Hacker News Reader

To expand on this a bit, if you want leverage over companies like MasterCard, Visa, and American Express, it definitely helps to have the data in your jurisdiction. As you noted, they will shut off mobile internet to support the state. If Visa decides that it doesn't want to give the government data on someone's transactions, it helps to have that data in the country.

"Oh, but the data is encrypted." Sure, but the country could literally seize all of the servers and shut down the payment processor. "Hey, American Express, if you don't give us the data we want, we'll simply take your whole payment network offline."

It's a lot harder to pressure a payment network when you don't have physical control - especially if that payment network can challenge you in court. It's easy for the government to shut off mobile networks that are physically present. It's harder for the government to stop traffic from routing to a payment processor whose servers are outside of the country - especially if they have a half-decent security/threat team ready to avoid blocks.

I don't know the laws of India, but it seems likely that the Executive has a certain amount of discretion that can be challenged. However, it's a lot harder to challenge that discretion if your business is offline for a year while you challenge it. Payment processors need to comply with local laws, but if you're a country where the Executive doesn't mind disrupting services, that gives them a huge amount of leverage to get your compliance beyond local laws. If the data is hosted outside of India, it's a lot easier to to simply comply with the laws rather than the laws plus whatever the Executive thinks they can claim the laws support.

Ultimately, if the data is stored within India, the Indian government can be an existential threat to their business in the country beyond what the law allows. A company will hand over data rather than seeing its servers seized for a year while a trial ensues. During that year, they'd lose all their customers to competitors and they'd be shut out of the market. Likewise, what if the government "accidentally" damages the data when they lose the trial? If you have 100M customers in a country and each is carrying a balance of $100, that's $10B that people owe. If the government has seized all those records and then damages them, your business is in a lot of trouble.

Data residency gives a government willing to bully companies a lot of power. It's simply a lot harder to access information stored abroad and you have a lot less leverage.

Still not really buying the physical control of data argument. If you need to force a company like MC to comply, you can always solve that problem at the point of sale, or (like they're doing right now) stop banks, which are firmly under your jurisdiction, from issuing cards. A company will hand over data rather than be banned from operating in the country, just the same.

The amount of leverage you have with data being abroad is approximately the same - you can decree that your financial institutions or businesses are committing a crime when transacting with said company, and that is all.

As far as I can tell, there's a fair bit of difference between "decreed a crime" and "we've backed up a truck to the DC, and physically seized your data, do as we say if want it back"

What is the long- or medium-term difference, to a company like Mastercard? They want to earn profits in India, they have to comply with the Indian government's demands. Case closed.

> Data residency gives a government willing to bully companies a lot of power. It's simply a lot harder to access information stored abroad and you have a lot less leverage.

You have no clue how much uncontrolled power Indian government has today. This law is brought in to benefit telecom companies and real estate companies. https://www.business-standard.com/article/companies/hiranand...

This argument is tenuous at most. Just because some companies are setting up data centers does not mean that Govt is deliberately forcing data residency to aid them.

It is ok for Europeans to insist on data residency within their shores but not for India? It is ok for Americans to insist on no data to be hosted in Chinese servers but not India?

India is fast turning into an Oligarchy where a few have all access. Indian government itself has been involved in selling the data of its citizens to private corporations. https://economictimes.indiatimes.com/industry/auto/auto-news...

> And that is, in my view, the driver for India’s interest in data residency.

I thought you were going to go further with that thought. I'm from an African country where the government tried to block social media during protests at DNS level. These efforts were trivially thwarted by using VPNs. The next trick was to cut off the internet entirely - unfortunately for the government, this broke electronic payments and ground the economy to a halt, so the internet blackout lasted a day.

I suspect one of the factors is that India wants to be able to cut itself off from the internet without breaking (payment) systems that have data stored offshore.

>What I feel about this is that of course India has the sovereign right to do as it pleases, but its messy, adhoc approach to digital governance won’t win it any laurels and will actually tarnish its reputation. Also, it would be on a much better footing if it passed a decent law on digital privacy, which many have been saying is long overdue — leading to a flourishing unregulated economy in selling Indians’ data[3].

You seem to be on a general critique of Indian policy, and also applying it to this specific case. If we untangle those two for a moment, what exactly is messy, adhoc about this financial data residency requirement? It seems logical to me that local financial data should remain local for legitimate legal reasons (supervision of fraud/criminality being the most obvious ones). Why would this tarnish their reputation?

> leading to a flourishing unregulated economy in selling Indians’ data

At risk of being incredibly inflammatory - this is the first I've heard of bulk Indian citizens' data being worth enough to harvest in the first place - what's changed?

You can see datasets purporting to be, for instance, details about students appearing for various Indian competitive exams for as little as $50-100[1]. Other datasets are costlier, of course.

If you're marketing to that demographic (e.g. potential ads for private colleges, or other courses), your budget won't be super high, but you might well spend a little for a bunch of emails of potential leads.

[1] https://www.reddit.com/r/india/comments/63s18q/student_data_...