The global leading company, MasterCard, proposes the Reserve Bank of India (RBI) a certain date from which it will start to delete Indian cardholder’s data from its global servers, however, warns about the impact, which could be weakening of safety and security over a period of time.
Porush Singh, India and Division President of South Asia, MasterCard, said the company is operating in over 200 countries, and nowhere else it has been asked to delete data from global servers.
In April, RBI issued a new regulation, which came into effect from October 16, requiring payments companies to store all information about transactions involving Indians solely on computers in the country.
The RBI directive on data localization asked MasterCard to store all new Indian transaction data at its technology center in Pune.
“The proposal we have given (to RBI) is that we will delete it (data) from everywhere else, whether it is the card number, transaction details. The data will only be stored in India … we will start deleting that…,” Singh said. He further said MasterCard has proposed to the RBI that Indian data would be stored locally and nowhere else.
Singh added that the company has also informed the central bank about data deletion’s impact. “But we have also said that it does have an impact. No other country has asked us like that. No other country in the world has asked us the data to be deleted from the global server and the reason why it is a concern for us because that would be weakening of the safety, security over a period of time,” Singh said.
Or if the company is seeking any reprieve in complying with the regulations; Singh said the company is planning with the dateline which it has submitted to the RBI. “I do not want to wait. As far as we are concerned, we have said this is the date earliest we can do… And this is going to be impacted in the longer term which you need to consider,” he added.
When asked if the payments gateway was complying with the RBI directives, Singh said from October MasterCard has started storing a copy of the data.
“…the date of (data) deletion (from global servers) is something which is not yet decided as we are waiting for the RBI to confirm back to us,” he said and added “we have proposed a certain date on which we will start deleting the data on a running/regular basis”.
According to Singh, the deletion of data is not a simple process. “This is because people can charge you…dispute the transactions, that all in the process … it needs multiple players, multiple stakeholders. We have given them (RBI) a proposal and we are waiting for them to confirm back,” he said.
Data localization’s cost will be an incremental one, according to Singh. It requires data about residents to be collected, processed, and stored inside the country, often before being transferred internationally, and is usually transferred only after meeting local privacy or data protection laws.