Give'em leeway over porting banking data

A section of foreign banks is seeking data localisation requirements issued by RBI to be applied from January next year. Data localisation involves fragmenting operations for multinational banks, which increases costs and reduces competitiveness. Foreign banks have been winding down their presence in India, particularly in the retail segment, as local private banks have expanded their footprint. This, in some measure, reduces their access to consumer data the central bank is most sensitive about. RBI has given foreign banks a long runway to purge data of Indian clients from their servers abroad. It has also made concessions over processing credit card data abroad - provided it is erased immediately afterwards. Yet, foreign banks are yet to satisfy local data audit requirements.

Globally, two approaches are solidifying over banks' use of data. European and US banking is gravitating towards an open data protocol, while Asian banking is fragmenting over data localisation. Banks in advanced economies have a competitive advantage in their access to cheap credit. They are trying to push this advantage further through data processing. Banking regulators across Asia are justifiably wary about data leaving their shores and its impact on the competitiveness of their relatively smaller banks. Asian banks are eyeing a bigger share of cross-border transactions, and the rules are nudging foreign banks to store and process data locally. This fits in with broader measures on data protection involving privacy, residency and sovereignty.

There could be some merit in foreign banks' proposal to apply data localisation rules prospectively. Porting back historical data may not be technically, or legally, feasible in some cases. Since foreign banks aren't expanding aggressively in India, historical data available with them may not be a concern from a business PoV. Data security can be ensured through bilateral arrangements with reciprocal jurisdictions. This should not be an impediment in an open data jurisdiction, where data is typically better protected.