Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

India bans MasterCard from adding new customers

techcrunch.com

Post reply on HN
Print view View original

11–20 of 180 posts

Re: India bans MasterCard from adding new customers

#11

Post by ntrz »

frabcus wrote: post #10
ntrz wrote: post #5

So, the reason is that the entirety of the customer data must be stored locally in India, rather than on a server located elsewhere[0]? Does anyone know why the rule in India is so much stricter than the equivalent GDPR rule[1], which allows transfer of data outside the EU in various circumstances (basically if it's assured that it won't lead to the data being subject to much laxer standards of protection)? According…

If I was running a large country, I'd want transactions to be entirely local for national security reasons. Generally, in the event of a world war, I wouldn't want it to be trivial for other countries to remotely cut off my whole economy.

From the text of the rule:

> There is no bar on processing of payment transactions outside India if so desired by the PSOs. However, the data shall be stored only in India after the processing. The complete end-to-end transaction details should be part of the data.

So this only applies to the customer data, not the actual systems that do the transaction processing and verification. The systems that actually do the work could still be cut off from India, leaving them with nothing but a database of customer transactions.

Re: India bans MasterCard from adding new customers

#12

Post by mtmail »

obiwanpallav1 wrote: post #7

What are/was the effects of GDPR in EU? Also, did it lead to a huge increase in the spendings for MasterCard?

I'd imagine a bigger loss for MasterCard was the EU capping their interchange fees to 0.3% with a regulation in 2015. "At present, credit card interchange fees in the UK are typically around 0.85% per transaction" (https://www.theguardian.com/money/2015/jul/27/cap-on-card-fe...). After Brexit MasterCard will increase it to 1.5% (https://www.theguardian.com/money/2021/jan/25/mastercard-to-...) Loosing out on 0.55% fee on every transaction is significant at MasterCard's scale.

Re: India bans MasterCard from adding new customers

#13

Post by ntrz »

kyrra wrote: post #8
bserge wrote: post #3

Is this hard to implement for MasterCard? Otherwise, it seems reasonable to me, but I'm not that knowledgeable in this area.

Yes, it is. You either need to entirely fork your operation to have it operate entirely within India, or be extremely careful with how you store your data, and store the data only in India, but process it in other data centers without ever having it touched disk. Which I believed means you can never even log the data.

The rule[0] says that you can process the data abroad, including storing it on disk temporarily for purposes of processing, as long as it is deleted within 24 hours. So it's not quite as strict as requiring it be kept in memory the whole time without ever writing to disk, but it does sound like you probably couldn't keep detailed logs.

[0] https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id...

Re: India bans MasterCard from adding new customers

#14

Post by vishnugupta »

bserge wrote: post #3

Is this hard to implement for MasterCard? Otherwise, it seems reasonable to me, but I'm not that knowledgeable in this area.

The physical hosting while not trivial is not a big challenge. They need to find a reliable hosting provider in India and there are many.

Where it gets really hairy is routing. Example - handling payments of Indian international travellers; or card details entered on websites that are hosted outside of India.

I worked on a similar project but 1/10th of scale and even then it was extremely tricky to cover all the edge cases.

Re: India bans MasterCard from adding new customers

#15

Post by BitwiseFool »

kyrra wrote: post #8
bserge wrote: post #3

Is this hard to implement for MasterCard? Otherwise, it seems reasonable to me, but I'm not that knowledgeable in this area.

Yes, it is. You either need to entirely fork your operation to have it operate entirely within India, or be extremely careful with how you store your data, and store the data only in India, but process it in other data centers without ever having it touched disk. Which I believed means you can never even log the data.

As difficult as this will be to implement, I suspect it will be a boon for the Indian IT industry. I suspect MasterCard and others will comply with the new law in due time simply because the Indian market is so vast and full of revenue potential.

Re: India bans MasterCard from adding new customers

#16

Post by hnbad »

I find it interesting that the card companies are concerned storing the data in India could allow the government access to it when the data apparently currently resides in the US. Either they're doing something with the data in the US that prevents the US from accessing it the way India could or they're just accepting the US being able to access it as a given and don't see why Indian customers wouldn't want that.

Re: India bans MasterCard from adding new customers

#18

Post by seunosewa »

frabcus wrote: post #10
ntrz wrote: post #5

So, the reason is that the entirety of the customer data must be stored locally in India, rather than on a server located elsewhere[0]? Does anyone know why the rule in India is so much stricter than the equivalent GDPR rule[1], which allows transfer of data outside the EU in various circumstances (basically if it's assured that it won't lead to the data being subject to much laxer standards of protection)? According…

If I was running a large country, I'd want transactions to be entirely local for national security reasons. Generally, in the event of a world war, I wouldn't want it to be trivial for other countries to remotely cut off my whole economy.

How about just avoiding wars? Global interdependence of countries is beneficial for this reason. Also, India's military is no match for and unlikely to have any reason to fight the external countries where MasterCard's data is likely to be stored (US, UK, etc).

Re: India bans MasterCard from adding new customers

#19

Post by elliekelly »

sudhirj wrote: post #4

I can't make out if these rules are specific to India. Doesn't the EU have the same data residency rules as well? Why are Mastercard and Amex struggling with this?

I suspect this is more a case of “unwilling” rather than “unable”. Slightly related, China recently passed a similar law:https://www.ropesgray.com/en/newsroom/alerts/2021/July/China...

Re: India bans MasterCard from adding new customers

#20

Post by captn3m0 »

kyrra wrote: post #8
bserge wrote: post #3

Is this hard to implement for MasterCard? Otherwise, it seems reasonable to me, but I'm not that knowledgeable in this area.

Yes, it is. You either need to entirely fork your operation to have it operate entirely within India, or be extremely careful with how you store your data, and store the data only in India, but process it in other data centers without ever having it touched disk. Which I believed means you can never even log the data.

The original RBI circular was in 2018[1] with a audit date set for December 2018. That wasn't met as most companies requested for an extension, which the RBI gave multiple times.

So yes, it is difficult - but it has been years since MasterCard knew about this.

[1]: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=1124...

Post reply on HN