4 ms·

India wants data residency because it wants to apply its own somewhat unique approach to law enforcement to all digital data — financial and otherwise. This is

India wants data residency because it wants to apply its own somewhat unique approach to law enforcement to all digital data — financial and otherwise. This is a country that switches off mobile data (3G and 4G) at the drop of a hat[1], and switched off an entire state’s mobile Internet access for 18 months[2]. This may appear unnecessary and capricious to some especially in the West. However I’m sure pro-Indian government commenters will say “we’re sovereign, our government can do as it likes as it has a democratic mandate” and that is of course true. And that is, in my view, the driver for India’s interest in data residency. Its laws allow its government an enormous degree of latitude to do what it likes. When it has to access foreign data it is often thwarted by EU or US privacy & legal rules, which it feels is unbecoming of a nation as geopolitically important as India. What I feel about this is that of course India has the sovereign right to do as it pleases, but its messy, adhoc approach to digital governance won’t win it any laurels and will actually tarnish its reputation. Also, it would be on a much better footing if it passed a decent law on digital privacy, which many have been saying is long overdue — leading to a flourishing unregulated economy in selling Indians’ data[3]. [1] https://www.bbc.co.uk/news/world-asia-india-50819905 https://www.bbc.co.uk/news/world-asia-india-50819905 [2] https://techcrunch.com/2021/02/05/india-is-restoring-4g-internet-in-jammu-and-kashmir-after-18-months/ https://techcrunch.com/2021/02/05/india-is-restoring-4g-inte... [3] https://restofworld.org/2020/all-the-data-fit-to-sell/ https://restofworld.org/2020/all-the-data-fit-to-sell/

mdasen 5y ago
To expand on this a bit, if you want leverage over companies like MasterCard, Visa, and American Express, it definitely helps to have the data in your jurisdiction. As you noted, they will shut off mobile internet to support the state. If Visa decides that it doesn't want to give the government data on someone's transactions, it helps to have that data in the country. "Oh, but the data is encrypted." Sure, but the country could literally seize all of the servers and shut down the payment processor. "Hey, American Express, if you don't give us the data we want, we'll simply take your whole payment network offline." It's a lot harder to pressure a payment network when you don't have physical control - especially if that payment network can challenge you in court. It's easy for the government to shut off mobile networks that are physically present. It's harder for the government to stop traffic from routing to a payment processor whose servers are outside of the country - especially if they have a half-decent security/threat team ready to avoid blocks. I don't know the laws of India, but it seems likely that the Executive has a certain amount of discretion that can be challenged. However, it's a lot harder to challenge that discretion if your business is offline for a year while you challenge it. Payment processors need to comply with local laws, but if you're a country where the Executive doesn't mind disrupting services, that gives them a huge amount of leverage to get your compliance beyond local laws. If the data is hosted outside of India, it's a lot easier to to simply comply with the laws rather than the laws plus whatever the Executive thinks they can claim the laws support. Ultimately, if the data is stored within India, the Indian government can be an existential threat to their business in the country beyond what the law allows. A company will hand over data rather than seeing its servers seized for a year while a trial ensues. During that year, they'd lose all their customers to competitors and they'd be shut out of the market. Likewise, what if the government "accidentally" damages the data when they lose the trial? If you have 100M customers in a country and each is carrying a balance of $100, that's $10B that people owe. If the government has seized all those records and then damages them, your business is in a lot of trouble. Data residency gives a government willing to bully companies a lot of power. It's simply a lot harder to access information stored abroad and you have a lot less leverage.
- pankajdoharey 5y ago
  India is fast turning into an Oligarchy where a few have all access. Indian government itself has been involved in selling the data of its citizens to private corporations. https://economictimes.indiatimes.com/industry/auto/auto-news/govt-earned-over-rs-100-crores-by-sharing-vehicle-registration-data-with-private-entities-gadkari/articleshow/80862992.cms https://economictimes.indiatimes.com/industry/auto/auto-news...
- kspacewalk2 5y ago
  Still not really buying the physical control of data argument. If you need to force a company like MC to comply, you can always solve that problem at the point of sale, or (like they're doing right now) stop banks, which are firmly under your jurisdiction, from issuing cards. A company will hand over data rather than be banned from operating in the country, just the same. The amount of leverage you have with data being abroad is approximately the same - you can decree that your financial institutions or businesses are committing a crime when transacting with said company, and that is all.
  - r9 5y ago
    As far as I can tell, there's a fair bit of difference between "decreed a crime" and "we've backed up a truck to the DC, and physically seized your data, do as we say if want it back"
    - kspacewalk2 5y ago
      What is the long- or medium-term difference, to a company like Mastercard? They want to earn profits in India, they have to comply with the Indian government's demands. Case closed.
- KorematsuFred 5y ago
  > Data residency gives a government willing to bully companies a lot of power. It's simply a lot harder to access information stored abroad and you have a lot less leverage. You have no clue how much uncontrolled power Indian government has today. This law is brought in to benefit telecom companies and real estate companies. https://www.business-standard.com/article/companies/hiranandani-group-opens-giant-data-centre-in-mumbai-to-tap-digital-economy-120070701183_1.html https://www.business-standard.com/article/companies/hiranand...
DaiPlusPlus 5y ago
> leading to a flourishing unregulated economy in selling Indians’ data At risk of being incredibly inflammatory - this is the first I've heard of bulk Indian citizens' data being worth enough to harvest in the first place - what's changed?
- signal11 5y ago
  You can see datasets purporting to be, for instance, details about students appearing for various Indian competitive exams for as little as $50-100[1]. Other datasets are costlier, of course. If you're marketing to that demographic (e.g. potential ads for private colleges, or other courses), your budget won't be super high, but you might well spend a little for a bunch of emails of potential leads. [1] https://www.reddit.com/r/india/comments/63s18q/student_data_from_various_competitive_exams_for/ https://www.reddit.com/r/india/comments/63s18q/student_data_...
alienthrowaway 5y ago
> And that is, in my view, the driver for India’s interest in data residency. I thought you were going to go further with that thought. I'm from an African country where the government tried to block social media during protests at DNS level. These efforts were trivially thwarted by using VPNs. The next trick was to cut off the internet entirely - unfortunately for the government, this broke electronic payments and ground the economy to a halt, so the internet blackout lasted a day. I suspect one of the factors is that India wants to be able to cut itself off from the internet without breaking (payment) systems that have data stored offshore.
passivate 5y ago
>What I feel about this is that of course India has the sovereign right to do as it pleases, but its messy, adhoc approach to digital governance won’t win it any laurels and will actually tarnish its reputation. Also, it would be on a much better footing if it passed a decent law on digital privacy, which many have been saying is long overdue — leading to a flourishing unregulated economy in selling Indians’ data[3]. You seem to be on a general critique of Indian policy, and also applying it to this specific case. If we untangle those two for a moment, what exactly is messy, adhoc about this financial data residency requirement? It seems logical to me that local financial data should remain local for legitimate legal reasons (supervision of fraud/criminality being the most obvious ones). Why would this tarnish their reputation?

mdasen 5y ago

To expand on this a bit, if you want leverage over companies like MasterCard, Visa, and American Express, it definitely helps to have the data in your jurisdiction. As you noted, they will shut off mobile internet to support the state. If Visa decides that it doesn't want to give the government data on someone's transactions, it helps to have that data in the country. "Oh, but the data is encrypted." Sure, but the country could literally seize all of the servers and shut down the payment processor. "Hey, American Express, if you don't give us the data we want, we'll simply take your whole payment network offline." It's a lot harder to pressure a payment network when you don't have physical control - especially if that payment network can challenge you in court. It's easy for the government to shut off mobile networks that are physically present. It's harder for the government to stop traffic from routing to a payment processor whose servers are outside of the country - especially if they have a half-decent security/threat team ready to avoid blocks. I don't know the laws of India, but it seems likely that the Executive has a certain amount of discretion that can be challenged. However, it's a lot harder to challenge that discretion if your business is offline for a year while you challenge it. Payment processors need to comply with local laws, but if you're a country where the Executive doesn't mind disrupting services, that gives them a huge amount of leverage to get your compliance beyond local laws. If the data is hosted outside of India, it's a lot easier to to simply comply with the laws rather than the laws plus whatever the Executive thinks they can claim the laws support. Ultimately, if the data is stored within India, the Indian government can be an existential threat to their business in the country beyond what the law allows. A company will hand over data rather than seeing its servers seized for a year while a trial ensues. During that year, they'd lose all their customers to competitors and they'd be shut out of the market. Likewise, what if the government "accidentally" damages the data when they lose the trial? If you have 100M customers in a country and each is carrying a balance of $100, that's $10B that people owe. If the government has seized all those records and then damages them, your business is in a lot of trouble. Data residency gives a government willing to bully companies a lot of power. It's simply a lot harder to access information stored abroad and you have a lot less leverage.

pankajdoharey 5y ago
India is fast turning into an Oligarchy where a few have all access. Indian government itself has been involved in selling the data of its citizens to private corporations. https://economictimes.indiatimes.com/industry/auto/auto-news/govt-earned-over-rs-100-crores-by-sharing-vehicle-registration-data-with-private-entities-gadkari/articleshow/80862992.cms https://economictimes.indiatimes.com/industry/auto/auto-news...
kspacewalk2 5y ago
Still not really buying the physical control of data argument. If you need to force a company like MC to comply, you can always solve that problem at the point of sale, or (like they're doing right now) stop banks, which are firmly under your jurisdiction, from issuing cards. A company will hand over data rather than be banned from operating in the country, just the same. The amount of leverage you have with data being abroad is approximately the same - you can decree that your financial institutions or businesses are committing a crime when transacting with said company, and that is all.
- r9 5y ago
  As far as I can tell, there's a fair bit of difference between "decreed a crime" and "we've backed up a truck to the DC, and physically seized your data, do as we say if want it back"
  - kspacewalk2 5y ago
    What is the long- or medium-term difference, to a company like Mastercard? They want to earn profits in India, they have to comply with the Indian government's demands. Case closed.
KorematsuFred 5y ago
> Data residency gives a government willing to bully companies a lot of power. It's simply a lot harder to access information stored abroad and you have a lot less leverage. You have no clue how much uncontrolled power Indian government has today. This law is brought in to benefit telecom companies and real estate companies. https://www.business-standard.com/article/companies/hiranandani-group-opens-giant-data-centre-in-mumbai-to-tap-digital-economy-120070701183_1.html https://www.business-standard.com/article/companies/hiranand...

DaiPlusPlus 5y ago

> leading to a flourishing unregulated economy in selling Indians’ data At risk of being incredibly inflammatory - this is the first I've heard of bulk Indian citizens' data being worth enough to harvest in the first place - what's changed?

signal11 5y ago
You can see datasets purporting to be, for instance, details about students appearing for various Indian competitive exams for as little as $50-100[1]. Other datasets are costlier, of course. If you're marketing to that demographic (e.g. potential ads for private colleges, or other courses), your budget won't be super high, but you might well spend a little for a bunch of emails of potential leads. [1] https://www.reddit.com/r/india/comments/63s18q/student_data_from_various_competitive_exams_for/ https://www.reddit.com/r/india/comments/63s18q/student_data_...

alienthrowaway 5y ago

> And that is, in my view, the driver for India’s interest in data residency. I thought you were going to go further with that thought. I'm from an African country where the government tried to block social media during protests at DNS level. These efforts were trivially thwarted by using VPNs. The next trick was to cut off the internet entirely - unfortunately for the government, this broke electronic payments and ground the economy to a halt, so the internet blackout lasted a day. I suspect one of the factors is that India wants to be able to cut itself off from the internet without breaking (payment) systems that have data stored offshore.

passivate 5y ago

>What I feel about this is that of course India has the sovereign right to do as it pleases, but its messy, adhoc approach to digital governance won’t win it any laurels and will actually tarnish its reputation. Also, it would be on a much better footing if it passed a decent law on digital privacy, which many have been saying is long overdue — leading to a flourishing unregulated economy in selling Indians’ data[3]. You seem to be on a general critique of Indian policy, and also applying it to this specific case. If we untangle those two for a moment, what exactly is messy, adhoc about this financial data residency requirement? It seems logical to me that local financial data should remain local for legitimate legal reasons (supervision of fraud/criminality being the most obvious ones). Why would this tarnish their reputation?