Foreign Tech Giants Misusing Data Serious Threat, Akin to ‘Open Porous Border’, Say Intelligence Agencies

Intelligence agencies have raised concerns about foreign tech giants misusing India’s data in the absence of a regulatory framework to govern them. They called it a serious threat, akin to an “open porous border”.

According to an intelligence note accessed by CNN-News18, there are serious concerns regarding the absence of data localisation process in the country. Data localisation is a process where data generated in India should only be kept in India.

All tech giants depend on India for their growth due to the sheer number of users. India is the only country where there is no regulatory framework available to govern foreign tech companies.

Intelligence agencies said all tech giants should be under an obligation not to share India’s data abroad. They have also flagged process sharing, which is a mechanism used for data sharing.

There are also concerns about location of servers as even if localisation is done, the servers are in the host countries, the agencies said. These tech giants, in the name of data process sharing, send data to their host countries and data localisation then becomes only lip service, they added.

The agencies further said these concerns were all related to the sovereignty of the country as this very data could be used against you. The data can be used against the particular party or individual by manipulating the algorithm through their choices, trends and preferences, they added.

The same data, the agencies said, is available for behavioural preferences and can be used on social media platforms. The data can be used by the west in the name of transparency and liberalism, they added.

India notified the Digital Personal Data Protection Act on August 11, which aims to protect the privacy of Indian citizens while proposing a penalty of up to Rs 250 crore against those who fail to protect or misuse the digital data of individuals.

While the Act provides for the processing of digital personal data in a manner that protects an individual’s right and the need to process such data for lawful purposes, it is not clear if it has any provisions to safeguard data localisation and data sharing.