The India Draft National e-Commerce Policy (the “Policy”) is a high-level policy document proposed by India’s Department for Promotion of Industry and Internal Trade in February 2019. It sketches out a series of policy recommendations that range from useful consumer protections to non-constructive protectionist industry regimes that would likely backfire and hurt businesses, entrepreneurs and consumers alike. The best of these recommendations would institute stricter consumer protections against annoying, unsolicited phone calls and emails. But the worst of them would make data transfers difficult, impose onerous liability on third party platforms, and institute data localization that would reduce business and consumer choices.

The India Draft National e-Commerce Policy (the “Policy”) proposes a mixed bag of strict regulatory and protectionist policies related to data governance and privacy – largely premised on the rationale that “India’s data should be used for the country’s development. Indian citizens and companies should get the economic benefits from the monetization of data.”

These recommendations accompany others, regarding tax, infrastructure development, and customs and export policy – but we focus mainly on the recommendations concerning data privacy and governance. We also touch on other suggested policies (such as those regarding online liability) that are potentially intertwined.

The Policy paints in broad brush strokes. It is therefore difficult to gauge in a precise way its likely legal and economic impacts. But certain concerns do stand out, alongside some worthy recommendations.

First, the positive. The Policy, to its credit, recommends that India more vigorously regulate unsolicited email, SMS and telephone messages. This is a step forward. It would protect consumers and enforce integrity across these commercial platforms. If drafted thoughtfully, this legislation could align India’s email, text and telephone marketing laws with those of the U.S. or Canada. This is therefore a promising development.

On the other hand, the Policy proposes several steps that seem likely to curtail innovation or business development, particularly if they lead to overly aggressive or protectionist regulation. In particular,

• It recommends data localization requirements that would make it difficult for Indian businesses to work with international data and services platforms;
• It recommends that India restrict data transfers out of India from e-commerce platforms, social media, and search engines – thus limiting how Indian consumers and businesses can work with those platforms;
• It even suggests price controls – which can limit choices and reduce competition and innovation;
• It recommends that the Indian authorities be granted access to commercial source code and algorithms, which could inhibit intellectual property development and innovation; and
• More broadly, it suggests that online platforms should be liable for user-generated content (and thus safe harbors for internet intermediaries be diluted) – a threat to free speech and open communication.

At the same time, the Policy proposes that Indian authorities have wide latitude to demand information held overseas – a potential concern for civil liberties, and an invitation for international disputes.

All that said, the Policy is an early-stage document, and will be subjected to scrutiny from the wide range of groups with something at stake. These include Indian entrepreneurs, investors, vendors with international clients, and businesses with international vendors. Consumers, too, may see their choices dwindle if the Policy is implemented aggressively. We hope that moderating voices will prevail to help draft a document that protects consumers without enforcing protectionist data regimes.