Data Localization Could Soon be the Worldwide Reality

Context: The recent judgment by the Court of Justice of the European Union (CJEU) striking down the US-EU Privacy Shield will have long term consequences on data localisation worldwide.

Distinct Approached to Privacy: As per Justice Srikrishna Committee, there are three distinct approaches: 

• American: With some fundamental difference with the data protection laws of Europe, the US has created exceptional legal frameworks to facilitate the free flow of data – US-EU Privacy Shield.

1. European: came out with strict data protection laws in the form of General Data Protection Regulation (GDPR) to regulate incoming and outgoing data.

• Chinese: It has applied strict restrictions on foreign data companies that operate within its territory, while Chinese data companies complied with local laws outside the territory.

Reasons behind CJEU ruling against Privacy Shield:

• Not compatible with GDPR: US law did not afford a level of protection compatible with protections required under Europe’s GDPR.

• Inadequacy of contractual clauses: The court held that the transfer of data should not be permitted in cases of other bilateral Standard Contractual Clauses (SCC).

Implications of the ruling:

• Challenges to India: India’s compatibility with the GDPR has been challenged through the following:

• Lack of privacy law and all transfers of personal data between European and Indian companies take place under SCC.
• Wide and sweeping powers under law enforcement agencies impinge on the privacy through surveillance under the garb of national security.

• Push towards data localisation: The long-term impact of the CJEU decision is likely to be that European data will never leave European shores again.

Conclusion: Although data localization adversely affects our ability to take full advantage of the global data economy, nevertheless if all countries wish to be on the same page, there is not much difference where the data is being kept and processed.