white_paper_on_data_protection_in_india_171127_final_v2

encryption keys to government authorities. CII while not explicitly defined, is understood to
mean public communication and information services. Further, network operators or
providers of network products which violate Article 37, will be ordered by the relevant
departments to correct their actions. In the event that they fail to comply with these
instructions, then the departments can issue warnings, confiscate illegal income and impose
penalties. They can also suspend business operations, shut down websites and revoke
business certificates or licenses.
Australia
In Australia, the Personally Controlled Electronic Health Records Act, 2012 provides that
where a system operator, a registered repository operator, or a registered contracted service
provider holds the health records of an individual, or has access to such records, then such
records cannot be taken outside Australia. The system operator is not permitted to process, or
allow such information to be processed, outside Australia. The system operator is also not
permitted to allow another person to hold the records, or take records outside Australia, or to
process information relating to the records outside Australia. 379
Canada
In Canada, the PIPEDA does not contain any data localisation requirements. However,
provincial law in Nova Scotia (Personal Information International Disclosure Protection Act,
2006) requires that personal information created by public institutions (such as government
agencies, schools and hospitals) be stored on servers located within Canada. 380
Vietnam
In Vietnam, the Decree on Management, Provision, and Use of Internet Services and
Information Content Online 381 (Decree 72) requires a range of Internet service providers to
maintain within Vietnam, a copy of any information they hold in order to facilitate the
inspection of information by authorities, specifically providing that organisations and
enterprises must have at least one server system in Vietnam serving the inspection, storage,
and provision of information at the request of competent authorities. 382 Decree 72 applies to
general websites, social networks, mobile networks, and game service providers. 383
Indonesia
379 Section 77, Personally Controlled Electronic Health Records Act, 2012.
380 Section 5, Personal Information International Disclosure Protection Act, 2006.
381 Decree on the management, provision and use of Internet services and online information (No. 72/2013/ND-
CP).
382 Article 24(2), Decree on Management, Provision and Use of Internet Services and Online Information (No.
72/2013), available at https://vnnic.vn/sites/default/files/vanban/Decree%20No72-2013-ND-CP.PDF, (last
accessed 17 November 2017).
383 Article 25(8) (social networks), Article 28(2) (mobile networks), Art. 34(2) (game service providers) of the
Decree on Management, Provision and Use of Internet Services and Online Information (No. 72/2013), available
at http://www.moit.gov.vn/Images/FileVanBan/_ND72-2013-CPEng.pdf, (last accessed 20 November 2017).
74