white_paper_on_data_protection_in_india_171127_final_v2

CHAPTER 9 : DATA LOCALISATION
9.1 Introduction
Data localisation requires companies to store and process data on servers physically located
within national borders. Governments across the globe driven by concerns over privacy,
security, surveillance and law enforcement have been enacting legislations that necessitate
localisation of data. A nation has the prerogative to take measures to protect its interests and
its sovereignty, but it must carefully evaluate the advantages and dangers of locally storing
data before taking a firm decision on an issue has the potential to cause a major ripple effect
across a number of industries.
9.2 Issues
(i)
Protecting Rights of Data Subjects
Enacting a data localisation law may help in ensuring the protection of the rights of data
subjects in some circumstances. For instance in the Microsoft case, it was held that US‘s
Stored Communications Act cannot be applied extraterritorially, and can only be applied to
data which is actually stored in the country. 359 This case referred to whether the government,
by way of a warrant issued under the Stored Communications Act could request Microsoft to
access and produce emails of a customer whose data was stored on a server in Ireland. 360
(ii)
Preventing Foreign Surveillance
One of the primary reasons for enacting a data localisation law is to prevent foreign
surveillance. It is grounded in the belief that placing data abroad would allow foreign
governments to impinge upon the privacy and security of the data of domestic nationals. 361
This has led to some countries attempting to keep data from leaving their shores, in order to
protect it from falling into the hands of other governments. 362 While, a data localisation
mandate may be effective in reducing foreign surveillance as data will be stored locally, such
a mandate may increase the risk of local surveillance by law enforcement agencies.
(iii) Easy Access of Data in Support of Law Enforcement and National Security
Currently, jurisdictional claims against foreign entities are enforced through Mutual Legal
Assistance Treaties. 363 The presence of personal information in the territory of a country
359 Microsoft Corporation v. United States of America, No. 14-2985 (2d Cir. 2016).
360 Microsoft Corporation v. United States of America, No. 14-2985 (2d Cir. 2016).
361
Jonah Force Hill, ‗The Growth Of Data Localization Post-Snowden: Analysis And Recommendations For
U.S. Policymakers And Business Leaders‘, The Hague Institute for Global Justice, Conference on the Future of
Cyber Governance 2014, 5 (1 May 2014) as cited in Erica Fraser, ‗Data Localisation and the Balkanisation of
the Internet‘, 13(3) SCRIPTed 359 (December 2016).
362
Anupam Chander and Uyên P. Lê, ‗Breaking the Web: Data Localisation vs. the Global Internet‘ UC Davis
Legal Studies Research Paper No. 378, (April 2014).
363 Andrew Keane Woods, ‗Against Data Exceptionalism‘, 68(4) Stanford Law Review 729, 748 (April 2016).
69