Introduction

Data is the singular input of the digital economy, as it is a key component to optimising the industry of online display advertising (the counterpart to search advertising), as more user data allows for the engineering for more optimal advertisements. This piece argues that this industry is hampered by section 16 of the Digital Personal Data Protection (“DPDP”) Act, as it gives unchecked power to the executive to blacklist data flows towards any countries, resulting in a geoblocked environment. This piece continues with the argument that this creates competitive market distortions in the industry, and prejudices India’s potential data economy. 

The first part of the piece speaks to data’s nature as a competitive input, bringing in the case of In Re: Updated Terms of Service and Privacy Policy for WhatsApp Users (hereinafter referred to as “Meta v. CCI”), and delineating how India’s data economy is structurally dependent on foreign entities. It also speaks of how data asymmetry creating competitive advantages is present within Indian antitrust jurisprudence. The second part shows how section 16 of the DPDPA structurally is different from the European Union’s (“EU”) adequacy standard model. The third part shows how geoblocking can be sanctioned by the state. The fourth part shows how geoblocking can be harmful in the industry of online display advertising. The fifth part shows how unchecked power predictably causes distortion, and focuses on the application of public choice theory. Additionally, it also shows why legislative amendment is necessary. 

Data as Competitive Input & India’s Structural Data Dependency

Data isn’t just an intangible manifestation of each individual’s choices, behaviours, and information, but rather, a commodity in the new digital age. Indian jurisprudence also supports this idea of data being a commodity, which is a crucial legal understanding pertinent to legislating on what drives the new world economy. 

In the case of CCI v. Meta, the Competition Commission of India (“CCI”)  held that data is an essential commodity in the age of Digital Markets. A key characteristic of Digital Markets is that, the more data is available on a particular individual/community/group, the more effective is targeted online display advertisements pointed towards them. Online display advertising, a no cost consumer market, benefits from direct (more user data equaling more effective ads) and indirect (complementary services) network effects. Online display advertising scales with data.^[1] The market of online display advertisement runs through and on the data that is collected from individuals. Entities and corporations owning more data have a substantial competitive advantage over those who have lesser data on individuals. This creates an entry barrier that makes it difficult for new competitors to overcome.^[2] So, when Whatsapp’s privacy policy in India was altered to not allow an option to users to share their Data with Meta’s other subsidiaries, the Commission held this to be anticompetitive. Within Indian Antitrust jurisprudence, the control and abuse of data is seen to be anticompetitive.^[3]

India as a domestic data market produces most of the data in the world, but alongside that, also has the least amount of data centres to harness that commodity. Data centres are a key necessity to store, process, and distribute massive amounts of data, and are a necessity for Artificial Intelligence, Cloud Computing, and Big Data Analytics. The only inference which can be made considering these two facts is that a substantial percentage of Competitive Market players in online digital services are based outside of India. This is a prerequisite to understanding that territorial Data geoblocking of India from any other countries could heavily substantiate the market position of the countries allowed to harness Indian data artificially. 

Data is an input, and restricting data flows to certain countries causes an artificial entry and competitive barrier which grants certain entities in the industry of online display advertising an incumbent advantage in their business. There needs to be a parliamentary amendment to change this unconstitutional section, as the competition regulator in India is helpless to intervene otherwise. 

Section 16 DPDP Act: Structure of the Discretion

Section 16 of the Digital Personal Data Protection Act grants the central government the power to blacklist any country from being able to receive India’s data. The provision grants wide, and unrestricted power to the Central Government to blacklist certain countries from any and all outward data flows. There are no statutory restrictions, nor any grounds the central government needs to meet to put out a notification to restrict India’s data from any sovereign union. 

This lack of criteria ensures that there are no procedural safeguards (notice, hearing, or transparency) which could potentially hold the central government accountable for their decisions. This is especially cumbersome as India’s judiciary has held blacklisting to be a form of civil death;^[4] a contributing factor as to why India’s judiciary has recognised the principles of natural justice to be applied to executive actions. Principles of natural justice however, need some criteria for judicial review to be practically effective.

In comparison with the EU model, Adequacy Standards therein, have clear and solid criteria rooted within the European Union ideals of data protection. The Adequacy Standards enshrined within the General Data Protection Regulations (“GDPR”) include and demarcate countries against the European Union data sharing club. There is a specialised authority making decisions and consulting legislative authorities for making decisions on those matters, and renewing Adequacy decisions. The EU has consistently outlined standards of data protection relating to how much power sovereigns have over their data, and outlining reasonable situations for sovereign authorities to tap into their citizens’ data. In Schrems I and II, the Commission punished the United States’ Federal Bureau of Investigation’s attempt to forcefully obtain data from Facebook by taking the United States out of the EU data sharing club. 

India’s legislative machinery for cross-border data transfers under section 16, on the other hand, does not provide any opportunity for hearing, notice, or even a solid criteria. As such, India’s revolutionary negative blacklist model is a boon for the Indian economy, as it makes it convenient for foreign entities to set up shop here, as they do not have to wait to be put into a Data sharing club like they have to in the EU. However, this negative blacklisting model without any formal criteria for the executive to make decisions under results in the predictable creation of a geoblocked competitive ecosystem for online digital markets.

Geoblocking as a Market-Distorting Mechanism

Geoblocking is a market distortion mechanism which was frequently used by e-commerce websites within the EU, so as to curb perceived high regulatory costs. E-commerce websites used to segment the availability of certain products according to a user’s IP address and the country they inhabit. A user in country A had access to only the goods made and sold in country A, and the same applies for a user in country B. This market segmentation is an inherently anticompetitive act, as sellers within country A would have a competitive advantage over those in country B, all substantiated by the e-commerce websites. Commodities/goods in country A and B would therefore be unable to compete with each other, as they would be segmented away through the user’s IP address. This was held to be inherently anticompetitive, and then came the EU GeoBlocking Regulation. Studies were conducted on the GeoBlocking Regulation i.e., the banning of Geoblocking practices (except for justified instances) on 4 different commodities across the EU, and it found that the EU had a net 1.4% increase in their consumer surplus (the economic benefit consumers receive), with much higher variances across individual countries within the EU. 

Geoblocking practices are actively worse for consumers, and the economy at large, as it causes the distortion of market competition wherever applied. Geoblocking practices have been understood to be harmful even under Indian antitrust jurisprudence, as it is seen to be a vertical restraint on competition under the Competition Act, 2002 (agreements on geographic segmentation). It is understood that geoblocking is a harmful act, prejudicing the competitive ecology and the economy of the country.

Section 16 of the DPDP Act, in its application, can be seen to have a similar impact on competition. The DPDP Act has the legislative structure to substantiate an identical framework to geoblock India’s digital economy either to within itself, or towards other countries without any regards as to which company, or online display advertisement entity, would accidentally benefit, by the ban. Additionally, a State imposed data flow ban under the DPDPA would not even have any procedural safeguards like the right to a fair hearing, or even data protection considerations and investigations to be undertaken. Section 16 of the Act, therefore, allows for a blanket ban to be placed on all data flow towards a country, without any thought or justification by the central government, without any scope or criteria to argue against for the country to justify their data flow exchange towards.

How State-Sanctioned Geoblocking Produces Anticompetitive Effects

State sanctioned geoblocking creates a vertical foreclosure by effectively mandating a market segmentation for all players relying on that data. This predictably creates a protected, non-competitive domestic environment for certain existing or favoured players. This enables market players to exist in a segregated, anticompetitive environment. 

Data is the input of the digital economy, and for competitors in the online display advertising industry, it is a critical element of their functioning as a business. This input would be foreclosed to companies which host their data centres in the blacklisted countries. It has been held in Meta v. CCI that data asymmetry, and policies which abuse one’s dominance towards that end, intensifies entry barriers, as data is the key central input required for online display advertising to work. India’s geoblocked environment would cause the input to be restricted to certain firms, giving them an incumbent competitive advantage. A geoblocked environment in the field of online display advertising would result in reduced contestability, and an increased concentration within the domestic market, as some players have received an incumbent advantage over others. 

Geoblocking performs poorly in digital markets because it collapses network effects, reduces data-scale advantages, and forecloses access to the key input that drives quality and innovation in online display advertising. In zero-price markets, harm manifests as degradation of quality, innovation, and choice, rather than price increases. Section 16 enables State-imposed input foreclosure, a textbook competition harm, and raises rivals’ costs by forcing market players to operate in segmented, smaller ecosystems. The predictable result is reduced contestability and increased concentration, which neither the Competition Commission of India nor judicial review is empowered to correct.

The Competition Act only permits action against enterprises; it does not empower CCI to review sovereign regulatory design or executive notifications. Section 16 therefore creates a structural antitrust distortion that lies outside the jurisdictional perimeter of the competition regulator. 

Why Unchecked Discretion Predictably Produces Distortion

Public Choice Theory exemplifies the idea that no government servant acts for the public good, or for some greater purpose; rather, they are all motivated by different self interests. Every political act is therefore the aggregate outcome of individual preferences and incentives. The central government, when granted broad powers for executive discretion, can always be seen to abuse it. Unrestrained ability for executive discretion results in the persons in power abusing it. Moreover, giving the executive absolutely no restrictions as a human actor results in any and all of their respective preferences and incentives being enabled. 

In this regard, the adequacy standards of the EU GDPR are seen to be a positive model for handling cross border data flows, meaning when an adequacy decision is made in favour of a country, they are integrated into a EU data sharing club of sorts, where all are free to share with each other. These adequacy decisions are made by the European Commission, with the European Data Protection Board, with the European Parliament being able to scrutinise whether or not the Commission acted within the powers granted to it. There are many checks and balances present inherently within the EU positive model for cross border data transfer. The absence of criteria in the negative model produces predictable distortions in the market.

Considering  that the power to blacklist can be abused, India needs to implement a legislative amendment by way of the parliament for there to exist proper and real criteria for the Central Government to make decisions on behalf of the country. In addition to this, the parliament should also make it so that the principles of natural justice are followed so that the blocked countries are given the ability to defend themselves in a proper forum. The European Union’s Commission has made it so that the particular adequacy decision would be made on three hard set criterias: firstly,the state of human rights within the particular country (how the country treats fundamental freedoms, how it handles state to citizen relations). Secondly, if there’s an authority to regulate the data protection matters within the country. Lastly, if the treaties/international obligations a country is party to satisfactory (ie doesn’t pose a threat to the data). These criteria are hard set, and ensure that data protection is a priority, and maintain competitive neutrality. Through this, the Central Government would have to prove all these criteria against a particular country for the country to be blacklisted from India. With these particular criteria, judicial review would also be ensured to enforce these standards. 

Conclusion

Section 16 of the DPDP Act, as of right now, causes cross border data restrictions, as it allows the executive broad powers to blacklist a country. This results in the executive predictably abusing that power, and creating a geoblocked environment. Geoblocking, in turn,  leads to some domestic or whitelisted countries having an incumbent advantage the Competition Commission of India is helpless to fix, alongside the harm it contributes to the innovation within the online display advertising industry, resulting in economic losses to the whole country, as competition and the economy are intrinsically interlinked. This problem can be curbed by an amendment to the DPDPA, done by the parliament, to maintain competitive neutrality, and enhance the ideals of data privacy.

Endnotes

1.  In re WhatsApp LLC and Meta Platforms Inc (2024) Competition Commission of India, Suo Motu Case No. 01 of 2021 and Case Nos. 05 of 2021 & 30 of 2021, para 28.

2. (n 1), para 226. 

3. (n 1) para 28.6.

4.  M P Jain and S N Jain, Principles of Administrative Law (8th Edn, LexisNexis 2017) 419.

About the Author

Janvi P Antony is a student at the National University of Advanced Legal Studies, Kochi