India’s Foray in Personal Data Protection Law

        Digital India regulatory framework and laws that is not only are just but at same time fuels growth expectations, protect rights and interest of its citizens at the same time be Business friendly. Any regulation/law is restrictive in nature. India’s digital growth has been exponential which has led to the concern about Personal Data misuse and exploitation has also in tune. Union cabinet has approved Digital Personal Data Protection (DPDP) Bill 2022(revised bill) to be tabled in the upcoming monsoon season of parliament. Though, the consultation process for the bill is over by the Ministry of Electronics and Information Technology (MeitY), the final form will be available after rectification by Parliament. Privacy being fundamental right (as recognized in Aug 2017) is constitutional guarantee. In tune DPDP bill recognizes its need to protect Personal Data, at the same time be not restrictive for Businesses to use personal data lawfully. It lays out obligations and duties on part of Data Fiduciaries (Businesses), Processors (processing data on behalf of fiduciary) and Principals (whose personal data the business wishes to process, including children).

Legality

         The act is applicable on processing Digital personal Data within territorial boundaries of India. It is also applicable for processing of digital data outside territory of India, if done in connection to profiling or to that of any economic activity being done on Indian Territory. Exception being it is not applicable to non automated processing of personal data, offline data, data processed for domestic purposes and records that are over 100 years.

Impact on Business 

        It would be obligatory on fiduciary to give Principals an itemized notice in clear and plain language containing description of personal data sought purpose of obtaining it and obtain consent from principal. The consent needs to be obtained for pre dated data also.

        The Principals Rights to withdraw consent, manage/review consent, rectification, erasure and restricted processing are inherent. This is in tune with EU’s GDPR data subject’s privacy rights would require changes at operational level as well.

        Businesses would have to create Consent Managers (which would enable principals manage their consent) through interoperable platforms which would be registered to the Data Protection Board (DPB) [Section 7(7)]. MeitY has already released a specification for electronic consent ver 1.1 and so has the financial sector with its own Consent Managers for data sharing .The technical solution can vary from sector to sector and business to business.

        Significant fiduciary classified as such will appoint a DPO (Data Protection Officer) based in India and also appoint independent Data auditors for compliance.

        DPDP will lead to revision of Internal Data Policies and review/updating of IT, Data Protection, Data Retention and cyber security policies of companies. It will be reasonable that companies build adequate safeguard through policies, procedures and technologies to handle and process data.

People’s Privacy and Rights 

    User centricity, compliance with extant provisions of laws and granular control lead to right that principal can obtain from fiduciary confirmation/summary/identities of processors processing the data, rights to amendment (rectification), erasure, updation and grievance reprisal mechanism.

Transfer of Data 

        The Data Fiduciary may, where consent of the Data Principal has been obtained, may share, transfer or transmit the personal data to any Data Fiduciary/Processor to process personal data on its behalf under a valid contract. Central Govt may notify countries or territories outside India to which a Data Fiduciary may transfer personal data, in accordance with such terms and conditions as may be specified.The Bill has shedded the rigidity of cross border data transfer which plays a crucial role in easing data flows (helps corporations). The Bill has excluded data localisation requirements which will help in enabling small, medium and large enterprises to store data across geographies resulting in reduction of costs and time spent on localised data storage.

Children’s Age 

        For the purpose of act the age of child has been pegged at 18 years which will lead fiduciaries to obtain consent of parent/guardian of the principal. This age can be debated as it may seem to be on higher side. Post obtaining this parental consent, the Businesses will be required to ensure that such processing does not cause harm to children [Section 10(2)]. Businesses are also prohibited from undertaking tracking and behavioral monitoring of children or targeted advertisements towards them [Section 10(3)].

Conclusion 

        It remains to be seen in what form the bill becomes the law. Whatever be the changes the bill is going to be milestone in way our personal data is handled. Further, it remains to be seen how the DPB and government with its notifications and amendments give final shape to the law. It will lead to cost increase in business at the same time create job opportunities in the field. What GDPR enactment brought to Europe and the business there same can be expected in India.

MUMBAI MERI JAAN

Why Anguish this time when Mumbai is under Terror Attack ? It is not the first time that we are facing the burnt.This time it is special.Anguish and cry out Loud because it is not the poor but the Rich and affluent who have been targeted.Till last incident they were seeing it on there Plasma screens in their homes,Bars and Restaurants insulated climatically.Commenting that the Government is weak, our forces are incompetent so on and so forth. Ironically the one such joint was TAJ Mumbai.Till last time we saw the elite come out in press and media condemning the attacks but in the same breath talked about the spirit of the city.I wonder why? Was it that there next stop or the business meeting in an insulated environment should not be reflected in a bad taste.Or was it that they were in an insulated environment.My dear Suhel seths ,Javed Akhtars and Sobha Deys it was not the spirit of poor people but need to burn their hearths.
This time it was different.Cry aloud for the Rich have been killed.This time it is not the spirit of Mumbai because it had hit the core the rich.This time most of them felt angered who till last time talked about restrain.Do you see the irony?
In no way i am suggesting that lives lost were not innocent.They were.Problem is we may talk this time the Government may set up commissions and inquiries but when shall we see the light?
Talks about the great Indian Democracy.Where is it?I did not find it in any Newspaper or the ever blabbing News channels. No need to appeal to the people for our democratic setup is so strong that if Osama stand in election today I guarantee 110 % he will reach the parliament .Oh please do stand in election Mr Dawood And Mr Osama. We do need a change.
Lapses and lapses would have led to this.Where is the accountability.Compensation is no accountability.Any politician declaring compensation should be ............ i am out of words.Why cant as a nation we have a system of accountability?
Till then we will all feel cheated and can only talk and at times write a blog in anguish.
Mumbai meri jaan and India mere watan we get what we deserve.

@## read earlier blog advice to osamas feb 2008

FOR MY EYES ONLY (PART II)

The year is coming to an end surely and not so slowly.It also has been the steepest learning curve for me in terms of my profession particularly in an unit.Learning at times even involves unlearning what one had learned so far.I am writing here because in future when I look back I can at least take a clue.

Lesson No 1.
Unit Administration is not that simple and certainly cannot be ignored.For the first time I probably have a senior who has guided me like a senior subaltern should have done in my first unit.(For this is my second unit only unfortunately or fortunately). Not that my first unit subalterns were not that competent but the boss had a policy East is East and West is west the twine shall never meet.Whenever two subalterns were seen together it was perceived to be a plot being hatched hence the question why are you two here? So like two ends of a dipole we were dispatched in diagonally opposite directions.So much so for my first unit.Unit administration needs more attention at most of the times in our so called Technical Unit.

Lesson No 2.
Meet your command thrice a Day.For lets' not forget the raison d'etre leaders of men.

Lesson No 3.
It is always hard but satisfying to do things what is right rather than work on the fashionable policy of the unit is of the CO and 'sannu ki'.The choice of good and successful officer what we used to hear is I suppose is to be made here.I don't know yet what choice I will make when the days of reckoning will come and when it comes.

Lesson No 4.
Tactical or Technical? I think this is beyond the scope of this diary at the same time I hope to seek the answer at some time in near future.

Lesson NO 5.
Never mix pleasure with work. Would seem contradictory to corporate belief but then we are not one and neither is our social fabric.

Lesson No 6.
Knowing the rules help.It is the only way at times.

My earlier version (see post of Feb 08 )is in total contrast probably this is the coup de theatre before one picks field rank.