India to ease data storage rules in relief for Google, Meta

By Bibhudatta Pradhan and Santosh Kumar,

India plans to allow transfer and storing personal data in some countries overseas, in a reprieve for global companies including Alphabet Inc.’s Google, Amazon Inc., and Meta Platforms Inc.’s Facebook.

The government will “notify such countries or territories outside India to which a data fiduciary may transfer personal data,” according to the draft Digital Personal Data Protection Bill unveiled on Friday for public feedback. The long-delayed bill needs the approval of parliament before becoming law. An earlier version of the bill had sought to severely restrict transfer, processing and storage of data overseas.

The key piece of proposed legislation comes as digitisation thrives in the country of 140 crore where usage of smartphones and apps is skyrocketing. Nations around the world are bringing in laws to allow users to control what personal data to share with whom, for what and how long.

Read | Government proposes penalty of up to Rs 500 crore for data breach under Data Protection Bill

The data protection bill has been long in the making after global companies such as Meta and Alphabet as well as local startups said complying with data localization norms specified in an earlier version of the draft would be onerous.

“Companies like Amazon and Facebook can breathe easy now,” said Rahul Matthan, a partner at law firm Trilegal, adding that the latest draft was “nice and simple.”

“It’s data protection on training wheels and India can bring in the changes bit by bit.”

The Digital Personal Data Protection Bill of 2022 requires consent before collecting personal data, and proposes stiff penalties of as much as 5 billion rupees ($61.2 million) on persons and companies that fail to prevent data breaches including accidentally disclosing, sharing, altering or destroying personal data. Companies are allowed to store the collected data for only specified periods.

In August, the government withdrew an earlier version of the bill from parliament saying it will present a new legislation and include changes suggested by the panel of lawmakers that scrutinised it. The parliamentary panel previously recommended changes including treating social media platforms such as Meta as publishers and setting up a watchdog to oversee them.

Privacy is a thorny issue in the world’s biggest democracy, which has seen explosive digital growth with 760 million active Internet users. It took two years for Prime Minister Narendra Modi’s government to come up with data protection legislation after the Supreme Court ruled that privacy is a fundamental individual right. The parliamentary panel missed many deadlines to complete its report as lawmakers were divided on some of the bill’s provisions.

The new draft bill proposes setting up of Data Protection Board of India that will monitor and determine non-compliance and impose penalty. Companies like Amazon and Meta will also be required to appoint data protection officers who will represent them and who will be required to be based in India.

The draft bill also requires companies such as the parent entities of Google and Facebook to be accountable to a “consent manager” to provide an “accessible, transparent and inter operable platform” to give, manage, review and withdraw consent. Personal data of children cannot be obtained or processed without parental consent.

--With assistance from Saritha Rai.