The growing need for comprehensive data protection legislation and evolving concerns around the processing of data reverberates louder than ever amidst significant technological disruptions. The digital ecosystem has dramatically transformed over the last few years in India and the sectoral regulators have come up with several guidelines, policies and regulations to address specific concerns around the protection of data and consumer interests.
The Joint Parliamentary Committee (JPC) submitted its report on the Personal Data Protection Bill, 2019 and presented an updated version, i.e. the draft Data Protection Bill, 2021 (Bill), to the Parliament recently after deliberation of almost 2 years. The JPC has proposed certain significant changes such as the inclusion of non-personal data, digital media regulations and certification of digital and IoT devices that will impact businesses in a larger way, leading to demands for fresh industry-wide consultations on the Bill.
On the other hand, the JPC also provided clarity on the implementation and enforcement, which has largely been welcomed by business organisations.
Also Read
The business community seem to be divided over the data localisation mandate. The JPC recommended that the Central Government should ensure that a mirror copy of the sensitive personal data and critical personal data stored abroad is brought back to India and formulate a comprehensive policy on localisation in consultation with sectoral regulators.
The move could harm small businesses and organisations in absence of adequate infrastructure in the shorter run but may prove to be beneficial for domestic businesses in the longer run. The approach towards localisation could also act as an entry barrier for foreign businesses. Further, the inclusion of the Government in the consultative role for granting approval for cross-border transfer of sensitive personal data through contract or an intra-group scheme is perceived by businesses as making the entire process cumbersome and slow.
There are considerable concerned voices in the business community against the unorthodox inclusion of several provisions in the Bill. To elucidate: (a) non-personal data has been included within the purview of the Bill; (b) social media platforms will be held accountable for the content they host from unverified accounts; (c) Government should make efforts to establish a mechanism for the formal certification process for all digital and IoT devices. Though these recommendations impact businesses in different ways, the theme of the growing concern is that the JPC is misguided in its approach to include such obligations in a data protection law.
Further, the Bill also complicates intellectual property/trade secret concerns of the businesses with the fact that the businesses will now have to demonstrate the fairness of the algorithm or method used for processing of personal data and they will not be allowed to deny a request for data portability on the ground of trade secret.
As a relief to businesses and start-ups, the JPC has removed the concept of fixed penalties and it has recommended that penalties should be subject to a maximum cap and the quantum to be imposed should be decided taking into account factors such as the size and nature of the business. It also provides much needed clarity and room for business organisations to realign their business practices and policies with the Bill as businesses will now have a period of 24 months from the date of enforcement of the law for ensuring compliance.
Business organisations, however, think that the JPC went overboard with the inclusion of liability for non-compliance on the independent director/non-executive director. However, the liability is extended only in cases where the director did not act diligently or where non-compliance occurred with his knowledge.
Securing the privacy of children in the digital world has found prominence in the Bill with businesses now having more obligations in relation to processing of children’s personal data. Businesses dealing exclusively with children’s data are required to register themselves with the Data Protection Authority. They are now also required to verify the age of the child and obtain consent of the child’s parent or guardian.
Essentially, the Bill also makes provision for the child to opt out or provide fresh consent on attaining majority (i.e. 18 years). The business organisations are concerned about the embargo on profiling, tracking, behaviourally monitoring children and their data, or targeting advertisements at children, or processing any personal data that can cause significant harm to the child. The primary contention of the business community is that JPC has retained a generic ban on ‘profiling’, ‘tracking’ ‘monitoring’, ‘advertisements’ and ‘processing’, and failed to take into account the nuances and significance of each activity.
It is possible that India may have a comprehensive data protection legislation this year as a draft law is expected to be laid before the Parliament soon. However, there are certain critical issues that may need to be ironed out, including their interplay with sectoral regulators. Certainty in terms of the basic framework of the data protection law would help businesses plan their compliance strategy efficiently.
—The authors, Supratim Chakraborty is Partner & Ankit Chhaparia is Associate at Khaitan & Co LLP. Views expressed are personal
(Edited by : Priyanka Deshpande)
First Published: Feb 14, 2022 5:15 PM IST
