their customers. In corrupt countries, such as India, politicians and local law “enforcement” love to get their hands in the pockets of honest and hard working people. And what easier way is there than having a card that provides details of the money you have in your pocket.
- fukd 5y ago
  India has better financial system than USA/Europe. so they are not afraid to kick the monsters out of the country. Next is Visa

215 points by Garbage 5y ago

FYI, American Express and Diners Club have already been banned from adding new customers in India due to the same thing. https://www.reuters.com/article/india-banking-american-express-idINKBN2CA26T https://www.reuters.com/article/india-banking-american-expre...

vishnugupta 5y ago
> the subscriptions are now required to be paid monthly by people I have a bunch of subscriptions (App Store, JetBrains, AWS etc.,) which continue to seamlessly go through without me having to explicitly authorise each month. I suspect there is a fine print/subtext to that subscriptions rule that isn't accessible to public.
- kyrra 5y ago
  Sorry, I deleted that part of the comment as it didn't apply to this topic at hand. Multiple companies have dropped subscription support in india or changed things due to the recent RBI rules around mandates. https://gadgets.ndtv.com/apps/news/amazon-prime-membership-one-month-subscription-cancel-free-trial-discontinue-rbi-mandate-2442183 https://gadgets.ndtv.com/apps/news/amazon-prime-membership-o... https://help.ads.microsoft.com/#apex/ads/en/52003/3 https://help.ads.microsoft.com/#apex/ads/en/52003/3 EDIT: Another useful one: https://support.google.com/pay/india/answer/10710851?hl=en https://support.google.com/pay/india/answer/10710851?hl=en It looks like existing subscriptions were grandfathered until Sept 30, which is why you haven't seen a change. But new accounts cannot use subscriptions until the company has properly implemented e-mandates.
  - vishnugupta 5y ago
    You are right in that I haven’t seen any Indian merchants offer subscriptions anymore. And yes that e-mandate, I believe that UX is not ideal so there’s not much adoption. E-Mandates were launched as part of UPI 2.0 but there are hardly any merchant offering them. I wonder what’s holding them back besides bad UX. But I have a gut feeling that international merchants are exempted from this rule. Because I can go to JetBrains even now and subscribe to their products.
r-w 5y ago
Third paragraph from the bottom in the post you're literally commenting on :)

bserge 5y ago

Is this hard to implement for MasterCard? Otherwise, it seems reasonable to me, but I'm not that knowledgeable in this area.

kyrra 5y ago
Yes, it is. You either need to entirely fork your operation to have it operate entirely within India, or be extremely careful with how you store your data, and store the data only in India, but process it in other data centers without ever having it touched disk. Which I believed means you can never even log the data.
- ntrz 5y ago
  The rule[0] says that you can process the data abroad, including storing it on disk temporarily for purposes of processing, as long as it is deleted within 24 hours. So it's not quite as strict as requiring it be kept in memory the whole time without ever writing to disk, but it does sound like you probably couldn't keep detailed logs. [0] https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id=2995 https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id...
  - KineticLensman 5y ago
    > but it does sound like you probably couldn't keep detailed logs. Or backups.
    - toomuchtodo 5y ago
      Backups for India can be kept in India. It is a big country.
- BitwiseFool 5y ago
  As difficult as this will be to implement, I suspect it will be a boon for the Indian IT industry. I suspect MasterCard and others will comply with the new law in due time simply because the Indian market is so vast and full of revenue potential.

sudhirj 5y ago

I can't make out if these rules are specific to India. Doesn't the EU have the same data residency rules as well? Why are Mastercard and Amex struggling with this?

ntrz 5y ago
The Indian rule seems to require all data be stored strictly inside India, without any of it being stored outside the country. The EU permits data to be transferred outside the EU under a number of circumstances: e.g. if the other country has equivalent data protection laws, if the non-EU company you're transferring the data to has promised to abide by the EU rules, stuff like that. Take this with a grain of salt, of course, because I'm not a lawyer, but that's how I understand it.
- rjzzleep 5y ago
  Actually the European courts struck down Privacy Shield. So any company transferring data to the US is doing it illegally. Plenty of active lawsuits against google. But as much as HN likes to bash google, people here are pretty submissive when one is asking for advice on legal options against these companies. https://www.bbc.com/news/technology-53418898 https://www.bbc.com/news/technology-53418898
  - ntrz 5y ago
    As far as I know it's still possible to transfer data from the EU to the US under the GDPR if the companies involved have signed a ``standard contractual clause''[0] (the article says this was also a target of the Privacy Shield suit but the courts chose to continue to allow it). [0] https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en https://ec.europa.eu/info/law/law-topic/data-protection/inte...
    - johncolanduoni 5y ago
      Right, which Google[1], Amazon[2], and Microsoft[3] even offer to third parties on their cloud platforms. That ruling was mostly just a quibbling about the legal particulars, it didn’t change anything on the ground. [1]: https://support.google.com/adspolicy/answer/10042247?hl=en https://support.google.com/adspolicy/answer/10042247?hl=en [2]: https://aws.amazon.com/blogs/security/customer-update-aws-and-the-eu-us-privacy-shield/ https://aws.amazon.com/blogs/security/customer-update-aws-an... [3]: https://docs.microsoft.com/en-us/compliance/regulatory/offering-eu-model-clauses https://docs.microsoft.com/en-us/compliance/regulatory/offer...

ntrz 5y ago

So, the reason is that the entirety of the customer data must be stored locally in India, rather than on a server located elsewhere[0]? Does anyone know why the rule in India is so much stricter than the equivalent GDPR rule[1], which allows transfer of data outside the EU in various circumstances (basically if it's assured that it won't lead to the data being subject to much laxer standards of protection)? According to the article, the banks are saying the reason it's much stricter than the equivalent EU data residency requirements is to ensure the Indian government can spy on customer data. Is there a more reasonable, less malicious reason they may have written the requirements this way? [0] https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id=2995 https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id... [1] https://gdpr.eu/article-44-transfer-of-personal-data/ https://gdpr.eu/article-44-transfer-of-personal-data/

frabcus 5y ago
If I was running a large country, I'd want transactions to be entirely local for national security reasons. Generally, in the event of a world war, I wouldn't want it to be trivial for other countries to remotely cut off my whole economy.
- ntrz 5y ago
  From the text of the rule: > There is no bar on processing of payment transactions outside India if so desired by the PSOs. However, the data shall be stored only in India after the processing. The complete end-to-end transaction details should be part of the data. So this only applies to the customer data, not the actual systems that do the transaction processing and verification. The systems that actually do the work could still be cut off from India, leaving them with nothing but a database of customer transactions.
- seunosewa 5y ago
  How about just avoiding wars? Global interdependence of countries is beneficial for this reason. Also, India's military is no match for and unlikely to have any reason to fight the external countries where MasterCard's data is likely to be stored (US, UK, etc).

obiwanpallav1 5y ago

What are/was the effects of GDPR in EU? Also, did it lead to a huge increase in the spendings for MasterCard?

mtmail 5y ago
I'd imagine a bigger loss for MasterCard was the EU capping their interchange fees to 0.3% with a regulation in 2015. "At present, credit card interchange fees in the UK are typically around 0.85% per transaction" (https://www.theguardian.com/money/2015/jul/27/cap-on-card-fees-retailers https://www.theguardian.com/money/2015/jul/27/cap-on-card-fe...). After Brexit MasterCard will increase it to 1.5% (https://www.theguardian.com/money/2021/jan/25/mastercard-to-raise-fees-to-eu-firms-by-500-percent-for-online-sales-to-uk-shoppers https://www.theguardian.com/money/2021/jan/25/mastercard-to-...) Loosing out on 0.55% fee on every transaction is significant at MasterCard's scale.
- IshKebab 5y ago
  I agree that will have a bigger effect, and boo Brexit. But it's actually only transactions on EU shops by UK cards that face higher fees, which is a really small percentage of purchases. Definitely not every transaction. I'm sure they'll raise the other fees later though. Probably just dipping their toes.
  - toomuchtodo 5y ago
    Even more reason to accelerate instant payment system rollouts to avoid private payment systems that charge interchange fees.
    - IshKebab 5y ago
      What instant payment systems? Are there actually viable competitors to Visa/MasterCard?
      - toomuchtodo 5y ago

hnbad 5y ago

I find it interesting that the card companies are concerned storing the data in India could allow the government access to it when the data apparently currently resides in the US. Either they're doing something with the data in the US that prevents the US from accessing it the way India could or they're just accepting the US being able to access it as a given and don't see why Indian customers wouldn't want that.

debacle 5y ago

It is good to see India growing as a world power as the largest democracy in the world.

pavs 5y ago
They have been "growing" and "becoming" the next world leader for a while now. Anyone who have lived in india long enough will tell you how far from the truth this is. The only Stick India has, besides their nuclear arsenal, is the size of their domestic market (aka population). I dont think the purchasing power of their domestic market is that lucrative compare to actual superpowers (Economic or Military). Buy just large enough for International companies to bother to invest. The whole political platform for Modi is religious fanaticism, nationalosm and jingoism. Any sane, rational Indian leader would not be so Anti international investment. (I am not only talking about the incident mentioned in this article, but generally speaking). If you can look past the billionaires and the prosperous cities of India (however few), it eirily feels like the whole country is for most part still stuck in the 80s. Most people tout india as the largest democracy with diverse relious population. The reality on the ground could not have been farther from truth. In reality the country feels like its always in the state of experiment by their political leaders, competing with each other to find the best way to fuck things up without actually blowing up the country. Yet.
- addicted 5y ago
  To be fair, there was a strong bull case to be made for India till the early 2010s, especially in how well it recovered from the financial crisis. The problem is that Modi has brought an insane blend of pre liberalization economic policy, centralized authoritarian control, and british inspired religion based divide and conquer policies that have set India back a couple of generations at least, possibly permanently if he remains in power and continues down this path.
- eklavya 5y ago
  Yeah Modi is pretty anti international investment, just look here since he got into power FDI has dropped in India by almost -100% https://www.macrotrends.net/countries/IND/india/foreign-direct-investment https://www.macrotrends.net/countries/IND/india/foreign-dire... Also all the PLI schemes for companies are pretty anti international investment, so companies from Samsung to Apple are all investing big.

asaddhamani 5y ago

Data from Indian transactions should be stored and ideally even processed in India. This seems fair and reasonable to me.

zohch 5y ago
What makes it fair and reasonable and does whatever rationale you use here not open up the door to further nativism? I mean if it is fair and reasonable that Indian transactions should be stored and processed in India, is it not also fair and reasonable that goods sold in India should be made in India, that movies that show in India should be made in India, that all news consumed in India should be written in India? I get these are not the same, but what is the real difference here? Where does it become unreasonable in my examples and why?
- herbst 5y ago
  There is a huge difference to your other examples. The US does not actually have a good track record with protecting their customers with proper privacy laws.
  - thayne 5y ago
    I'm not sure what that has to do with this. There could be laws requiring that the data be kept secure and private without specifying that it has to be kept in a certain location. Besides which, India doesn't have a good track record of protecting privacy either.
    - herbst 5y ago
      True, but if it's not hosted under your own control it basically is fully out of your control. Doesn't the US gov / the 3 letter agencies basically have access to everything hosted within the US? Sure there are other ways, but India seems to like to go for the most radical solutions at times
      - 5y ago

kspacewalk2 5y ago

The obsession with where data physically sits at rest is so amusing to me. Not limited to overzealous governments and financial data; healthcare is singularly obsessed with this. It makes no sense whatsoever, of course. I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. I would understand if they demanded both storage and processing be done in India. Then it's just about control, and the ability to sever MC's India operations from the mother ship in case things go really sour and the US tries to cut India off from the global financial system or something. But since it's just about data at rest, it's nonsensical. Or am I missing something?

phoe-krk 5y ago
> I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. What do you mean by "properly encrypted"? MasterCard is not going to let you be the sole holder of your encryption keys. And if you aren't holding them, then they they hold it, and then they must be holding in at least one given country. And that country has the power to force them to turn these keys over. The power to do this is the goal of this game.
- kspacewalk2 5y ago
  That country already has the power to force them to turn these keys over (or use the keys to decrypt data of interest). Every non-tax-haven country which regulates its financial sector does (so, every country). It's unclear what is added by forcing them to store data locally.
  - phoe-krk 5y ago
    In most cases you can't easily tell that company to hand over data that is held in another country though.
ko27 5y ago
> I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country That encryption is pointlesss. North Korea can just demand the key and decrypt your data (assuming the company has presence in that country). Very few services have true end to end encryption. Currently it's not even feasible for healthcare data (homomorphic encryption is not practical yet).

redandblack 5y ago

The regulations on this has been in play for a while - I remember discussions in fall 2019 on this on asks by indian regulators to all multinational banks, payment processors, etc. The push to segregate local data within national boundaries needs to be addressed soon. Local data meaning transactions between 2 parties within the same country

nazrulmum10 5y ago

The South Asian market’s central bank said the new restrictions will go into effect on July 22

bloniac 5y ago

All the tech people in this thread arguing how it makes no difference technically where the data resides etc etc. really guys can you not think further than that? It’s simple and obvious the Indian government is exercising total control over its affairs. Naming technical distinctions completely misses the point. This is not a technical issue and has zero to do with tech. It’s political.

lou1306 5y ago
Data residency absolutely makes a difference, and I find it stunning that people don't see it. Ok, so you decide to store your nation's sensitive data in another country, $nation. If things get awry, there is a (pretty remote) risk that $nation will break your encryption. But there's also a much less remote risk that $nation will simply block all connections from your country and prevent you from accessing your own data. How do you deal with such a threat?
- draw_down 5y ago
  Agreed, it’s also also just such an arrogant attitude to take. People are so steeped in a globalized worldview that they’re unable to appreciate that not everyone considers themselves a “citizen of the world”, and that geopolitics actually do exist.

IG_Semmelweiss 5y ago

we have known for some time since well before the Tiktok ban in the US, that the world wide web was heading to the fractured web. It started with china. The moment the world accepted their firewall conditions, it was the moment that we said we are OK with letting you earn the benefits of the web, without the cost of openness. Open countries could set a marker on this issue. Either you are open or your are not. And if you aren't , you will be dooned to rot in your protectionist web. We didnt set the marker, so here we are.

eunos 5y ago
I argue that Snowden's disclosure accelerated the trends.

rowland66 5y ago

There has been alot of innovation in digital payments in India over the last 10 years. There are a number of local alternatives to traditional card brands. This might be a combination of protectionism to support local payment alternatives, and international card network unwillingness to invest in India given declining market share.

whall6 5y ago

Same thing happened to Amex

ramshanker 5y ago

Let us not forget, rules were formulated in 2018. Planned to be implemented by Dec 2018. Companies kept requesting extension of deadline. Finally RBI had enough. They have been given substantial time. At this point, non-compliance simply means un-willingness. Whether for political or technical reason. It is not a surprise-everyone move. Indian central bank is following consistent long term policy. I feel overall it is good.

fukd 5y ago

Netbanking and UPI is so popular here. I last used debit card about 3 years ago. I do not think its not even concern if MC is entirely banned

darth_avocado 5y ago

It is really interesting that there's even a debate over this. US and EU have long had similar policies in the name of "national interest" or "protecting the consumers", but if other countries have similar policies, it suddenly becomes a negative thing. I think the hard reality of it is data needs to be localized, to ensure companies comply with local laws. Every country has independent authority on how they want to run things, and whether it turns out to be good or bad, companies need to follow them.

throw998877123 5y ago
It would have been okay if the country had a good privacy protection law. And a not-so-broken justice system. The legal system wears you out starting right from the troubles of filing a police report (when needed). Having worked with the govt, they are pretty lame on security and high on convoluted regulations and harassment. The rules are applied selectively. As a fact, the govt (unintentionally) leaks the citizen's data and then they absolutely deny and cover up stuff. And there is zero accountability. Their departments regularly access stuff without proper authorisation and then store/move it insecurely elsewhere.
- darth_avocado 5y ago
  But data localization means the data is in a specific country, but the ownership still remains with the company. And I understand that the judicial systems can be flawed in different countries, but as a company, if you want to do business in a country, you still need to follow the law. To give you an example, companies operate in China, despite not having great labor laws or environmental protection laws, or the threat of facing the govt.'s wrath any moment. That's because they want to do business in that country. It's the same with any company or country.

lazyninja987 5y ago

MC & Amex are so small, nobody cares. Its probably the reason why they did not even bother to implement the new guidelines.

yawaworht1978 5y ago

I don't see the problem. When in Rome... It will create job in India. The government doesn't allow multinational companies to get away with having all the market access and data control while evading taxes.

naruvimama 5y ago

Let us imagine a scenario where Mastercard holds EU or US citizens data in China or Russia and refuses to move it to EU/US. If it is a bit hard to digest, perhaps one needs to extend the same respect to India's sovereignty.

8note 5y ago
Generally HN thinks highly of that, and will never visit the EU so they don't have to face punishments for GDPR violations
- decadancer 5y ago
  How real are these laws at all, by the way? Is it really a case when one company has to store their data separately and (inaccessible from other places). What do these laws enforce, networking-wise only?
draw_down 5y ago
“One”? MC likely hasn’t done this because it’s kind of a huge undertaking. I say this only as explanation, not as an excuse. India warned firms of this years ago so there is no excuse. It doesn’t really have anything to do with respect.

beezischillin 5y ago

This is just a few thoughts I came up with while reading this, they might not be completely accurate and are probably very sloppy but here goes... In the grand scheme of things these news are kind of interesting to read. I see multiple ways to characterise these events but it's a bit tough to because the only words I'm able to use kind of project a moral judgement onto the sides which I do not intend to make because history will have to be the judge of that. Needless to say, though, that I assume extreme selfishness from all sides as a given. With that said, you could say that this a fight between: - freedom and authoritarianism /banning things -or- giving people the freedom to trade by allowing foreign companies to pave the way/, - globalism and nationalism /promoting the interests of the local government -vs- a foreign one/ - or simply a battle of political interests. Probably a strange mix of all of the above, in reality.. I have a hard time figuring out who to root for, though, as these western multi-nationals can act pretty maliciously, too. And so do governments that turn authoritarian. I'd kinda prefer neither with the freedoms of all myself, but I am being unrealistic, sadly.

naruvimama 5y ago

Banking is highly regulated, AFAIK the government even gets to audit you server deployment and security measures. Nothing but yet another American company that would like India to behave like a colony.

vxNsr 5y ago

India’s been on a tear lately, first sci-hub, then Twitter now this… seems they’re growing up.

deleted 5y ago

[deleted]

guacathrowaway 5y ago

I am with mastercard on this one. Either they were asked to pay bribe and refused, which is good, or they genuinely care about their customers. In corrupt countries, such as India, politicians and local law “enforcement” love to get their hands in the pockets of honest and hard working people. And what easier way is there than having a card that provides details of the money you have in your pocket.

fukd 5y ago
India has better financial system than USA/Europe. so they are not afraid to kick the monsters out of the country. Next is Visa