US body pushes against RBI\'s data localisation norms\, alleges bias and conflict of interest

US body pushes against RBI's data localisation norms, alleges bias and conflict of interest

RBI is unwilling to budge, but the pressure has been building up. Apart from the US companies already lobbying for a deadline extension, the co-chairs of the US Senate India Caucus wrote to Prime Minister Narendra Modi on Friday requesting a relaxation in the norms.

The RBI's deadline for its new data localisation requirements ends today. The buzz is that the RBI is unwilling to budge, but the pressure has been building up. Apart from the US companies already lobbying for a deadline extension, the co-chairs of the US Senate India Caucus wrote to Prime Minister Narendra Modi on Friday requesting a relaxation in the norms.

According to The Economic Times, last week's closed-door meeting between Reserve Bank of India deputy governor BP Kanungo and some of the top US financial companies on the topic has also sparked complaints of bias and conflict of interest. Kanungo is in charge of payments and settlements and senior representatives from American Express, Visa, MasterCard, Amazon, Western Union, Discover and MoneyGram, among others, had met with him.

In a strongly-worded letter to Finance Minister Arun Jaitley, the US-India Strategic Partnership Forum (USISPF) protested against the presence of a think-tank representing the interests of homegrown tech firms like Paytm, Ola, Flipkart et al at the meeting.

"iSPIRT is a private association which is not a stakeholder in this consultation process. It must be noted that it is neither empanelled by the RBI, nor an official technical adviser to the government or the regulator," read the October 13 letter from Mukesh Aghi, CEO of USISPF, a trade body representing American corporates in India with senior CEOs from both countries on its board of directors.

"The presence of such a party in the meeting may constitute as a conflict of interest, especially when they were asked by the RBI during the course of the meeting to provide technical expertise to companies on compliance to this directive," the letter sent on Saturday reportedly pointed out. "The RBI, in the course of the meeting, placed great reliance on technical inputs provided by iSPIRT, which was represented by four officials rather than the one or two persons mandated for all other companies present."

Domestic e-payments companies like Paytm and Flipkart-backed PhonePe have previously come out in open support of the move towards data localisation, going so far as to accuse the global players of trying to find ways to avoid taxes and scrutiny.

Aghi told the daily that the presence of iSPIRT, "a third-party advocacy organisation" in a meeting between the regulator and regulated entities underscores bias. It's worth mentioning here that RBI has its own IT and cyber security cell, ReBIT. "iSPIRT has long advocated for digital protectionism and their presence at the meeting makes it apparent that the regulator's rationale behind data localisation is aligned to iSPIRT's stand," he said, adding, "iSPIRT hijacked the meeting to raise technological issues which needed a more detailed meeting with the right stakeholders."

According to him, the think-tank's "lack of payments experience" also led to many "assumptions" being made at the meeting, including "complete disregard for ecosystem safety and security" offered by global infrastructure.

This development comes just a day after the two US senators, John Cornyn and Mark Warner, of the Senate India Caucus urged Modi to soften India's stance on data localisation, warning that measures requiring this represent "key trade barriers" between the two nations. Instead of the RBI's strong stand, their October 12 letter advocated a "light-touch" regulatory framework that would allow data to flow freely across borders.

The government's firm stand on data localisation means cost escalation for these entities since a lot of their servers, which have been set up outside the country, will need to be brought here. Industry experts peg this cost at a few hundreds of millions of dollars.

In a circular dated April 5 the regulator had said in order to ensure better monitoring of payment service operators it is important to have unfettered supervisory access to data stored with these system providers as also with their service providers/ intermediaries/third party vendors and other entities in the payment ecosystem . It had added that "all payment system operators will ensure that data related to payment systems operated by them are stored only inside the country within a period of 6 months".

The buzz is that 80% of the payments entities have already shifted to storing payments data generated in India within its borders - WhatsApp being one of the most recent companies to comply with the RBI's April diktat.

However, the consensus in the banking sector is that the regulator will not inconvenience the public and block card transactions to punish the companies yet to comply with its norms. "If cards stop functioning, then it will be worse than demonetisation. No one can afford to make citizens go through something like that again. At the most, there can be some penalty levied," a senior banker with a private sector bank told the daily.