The obsession with where data physically sits at rest is so amusing to me. Not limited to overzealous governments and financial data; healthcare is singularly obsessed with this. It makes no sense whatsoever, of course. I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. I would understand if they demanded both storage and proc…
India bans MasterCard from adding new customers
61–70 of 180 posts
Re: India bans MasterCard from adding new customers
#62I can't make out if these rules are specific to India. Doesn't the EU have the same data residency rules as well? Why are Mastercard and Amex struggling with this?
The Indian rule seems to require all data be stored strictly inside India, without any of it being stored outside the country. The EU permits data to be transferred outside the EU under a number of circumstances: e.g. if the other country has equivalent data protection laws, if the non-EU company you're transferring the data to has promised to abide by the EU rules, stuff like that. Take this with a grain of salt, of…
Re: India bans MasterCard from adding new customers
#63Earlier quoted context omitted.
The Indian rule seems to require all data be stored strictly inside India, without any of it being stored outside the country. The EU permits data to be transferred outside the EU under a number of circumstances: e.g. if the other country has equivalent data protection laws, if the non-EU company you're transferring the data to has promised to abide by the EU rules, stuff like that. Take this with a grain of salt, of…
Actually the European courts struck down Privacy Shield. So any company transferring data to the US is doing it illegally. Plenty of active lawsuits against google. But as much as HN likes to bash google, people here are pretty submissive when one is asking for advice on legal options against these companies. https://www.bbc.com/news/technology-53418898
Re: India bans MasterCard from adding new customers
#64The obsession with where data physically sits at rest is so amusing to me. Not limited to overzealous governments and financial data; healthcare is singularly obsessed with this. It makes no sense whatsoever, of course. I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. I would understand if they demanded both storage and proc…
Re: India bans MasterCard from adding new customers
#65Earlier quoted context omitted.
They have been "growing" and "becoming" the next world leader for a while now. Anyone who have lived in india long enough will tell you how far from the truth this is. The only Stick India has, besides their nuclear arsenal, is the size of their domestic market (aka population). I dont think the purchasing power of their domestic market is that lucrative compare to actual superpowers (Economic or Military). Buy just…
Yeah Modi is pretty anti international investment, just look here since he got into power FDI has dropped in India by almost -100% https://www.macrotrends.net/countries/IND/india/foreign-dire... Also all the PLI schemes for companies are pretty anti international investment, so companies from Samsung to Apple are all investing big.
Re: India bans MasterCard from adding new customers
#66The obsession with where data physically sits at rest is so amusing to me. Not limited to overzealous governments and financial data; healthcare is singularly obsessed with this. It makes no sense whatsoever, of course. I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. I would understand if they demanded both storage and proc…
India wants data residency because it wants to apply its own somewhat unique approach to law enforcement to all digital data — financial and otherwise. This is a country that switches off mobile data (3G and 4G) at the drop of a hat[1], and switched off an entire state’s mobile Internet access for 18 months [2]. This may appear unnecessary and capricious to some especially in the West. However I’m sure pro-Indian gov…
"Oh, but the data is encrypted." Sure, but the country could literally seize all of the servers and shut down the payment processor. "Hey, American Express, if you don't give us the data we want, we'll simply take your whole payment network offline."
It's a lot harder to pressure a payment network when you don't have physical control - especially if that payment network can challenge you in court. It's easy for the government to shut off mobile networks that are physically present. It's harder for the government to stop traffic from routing to a payment processor whose servers are outside of the country - especially if they have a half-decent security/threat team ready to avoid blocks.
I don't know the laws of India, but it seems likely that the Executive has a certain amount of discretion that can be challenged. However, it's a lot harder to challenge that discretion if your business is offline for a year while you challenge it. Payment processors need to comply with local laws, but if you're a country where the Executive doesn't mind disrupting services, that gives them a huge amount of leverage to get your compliance beyond local laws. If the data is hosted outside of India, it's a lot easier to to simply comply with the laws rather than the laws plus whatever the Executive thinks they can claim the laws support.
Ultimately, if the data is stored within India, the Indian government can be an existential threat to their business in the country beyond what the law allows. A company will hand over data rather than seeing its servers seized for a year while a trial ensues. During that year, they'd lose all their customers to competitors and they'd be shut out of the market. Likewise, what if the government "accidentally" damages the data when they lose the trial? If you have 100M customers in a country and each is carrying a balance of $100, that's $10B that people owe. If the government has seized all those records and then damages them, your business is in a lot of trouble.
Data residency gives a government willing to bully companies a lot of power. It's simply a lot harder to access information stored abroad and you have a lot less leverage.
Re: India bans MasterCard from adding new customers
#67Earlier quoted context omitted.
The Indian rule seems to require all data be stored strictly inside India, without any of it being stored outside the country. The EU permits data to be transferred outside the EU under a number of circumstances: e.g. if the other country has equivalent data protection laws, if the non-EU company you're transferring the data to has promised to abide by the EU rules, stuff like that. Take this with a grain of salt, of…
Does Indian controlled AJK and Ladakh qualify as "inside India"?
Re: India bans MasterCard from adding new customers
#68Earlier quoted context omitted.
Actually the European courts struck down Privacy Shield. So any company transferring data to the US is doing it illegally. Plenty of active lawsuits against google. But as much as HN likes to bash google, people here are pretty submissive when one is asking for advice on legal options against these companies. https://www.bbc.com/news/technology-53418898
As far as I know it's still possible to transfer data from the EU to the US under the GDPR if the companies involved have signed a ``standard contractual clause''[0] (the article says this was also a target of the Privacy Shield suit but the courts chose to continue to allow it). [0] https://ec.europa.eu/info/law/law-topic/data-protection/inte...
[1]: https://support.google.com/adspolicy/answer/10042247?hl=en [2]: https://aws.amazon.com/blogs/security/customer-update-aws-an... [3]: https://docs.microsoft.com/en-us/compliance/regulatory/offer...
Re: India bans MasterCard from adding new customers
#69Earlier quoted context omitted.
India wants data residency because it wants to apply its own somewhat unique approach to law enforcement to all digital data — financial and otherwise. This is a country that switches off mobile data (3G and 4G) at the drop of a hat[1], and switched off an entire state’s mobile Internet access for 18 months [2]. This may appear unnecessary and capricious to some especially in the West. However I’m sure pro-Indian gov…
To expand on this a bit, if you want leverage over companies like MasterCard, Visa, and American Express, it definitely helps to have the data in your jurisdiction. As you noted, they will shut off mobile internet to support the state. If Visa decides that it doesn't want to give the government data on someone's transactions, it helps to have that data in the country. "Oh, but the data is encrypted." Sure, but the co…
The amount of leverage you have with data being abroad is approximately the same - you can decree that your financial institutions or businesses are committing a crime when transacting with said company, and that is all.
Re: India bans MasterCard from adding new customers
#70The obsession with where data physically sits at rest is so amusing to me. Not limited to overzealous governments and financial data; healthcare is singularly obsessed with this. It makes no sense whatsoever, of course. I'd much rather store properly encrypted personal information or financial data in North Korea than storing it unencrypted in my home country. I would understand if they demanded both storage and proc…