WhatsApp case proves India needs strong data protection law: Expert

As the Indian government steps up the pressure on Internet and social media giants to store consumers' data locally -- especially the payments-related data -- the road ahead is not easy for over one billion citizens as Internet giants have lobbied against the data protection law in the country for long, says the man who has taken the Facebook-owned WhatsApp to the court.

Reacting to an ET report that WhatsApp has set up data storage facilities in India for its soon-to-be-launched Payments service, advocate Virag Gupta said on Thursday that the truth would only come out on July 17 when the Supreme Court takes up the next hearing in the NGO's plea against WhatsApp.

"I do not know whether there is any truth here. Internet giants have lobbied against data protection laws for long. Right noises are also being made at the G-20 and World Economic Forum but why should the sovereign Parliament wait? India should promptly enact data protection law and notify IT Intermediary Rules," Gupta said.

"In addition, Internet giants ought to comply with the Indian laws, including the appointment of Grievance Officer in India and data localisation," added Gupta who represents Centre for Accountability and Systemic Change (CASC) which says WhatsApp has not complied with the Reserve Bank of India's (RBI) circular on data localisation norms.

In the last hearing on May 3, WhatsApp told the Supreme Court that the company is conducting a trial run of its payment service and will fully comply with the RBI norms on data localisation.

WhatsApp conducted the Payments trial last year with almost 1 million people to send money to each other in a simple and secure way.

"In response to India's payments data circular, we've built a system that stores payments-related data locally in India," a WhatsApp spokesperson had earlier told IANS.

With over 200 million users, India is the largest market for WhatsApp.

"WhatsApp payment is useful for people in their daily lives and we hope to expand the feature to all of India soon so we can contribute to the country's financial inclusion goals," the spokesperson added.

According to Gupta who represented RSS ideologue KN Govindacharya before the Delhi High Court in 2012, Internet companies make huge money out of selling consumers' data.

"Sadly, few Indians are concerned over data misuse. Overall, data is the new oil wherein India despite its biggest user base, hardly gets any value out of it. This is primarily because the internet giants are not taxed properly in India," said Gupta who has just released a new book titled "Taxing Internet Giants: American Companies & Data Protection in India".

"The top 15 Internet companies alone have amassed a value of over Rs 20 lakh crore due to their Indian users. The companies' value could be a major chunk of the Indian economy but is serving no purpose to Indians," he lamented.

On June 14, Union IT Minister Ravi Shankar Prasad said that the Ministry of Electronics and Information Technology (MeiTy) has finalised the much-anticipated Personal Data Protection Bill and the next required step is a Cabinet approval before the Bill goes to the Parliament.

"We have finalised the data protection law. I will take it to the Cabinet. We have had 3-4 rounds of consultation," Prasad said while addressing the CII's National Council meeting in the Capital.

Emphasising on data security and the country's hold over its data, the Minister said: "India will uphold its data sovereignty. It will not be negotiable. India is a huge country producing a lot of data."

With the government saying it will not relax the Reserve Bank of India's (RBI) norms for data localisation, the road ahead has become tough for global digital payment providers who have sought more time to comply with the guidelines.

The RBI guidelines say that all digital payment firms like Google Pay, WhatsApp and others must store data locally for their businesses.

"The entire payment data shall be stored in systems located only in India. The data should include end-to-end transaction details and information pertaining to payment or settlement transaction that is gathered / transmitted/processed as part of a payment message/instruction," say RBI guidelines.