Don't take the bat home, yet!

If countries are not sure that the protections they offer to citizen data will be provided elsewhere in the world, why will they let the data flow?

In a pre-pandemic world, winters in the Seth household used to be filled with gully cricket. Spending cold weekend mornings at a park with your friends was one of life’s small luxuries for as long as I can remember.

More often than not, games would not end organically when everyone was tired and wanted to go home. Instead, they would end when the person who owned the bat decided to leave. No wonder those Dream Eleven IPL ads with Hardik Pandya and Rohit Sharma struck a chord with millions of Indians (including me).

Every time the person with the bat left (let’s call him Manoj), I would wonder why the party had to stop just because one person could not be bothered to play any longer.

Since the pandemic, playing outdoor cricket has become too risky. But, every time I read about developments in data localisation, I find myself thinking about people like Manoj, who take the bat home because they don’t want to play anymore.

In recent memory, countries have been protective of the data their citizens generate. So every time there is a conversation around cross-border data flows, localisation is a standard go-to move.

And it’s not just China that is stringent about their data flowing freely around the world, India has sectoral localisation policies in areas like payments. Once a data protection law is in place, localisation for a broader set of data becomes the norm.

Similarly, we have seen the Court of Justice of the European Union (CJEU) restrict data transfer to the US.

Middle path

Localisation as an approach is expected from China. India, on the other hand, seems to be taking a middle path. What’s concerning to me here is that the West, notably the EU, has also decided to take the bat home.

The argument made by the CJEU is that European data in the US will not be afforded the same protections that it is given under the GDPR in Europe. And there are concerns that the US government, or for that matter, you could swap that with the Indian government, can get unauthorised access to citizen information.

On one level, that makes sense. It is the duty of states, even supra-states like the EU, to protect their citizens. And that duty now extends to the digital realm. And if countries are not sure that the protections they offer to citizen data will be provided to the information elsewhere in the world, then why let the data flow there in the first place?

However, on the other hand, the ability to share data at lightning speeds, regardless of geography, is as important as the existence of the data itself. It is thanks to these data transfers the digital world exists the way it does.

When restricting these data flows with localisation norms and adequacy standards becomes the norm and not the exception across sectors, each player in the global data value chain has to bear the costs in compliance.

So while it may make sense for states to be strict towards sharing of health data, the same approach might not make sense if the data is related to cab aggregators, for instance.

As states have woken up to the power of data, an increasing number of them are raring to take the bat home, with little or no regard for the consequences it might have on global business and data-driven innovation.

In my mind, that is a tragedy since we may never know what we missed out on.

The writer is a policy analyst working on emerging technologies. He tweets at @thesethist.

Tech-Tonic is a monthly look-in at all the happenings around the digital world, both big and small.