Skip to main content

Legal Capsule: Data Privacy & Protection: Analysing Srikrishna Committee Report against India’s WTO Obligations by Economic Laws Practice

Coinciding with the widespread global debate on data protection laws and citizens' privacy rights, a report titled "A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians" ("Report") authored by a Committee of Experts under the chairmanship of Justice B.N. Srikrishna, and the Personal Data Protection Bill of 2018 ("Draft Bill") were submitted to the Government of India ("GOI") on 27 July 2018. The Draft Bill is quite comprehensive in its scope and places stringent obligations on businesses. In particular, it provides for measures relating to protecting the personal information of Indian citizens, the role and duties of data fiduciaries and data processors, rights of individuals, and penalties for violation of these data protection measures. 

This note does not touch upon the general impact of the data protection under the Draft Bill on cross-border data flow and thereby impact on international trade and e-commerce. Rather, the note aims to test the provisions of the Draft Bill against India's obligations under the World Trade Organisation ("WTO"). Specifically, the Draft Bill places certain restrictions on the cross-border flow of personal data: 
  • Section 40(1) introduces requirements for storing a copy of all personal data generated through servers and data centres in India within India
  • Section 40(2) prohibits the cross-border flow of certain types of personal data which are to be categories as "critical personal data" by the Central Government per its discretion
Possible inconsistencies with WTO Rules

Generally speaking, the data localization requirements and prohibition on cross-border flow of critical personal data may be argued to be inconsistent with India's obligations under the WTO.Measures that regulate cross-border flows of personal data attract the provisions of the General Agreement on Trade in Services ("GATS"), which governs international trade in services. Obstructions to the flow of personal data across borders may have direct implications on Mode 1 (cross-border services) and Mode 2 (consumption abroad). These restrictions and/or prohibitions in the cross-border flow of data: (i) may run afoul India’s market access commitments, and (ii) could violate the national treatment requirements set out under the GATS since foreign service suppliers may be provided less favourable treatment compared to domestic service providers. 
  • Market access: Article XVI of the GATS provides that, inter alia, where a country has made market access commitments in its GATS schedule, then that country is prohibited from imposing limitations, through any means, on the number of service suppliers, unless the country has included such limitation in its GATS schedule. Section 40 (1) and Section 40 (2) of the Draft Bill could violate the market access commitments made by India in its GATS schedule. This is because these "measures" in the context of any supply of services provided in India could, in effect, limit the number of suppliers of that service in the Indian market. In other words, these provisions of the Draft Bill could limit access of foreign firms to India’s market by conditioning market access upon the local storage and processing of data. Such measures have the effect of restricting or prohibiting flow of cross-border services supply since they would require foreign firms to, inter alia, replicate data storage infrastructure which adds costs for additional data management and compliance requirements. However, this analysis has to be made on a case-wise basis after assessing the commitments made by India under the relevant service sector.   
  • National treatment: The national treatment rule under the GATS applies to all sectors where specific commitments have been undertaken. These commitments prohibit WTO members such as India from discriminating in favour of their domestic companies. Specifically, Article XVII of the GATS makes an obligation on countries to accord services and service suppliers of other countries “treatment no less favourable than that it accords to its own like services and services suppliers.” Article XVII:2 of the GATS specifies that a country may accord foreign services or service suppliers different treatment to achieve this objective. Article XVII:3 of the GATS defines treatment as “less favourable” if it “modifies the conditions of competition in favour of services or service suppliers of the Member.”

    The national treatment obligation may come in the way of the data localization requirements under the Draft Bill. For instance, data localization requires foreign suppliers to duplicate infrastructure and support-service in local markets. As a result, it could be argued that the foreign service suppliers are accorded less favourable treatment than the domestic service suppliers. Notably, even if the same conditions of localization apply to national suppliers of like services or are “formally identical”, it may be argued that they are still designed in a manner to alter the conditions in favour of like domestic service suppliers since they may not have to incur additional costs in replicating the infrastructure and support-service costs.  Therefore, the possibility that such measures are viewed as “less favourable” under Article XVII of the GATS exists. 

    Again, this analysis has to be made on a case-wise basis after assessing the commitments made by India under the relevant service sector. For example, data localization requirements imposed by the Reserve Bank of India dated 6 April 2018 to Indian banks and authorized e-payment systems may not violate India’s commitments at under the GATS. This is because India has made its commitments in financial services sectors subject to the requirements under its domestic laws through a horizontal exception. However, India has not provided for such a blanket exception in context of its commitments for other service sectors. 
Possible arguments India may take

Should Indian formally adopt the data localization requirements, India could argue as follows in its defense:
  • First, the prohibition on cross-border flow of critical personal data and more specifically the data localization requirement does not limit the number of service suppliers. In other words, any number of service supplier who complies with the above requirements may provide services in India;
  • Second, the data localization requirement in itself do not accord less favourable treatment to a foreign service supplier as the requirement applies to even Indian service suppliers. If an Indian service supplier hitherto did not store data locally, it would need to do so as well and therefore, the measures as such do not accord less favourable treatment.
  • Third, India could also take recourse to the “privacy” exception under Article XIV(c) of the GATS arguing that the measures are necessary to secure the protection of the privacy of individuals and are not arbitrary or unjustifiable discrimination.The privacy exception is untested by the Dispute Settlement Body of the WTO, and it remains to be seen how wide, or narrow this exception is interpreted. 
  • Fourth, India could also argue that the measures were required to protect its “essential security interests” in accordance with Article XIV bis. Based on this provision, WTO members may take actions in derogation of their obligations if such actions are taken for reasons specified for national security reasons. The recent instances of invoking the national security exception by certain WTO Members coupled with the fact that misuse of certain type of data may indeed represent a threat to national security could give India ground to justify its action, even if they may be in derogation to its commitments under the GATS. 
Conclusion: What happens next?

The Draft Bill has generated huge interest and debate among various stakeholders including businesses, academia, citizen interest groups and think tanks. At one hand, the proponents of privacy rights are pushing for stringent data protection measures and on the other, the business argue that the increased costs of data protection compliance may make businesses unviable. Undoubtedly, the Bill is likely to undergo significant churning through debates and reviews and it remains to be seen how India draws a balance between these two competing interests. 

Popular posts from this blog

VC Interview: Shailendra Singh of Sequoia Capital India

In a recent interview to Venture Intelligence, Shailendra Singh discussed some of the firm’s newer investments in the early stage segment including in the online payments space, the progress at a few existing portfolio companies and the active role the firm is playing in helping its portfolio companies scale and succeed in India and globally. Prior to joining the firm in 2006, Singh was a strategy consultant at Bain & Company in New York and before that, an entrepreneur in the digital media industry. Venture Intelligence: How does Sequoia go about identifying potential early stage investments in India? Is there anything different you are doing today than, say, a couple of years back? Shailendra Singh: There is a lot more focus on technology investing and early stage investing. In general, as you might remember a few years ago, we were doing primarily growth investing but in the past 18-odd months, we have had a very strong focus on early stage and that’s continuing. In terms

ChrysCapital, Motilal Oswal PE & Sequoia named PE-VC Firms of the Decade

Press Release ChrysCapital, Motilal Oswal Private Equity and Sequoia Capital India have been named the top Private Equity & Venture Capital investors in India during the last decade, as part of Venture Intelligence’s APEX Awards. The Venture Intelligence “Awards for Private Equity Excellence” (APEX) is dedicated to celebrating the best that the Indian Private Equity & Venture Capital industry has to offer.  While ChrysCapital won the “Private Equity Investor of the Decade” award, Motilal Oswal Private Equity was feted as India’s “Growth Capital Investor of the Decade”. The Indian arm of the storied Silicon Valley VC firm, Sequoia Capital, was named the country’s “Venture Capital Investor of the Decade”. The APEX Awardees are selected based on both Self Nomination by the participating PE-VC firms as well as "crowd sourced" nominations and voting from the Limited Partner, PE-VC and advisory communities. (The main criteria were Exit Track Record, New Fund Raises & Fo

Ambit tops League Table for Transaction Advisors to Private Equity deals in 2019

Ambit Corporate Finance topped the Venture Intelligence League Table for Transaction Advisor to Private Equity Transactions for the year 2019. Ambit advised PE deals worth $2.4 Billion (across 4 qualifying transactions) during the period. Citi ($1.1 Billion across 2 deals) and  Avendus  ($969 million across 12 deals) took the second and third spot. Edelweiss Financial Services ($758 million across 9 deals) and  PwC  ($708 million across 15 deals) completed the top five in 2019.  The  Venture Intelligence League Tables , the first such initiative exclusively tracking transactions involving India-based companies, are based on value of PE and M&A transactions advised by Financial and Legal Advisory firms. Ambit Corporate Finance advised the $1.9 Billion buyout of Pipeline Infrastructure from Reliance Industries   by Brookfield Asset Management  and the IFC and I Squared Capital-backed   Cube Highways' acquisition of Delhi-Agra Toll Road from Reliance Infrastructu

Jio deals help PE investments climb 12% in H1'20 to $18.8 B

Press Release With Reliance Industries' communications unit Jio Platforms attracting 51% of the investment value, Private Equity-Venture Capital (PE-VC) investments in India rose 12% during the first 6 months of 2020 to $18.8 Billion (across 341 deals), shows data from  Venture Intelligence , a research service focused on private company financials, transactions and their valuations. Investments totaling over $9.5 Billion in Jio by a troop of global private equity firms, following social media giant Facebook's $5.7 Billion mid April investment in the company, helped overall PE-VC investments better the $16.8 Billion (across 503 transactions) invested during the same period in 2019. (Note: These figures include Venture Capital investments, but exclude PE investments in Real Estate).   Jio Platforms' $9.5 Billion Private Equity haul (excluding Facebook’s strategic investment) was led by Middle Eastern and American investors with KKR, Saudi Arabia's Public Invest

Inventus, Sixth Sense, Blume & Norwest win Apex'20 Venture Capital Awards

Inventus Capital Partners, Sixth Sense Ventures, Blume Ventures and Norwest Venture Partners were voted the top Venture Capital investors in India during 2019. The Venture Intelligence “Awards for Private Equity Excellence” (APEX) is dedicated to celebrating the best that the Indian Private Equity & Venture Capital industry has to offer. Other 2019 winners in the VC segment included  Axilor Ventures which was voted   the  Accelerator of the Year for the second year running, 3one4 Capital (VC Fund Raise of the Year) and Innoven Capital (Venture Debt firm of the Year). The APEX Awardees are selected based on both Self Nomination by the participating PE-VC firms as well as "crowd sourced" nominations and voting from the Limited Partner, PE-VC and advisory communities. (The main criteria are Exit Track Record, New Fund Raises & Follow-on Funding Rounds for Portfolio Companies).    " It is an honour to be recognised by entrepreneurs and investors as