Meaning

Data localization or data residency law requires data about a nations’ citizens or residents be collect, process, and/or store inside the country, often before being transfer internationally, and usually transfer only after meeting local privacy or data protection laws, such as giving the user notice of how the information will be use and obtaining their consent.

Data localization is essentially a new concept and has not been describe thoroughly. While many countries do have data localization requirements imbibed in their statutes, they still do not have specific legislation f

or data localization. Data Protection has seen significant growth in the last decade, data localization is relatively a new concept.

While some countries have a conditional localization mandate, India, imposes data transfer restrictions through guidelines or

regulations in specific sectors, such as Capital Markets.

Interrelationship with Data Privacy

Data Localisation is imperative to protect data privacy in certain cases, an example being the defense sector.

Data Privacy is relatively more legalized than data localization, especially after the increasing trend of social networking and e-commerce. There has been a global trend of raising awareness amongst internet users regarding data privacy. This has been the result of the uproar cause after the Cambridge Analytica case.

In this case, the fact came to light that Facebook had been using personal data, without consent, and it was leaking

such data to politically influencing the masses. It was also speculate that this was the driving force behind U.S elections. It led to Cambridge Analytica acquiring the personal data of millions of Facebook users. This, however, is not the first time that Facebook violate privacy norms.

Since its inception, Facebook has promised to follow data privacy norms. However, after establishing its dominance as a social networking platform, it started using cookies

to acquire personal data for advertising purposes. After other platforms like Orkut, were taken down, Facebook became dominant in this sector. Because of its monopoly, it has continued to violate data privacy to a great extent.

Example of Monopoly

Another very prominent example of monopoly in the e-commerce sector is Amazon. There is a growing public awareness that Amazon has established itself as an essential part of the internet economy and

that its dominance may pose hazards.

The 2010 Horizontal Merger Guidelines, for example, acknowledge that enhanced market power can manifest as non-price harms, including in the form of reduced product quality, reduced product variety, reduced service, or

diminished innovation.

Both Amazon and Facebook are examples of monopolies where certain rights like data privacy are violate, but the laws regarding it are still not implement

because of the weak enforcement system relating to data privacy laws.

Therefore, in such cases, data localization becomes imperative because if the data is restrict to a jurisdiction, it becomes more plausible to protect it. The data collection pattern in the last decade also suggests that data collected in servers outside the country can result in

its harvesting for political gains, which ultimately violates data privacy.

Cambridge Analytica Case

The Cambridge Analytica case is a leading example of data being collect in one jurisdiction and harvest in another, while simultaneously violating privacy standards of different jurisdictions because

such data was use without consent.

The interface between data privacy and data localization can also be describe by data protectionism or data nationalism, which essentially means

that the data privacy of a country’s citizens is more secured due to restricting it within the country.

The draft e-commerce policy as well as the Personal Data Protection bill, 2019 sets certain privacy standards and also prescribes data localization norms. Such provisions talk about personal data, which is a category of Data Privacy standards. These statutes have however still not been enact and therefore the enforcement regime of data privacy and data localization in India has not yet been establish. Also, they have certain loopholes and have failed to take into account the recent violations of personal data and

sensitive information through individual social media traction.