I'll start with a warning that you need to untaint this data carefully. This appears to be part of some CGI application, so that goes double. Also, the *DATA handle is reserved for data at the tail of your script, after a __END__ or __DATA__ or Ctrl-Z.

You have an error in if (ref($data) eq 'SCALAR'). That asks if $data is a reference to a scalar, but then you treat $data as a string.

This is a neat problem to solve in perl 5.8+ because you can open a string as a file. The open function is able to take either a handle or a filename on its own. The difficulty with your puzzle is to distinguish between a string that is a filename and one that is csv data. It looks easy to, say, look for commas with a regex or index but that discounts the possibility of unexpected filenames.

How about taking the calling convention that a reference to a scalar is data and a string is a filename? That gives you what you seem to be writing towards.

You can detect a reference to a file handle with ref($foo) eq 'GLOB'. Lexical handles will be of that type. You could also insist that global handles be passed by reference. There is a lot of dwimmerie in dealing with filehandles, so testing is much to be desired for your sub.