Data protectionism

India's data belongs to its people, not to Indian companies

Speaking at the Vibrant Gujarat summit in Ahmedabad, the chairman of Reliance Industries Limited, Mukesh Ambani, drew attention to questions about the ownership of personal data that will be an important subject for regulators going forward. Mr Ambani argued that “data is the new oil in the new world order” and that “data is the new wealth”. Therefore, “India’s data must be controlled and owned by Indian people — and not by corporations, especially global corporations”. Mr Ambani is correct on the assumptions embedded here, and he needs to be congratulated for repeatedly raising the issue of data ownership as central to the future growth trajectory of India. However, there are also questions that are raised by Mr Ambani’s formulation, especially in the context of recent regulatory and policy moves in India. 

Mr Ambani — who also controls Jio, which has disrupted the telecommunications and data sector in India — is not wrong when he says that “India’s data must be controlled and owned by India’s people” rather than by corporations. However, it might be seen as somewhat self-serving for him to draw a line between global and Indian corporations in terms of policy here. That cannot and should not be seen as a basis for the drawing up of consumer-focused policy on data ownership. Once data ownership rights are assigned to individual Indians, it should be left up to them how they further dispose of what is, after all, their property. If they get a better “price” or services from a non-Indian company, then they should be able to re-assign rights to them, subject to certain national security limitations. This is, after all, a basic free trade principle applied to this domain. It will, as in other domains, ensure that consumers get the highest possible utility while ensuring that competitive forces are given full play. The alternative would be to create a group of privileged Indian corporations that are insulated from competition, and thus can take advantage of consumers. This digital ‘Bombay Club’ argument cannot be allowed to stand. 

The context of this discussion is important to note. Several recent flash points to do with data localisation have emerged between companies and regulators. The Reserve Bank of India last year ordered payments systems to store all their data locally for “better monitoring” by the RBI. This was a poorly considered move, as it would increase the cost of payments architecture— and, incidentally, reduce privacy of Indian citizens. Worse, a government-appointed committee has demanded that not just payments, but all data centres for companies serving Indian citizens be located within the physical borders of India; a similar rule might be applied to e-commerce companies. All of this erects unacceptable barriers to trade and harms consumers in the name of protecting Indian data. Indian consumers should be the focus of such regulation, not Indian companies or Indian bureaucrats. The government and regulators should thus consider the principles that Mr Ambani upholds, but not implement them in such a way that only Indian companies benefit.