Thread by @internetfreedom

#DataProtectionTop10
Part 6 of our series on the Personal Data Protection Bill focuses on data localisation. What happens to the Internet's open nature? How does the Government decide which data is restricted? How is your privacy affected? A thread. 1/n
internetfreedom.in/dataprotection…

There are two kinds of personal data with location restrictions:
a. sensitive
b. critical
As per Clause 33, when sensitive personal data is transferred outside India with explicit consent, a copy of such data shall continue to be stored in India. This is data mirroring.
2/n

However, critical personal data is strictly localised, and may be stored and processed only in India. It may be transferred only for prompt actions, or if the Central Govt. decides at its discretion that it doesn't affect State security and strategic interests (Clause 34). 3/n

The issue: 'critical personal data' isn't clearly defined. As per the Srikrishna Committee, it will include all kinds of data integral to the economy and State functioning. It may include health, transport, Govt. services, etc. even surpassing the scope of personal data. 4/n

Not only would this deter foreign companies from servicing India, it would disallow Indian start-ups from using foreign cloud storage services. This hampers innovation and for very overbroad concerns of 'foreign surveillance.' Ironically, domestic surveillance is our concern. 5/n

Further, data localisation in a few centres across India instead of scattering data storage globally leads to a greater risk of cyber attacks on this data. Just like putting all our eggs in one basket! 6/n
script-ed.org/article/data-l…

We recommend that our data protection law should incorporate a protection framework, like Japan. India should abandon the data sovereignty approach, so as to ensure the free flow of data and protection of user rights. Read our blog post for detailed suggestions! 7/n