The Centre for Internet and Society
https://cis-india.org
These are the search results for the query, showing results 11 to 25.
How Function Of State May Limit Informed Consent: Examining Clause 12 Of The Data Protection Bill
https://cis-india.org/internet-governance/blog/medianama-february-18-2021-amber-sinha-data-protection-bill-consent-clause-state-function
<b>The collective implication of leaving out ‘proportionality’ from Clause 12 is to provide very wide discretionary powers to the state.</b>
<p>The blog post was <a class="external-link" href="https://www.medianama.com/2022/02/223-data-protection-bill-consent-clause-state-function/">published in Medianama</a> on February 18, 2022. This is the first of a two-part series by Amber Sinha.</p>
<hr />
<p style="text-align: justify; ">In 2018, hours after the Committee of Experts led by Justice Srikrishna Committee released their report and draft bill, I wrote <a href="https://www.livemint.com/Opinion/zY8NPWoWWZw8AfI5JQhjmL/Draft-privacy-bill-and-its-loopholes.html">an opinion piece</a> providing my quick take on what was good and bad about the bill. A section of my analysis focused on Clause 12 (then Clause 13) which provides for non-consensual processing of personal data for state functions. I called this provision a ‘carte-blanche’ which effectively allowed the state to process a citizen’s data for practically all interactions between them without having to deal with the inconvenience of seeking consent. My former colleague, Pranesh Prakash <a href="https://twitter.com/pranesh/status/1023116679440621568">pointed out</a> that this was not a correct interpretation of the provision as I had missed the significance of the word ‘necessary’ which was inserted to act as a check on the powers of the state. He also pointed out, correctly, that in its construction, this provision is equivalent to the position in European General Data Protection Regulation (Article 6 (i) (e)), and is perhaps even more restrictive.</p>
<p style="text-align: justify; ">While I agree with what Pranesh says above (his claims are largely factual, and there can be no basis for disagreement), my view of Clause 12 has not changed. While Clause 35 has been a focus of considerable discourse and analysis, for good reason, I continue to believe that Clause 12 remains among the most dangerous provisions of this bill, and I will try to unpack here, why.</p>
<p style="text-align: justify; ">The Data Protection Bill 2021 has a chapter on the grounds for processing personal data, and one of those grounds is consent by the individual. The rest of the grounds deal with various situations in which personal data can be processed without seeking consent from the individual. Clause 12 lays down one of the grounds. It allows the state to process data without the consent of the individual in the following cases —</p>
<p>a) where it is necessary to respond to a medical emergency<br />b) where it is necessary for state to provide a service or benefit to the individual<br />c) where it is necessary for the state to issue any certification, licence or permit<br />d) where it is necessary under any central or state legislation, or to comply with a judicial order<br />e) where it is necessary for any measures during an epidemic, outbreak or public health<br />f) where it is necessary for safety procedures during disaster or breakdown of public order</p>
<p>In order to carry out (b) and (c), there is also the added requirement that the state function must be authorised by law.</p>
<h2>Twin restrictions in Clause 12</h2>
<p style="text-align: justify; ">The use of the words ‘necessary’ and ‘authorised by law’ is intended to pose checks on the powers of the state. The first restriction seeks to limit actions to only those cases where the processing of personal data would be necessary for the exercise of the state function. This should mean that if the state function can be exercised without non-consensual processing of personal data, then it must be done so. Therefore, while acting under this provision, the state should only process my data if it needs to do so, to provide me with the service or benefit. The second restriction means that this would apply to only those state functions which are authorised by law, meaning only those functions which are supported by validly enacted legislation.</p>
<p style="text-align: justify; ">What we need to keep in mind regarding Clause 12 is that the requirement of ‘authorised by law’ does not mean that legislation must provide for that specific kind of data processing. It simply means that the larger state function must have legal backing. The danger is how these provisions may be used with broad mandates. If the activity in question is non-consensual collection and processing of, say, demographic data of citizens to create state resident hubs which will assist in the provision of services such as healthcare, housing, and other welfare functions; all that may be required is that the welfare functions are authorised by law.</p>
<h2 style="text-align: justify; ">Scope of privacy under Puttaswamy</h2>
<p style="text-align: justify; ">It would be worthwhile, at this point, to delve into the nature of restrictions that the landmark Puttaswamy judgement discussed that the state can impose on privacy. The judgement clearly identifies the principles of informed consent and purpose limitation as central to informational privacy. As discussed repeatedly during the course of the hearings and in the judgement, privacy, like any other fundamental right, is not absolute. However, restrictions on the right must be reasonable in nature. In the case of Clause 12, the restrictions on privacy in the form of denial of informed consent need to be tested against a constitutional standard. In Puttaswamy, the bench was not required to provide a legal test to determine the extent and scope of the right to privacy, but they do provide sufficient guidance for us to contemplate how the limits and scope of the constitutional right to privacy could be determined in future cases.</p>
<p style="text-align: justify; ">The Puttaswamy judgement clearly states that “the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution.” By locating the right not just in Article 21 but also in the entirety of Part III, the bench clearly requires that “the drill of various Articles to which the right relates must be scrupulously followed.” This means that where transgressions on privacy relate to different provisions in Part III, the different tests under those provisions will apply along with those in Article 21. For instance, where the restrictions relate to personal freedoms, the tests under both Article 19 (right to freedoms) and Article 21 (right to life and liberty) will apply.</p>
<p style="text-align: justify; ">In the case of Clause 12, the three tests laid down by Justice Chandrachud are most operative —<br />a) the existence of a “law”<br />b) a “legitimate State interest”<br />c) the requirement of “proportionality”.</p>
<p style="text-align: justify; ">The first test is already reflected in the use of the phrase ‘authorised by law’ in Clause 12. The test under Article 21 would imply that the function of the state should not merely be authorised by law, but that the law, in both its substance and procedure, must be ‘fair, just and reasonable.’ The next test is that of ‘legitimate state interest’. In its report, the Joint Parliamentary Committee places emphasis on Justice Chandrachud’s use of “allocation of resources for human development” in an illustrative list of legitimate state interests. The report claims that the ground, functions of the state, thus satisfies the legitimate state interest. We do not dispute this claim.</p>
<h2 style="text-align: justify; ">Proportionality and Clause 12</h2>
<p style="text-align: justify; ">It is the final test of ‘proportionality’ articulated by the Puttaswamy judgement, which is most operative in this context. Unlike Clauses 42 and 43 which include the twin tests of necessity and proportionality, the committee has chosen to only employ one ground in Clause 12. Proportionality is a commonly employed ground in European jurisprudence and common law countries such as Canada and South Africa, and it is also an integral part of Indian jurisprudence. As commonly understood, the proportionality test consists of three parts —</p>
<p>a) the limiting measures must be carefully designed, or rationally connected, to the objective<br />b) they must impair the right as little as possible<br />c) the effects of the limiting measures must not be so severe on individual or group rights that the legitimate state interest, albeit important, is outweighed by the abridgement of rights.</p>
<p style="text-align: justify; ">The first test is similar to the test of proximity under Article 19. The test of ‘necessity’ in Clause 12 must be viewed in this context. It must be remembered that the test of necessity is not limited to only situations where it may not be possible to obtain consent while providing benefits. My reservations with the sufficiency of this standard stem from observations made in the report, as well as the relatively small amount of jurisprudence on this term in Indian law.</p>
<p style="text-align: justify; ">The Srikrishna Report interestingly mentions three kinds of scenarios where consent should not be required — where it is not appropriate, necessary, or relevant for processing. The report goes on to give an example of inappropriateness. In cases where data is being gathered to provide welfare services, there is an imbalance in power between the citizen and the state. Having made that observation, the committee inexplicably arrives at a conclusion that the response to this problem is to further erode the power available to citizens by removing the need for consent altogether under Clause 12. There is limited jurisprudence on the standard of ‘necessity’ under Indian law. The Supreme Court has articulated this test as ‘having reasonable relation to the object the legislation has in view.’ If we look elsewhere for guidance on how to read ‘necessity’, the ECHR in Handyside v United Kingdom held it to be neither “synonymous with indispensable” nor does it have the “flexibility of such expressions as admissible, ordinary, useful, reasonable or desirable.” In short, there must be a pressing social need to satisfy this ground.</p>
<p style="text-align: justify; ">However, the other two tests of proportionality do not find a mention in Clause 12 at all. There is no requirement of ‘narrow tailoring’, that the scope of non-consensual processing must impair the right as little as possible. It is doubly unfortunate that this test does not find a place, as unlike necessity, ‘narrow tailoring’ is a test well understood in Indian law. This means that while there is a requirement to show that processing personal data was necessary to provide a service or benefit, there is no requirement to process data in a way that there is minimal non-consensual processing. The fear is that as long as there is a reasonable relation between processing data and the object of the function of state, state authorities and other bodies authorised by it, do not need to bother with obtaining consent.</p>
<p style="text-align: justify; ">Similarly, the third test of proportionality is also not represented in this provision. It provides a test between the abridgement of individual rights and legitimate state interest in question, and it requires that the first must not outweigh the second. The absence of the proportionality test leaves Clause 12 devoid of any such consideration. Therefore, as long as the test of necessity is met under this law, it need not evaluate the denial of consent against the service or benefit that is being provided.</p>
<p style="text-align: justify; ">The collective implication of leaving out ‘proportionality’ from Clause 12 is to provide very wide discretionary powers to the state, by setting the threshold to circumvent informed consent extremely low. In the next post, I will demonstrate the ease with which Clause 12 can allow indiscriminate data sharing by focusing on the Indian government’s digital healthcare schemes.</p>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/blog/medianama-february-18-2021-amber-sinha-data-protection-bill-consent-clause-state-function'>https://cis-india.org/internet-governance/blog/medianama-february-18-2021-amber-sinha-data-protection-bill-consent-clause-state-function</a>
</p>
No publisheramberData GovernanceInternet GovernanceData ProtectionPrivacy2022-03-01T14:56:49ZBlog EntryCIS Comments and Recommendations on the Data Protection Bill, 2021
https://cis-india.org/internet-governance/blog/pallavi-bedi-and-shweta-mohandas-cis-comments-on-data-protection-bill
<b>This document is a revised version of the comments we provided on the 2019 Bill on 20 February 2020, with updates based on the amendments in the 2021 Bill.</b>
<p style="text-align: justify; ">After nearly two years of deliberations and a few changes in its composition, the Joint Parliamentary Committee (JPC), on 17 December 2021, submitted its report on the Personal Data Protection Bill, 2019 (2019 Bill). The report also contains a new version of the law titled the Data Protection Bill, 2021 (2021 Bill). Although there were no major revisions from the previous version other than the inclusion of all data under the ambit of the bill, some provisions were amended.</p>
<p style="text-align: justify; ">This document is a revised version of the<a href="https://cis-india.org/accessibility/blog/cis-comments-pdp-bill-2019"> comments</a> we provided on the 2019 Bill on 20 February 2020, with updates based on the amendments in the 2021 Bill. Through this document we aim to shed light on the issues that we highlighted in our previous comments that have not yet been addressed, along with additional comments on sections that have become more relevant since the pandemic began. In several instances our previous comments have either not been addressed or only partially been addressed; in such instances, we reiterate them.</p>
<p style="text-align: justify; ">These general comments should be read in conjunction with our previous recommendations for the reader to get a comprehensive overview of what has changed from the previous version and what has remained the same. This document can also be read while referencing the new Data Protection Bill 2021 and the JPC’s report to understand some of the significant provisions of the bill.</p>
<hr />
<p style="text-align: justify; "><strong><a href="https://cis-india.org/internet-governance/general-comments-data-protection-bill.pdf" class="internal-link">Read on to access the comments</a> | </strong><span>Review and editing by Arindrajit Basu. Copy editing: The Clean Copy; Shared under Creative Commons Attribution 4.0 International license</span></p>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/blog/pallavi-bedi-and-shweta-mohandas-cis-comments-on-data-protection-bill'>https://cis-india.org/internet-governance/blog/pallavi-bedi-and-shweta-mohandas-cis-comments-on-data-protection-bill</a>
</p>
No publisherPallavi Bedi and Shweta MohandasInternet GovernanceData ProtectionPrivacy2022-02-14T16:07:44ZBlog EntryThe Competition Law Case Against Whatsapp’s 2021 Privacy Policy Alteration
https://cis-india.org/internet-governance/blog/the-competition-law-case-against-whatsapp2019s-2021-privacy-policy-alteration
<b>Having examined the privacy implications of Whatsapp's changes to its privacy policy in 2021, this issue brief is the second output in our series examining the effects of those changes. This brief examines the changes in the context of data sharing between Whatsapp and Facebook as being an anticompetitive action in violation of the Indian Competition Act, 2002. </b>
<span id="docs-internal-guid-2e4a5c52-7fff-f416-6970-948314f0b524">
<p style="text-align: justify;" dir="ltr"> </p>
<h3 style="text-align: justify;">Executive Summary</h3>
<p style="text-align: justify;" dir="ltr">On January 4, 2021, Whatsapp announced a revised privacy policy through an in-app notification. It highlighted that the new policy would impact user interactions with business accounts, including those which may be using Facebook's hosting services. The updated policy presented users with the option of either accepting greater data sharing between Whatsapp and Facebook or being unable to use the platform post 15th May, 2021. The updated policy resulted in temporarily slowed growth for Whatsapp and increased growth for other messaging apps like Signal and Telegram. While Whatsapp has chosen to delay the implementation of this policy due to consumer outrage, it is important for us to unpack and understand what this (and similar policies) mean for the digital economy, and its associated competition law concerns. Competition law is one of the sharpest tools available to policy-makers to fairly regulate and constrain the unbridled power of large technology companies.</p>
<p style="text-align: justify;" dir="ltr">While it is evident the Indian competition landscape will benefit from revisiting the existing law and policy framework to reign in Big technology companies, we argue that the change in Whatsapp’s privacy policy in 2021 can be held anti-competitive using legal provisions as they presently stand. Therefore, in this issue brief, we largely limit ourselves to evaluating the legality of Whatsapp’s privacy policy within the confines of the present legal system. </p>
<p style="text-align: justify;" dir="ltr">First, we dive into an articulation of the present abuse of dominance framework in Indian Competition Law. Second, we analyze whether there was abuse of dominance-bearing in mind an economic analysis of Whatsapp’s role in the relevant market by using tests laid out in previous rulings of the CCI</p>
<br />
<p style="text-align: justify;" dir="ltr">The framework for determining abuse of dominance as per The Competition Act is based on three factors:</p>
<p style="text-align: justify;" dir="ltr">1. Determination of relevant market</p>
<p style="text-align: justify;" dir="ltr">2. Determination of dominant position</p>
<p style="text-align: justify;" dir="ltr">3. Abuse of the dominant position</p>
<br />
<p style="text-align: justify;" dir="ltr">In two previous orders in 2016 and 2020, CCI has held that Whatsapp is dominant in its relevant market based on several factors which we explore. These include:</p>
<ol><li style="list-style-type: decimal;" dir="ltr">
<p style="text-align: justify;" dir="ltr">Advantage in user base, usage and reach,</p>
</li><li style="list-style-type: decimal;" dir="ltr">
<p style="text-align: justify;" dir="ltr">Barriers to entry for other competitors</p>
</li><li style="list-style-type: decimal;" dir="ltr">
<p style="text-align: justify;" dir="ltr">Power of acquisition over competitors.</p>
</li></ol>
<br />
<p style="text-align: justify;" dir="ltr">However, in both orders, CCI held that Whatsapp did not abuse its dominance by arguing that the practices in question allowed for user choice. We critique these judgments for not reflecting the market structures and exploitative practices of large technology companies. We also argue that even if we use the test of user choice laid down by the CCI in its previous orders concerning Whatsapp and Facebook, the changes made to the privacy policy in 2021 did abuse dominance,and should be held guilty of violating competition law standards.</p>
<p style="text-align: justify;" dir="ltr">Our analysis revolves around examining the explicit and implicit standards of user choice laid out by the CCI in its 2016 and 2020 judgements as the standard for evaluating fairness in an Abuse of Dominance claim.We demonstrate how the 2021 changes failed to meet these standards. </p>
<p style="text-align: justify;" dir="ltr">Finally, we conclude by noting that the present case offers a crucial opportunity for India to take a giant step forward in its regulation of big tech companies and harmonise its rulings with regulatory developments around the world.</p>
<p style="text-align: justify;" dir="ltr">The full issue brief can be found <a href="https://cis-india.org/internet-governance/whatsapp-privacy-policy-2021-issue-brief-competition-law">here</a></p>
<div> </div>
<p style="text-align: justify;" dir="ltr"> </p>
<p style="text-align: justify;" dir="ltr"> </p>
<div> </div>
</span>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/blog/the-competition-law-case-against-whatsapp2019s-2021-privacy-policy-alteration'>https://cis-india.org/internet-governance/blog/the-competition-law-case-against-whatsapp2019s-2021-privacy-policy-alteration</a>
</p>
No publisherAman Nair and Arindrajit BasuConsumer RightsDigital EconomyData ProtectionFacebookCompetitionWhatsAppCompetition Law2021-03-24T16:12:09ZBlog EntryA Guide to Drafting Privacy Policy under the Personal Data Protection Bill, 2019
https://cis-india.org/internet-governance/blog/shweta-reddy-september-17-2021-a-guide-to-drafting-privacy-policy-under-personal-data-protection-bill
<b>The Personal Data Protection Bill, 2019, (PDP Bill) which is currently being deliberated by the Joint Parliamentary Committee, is likely to be tabled in the Parliament during the winter session of 2021.</b>
<p style="text-align: justify;">The Bill in its current form, doesn’t have explicit transitory provisions i.e. a defined timeline for the enforcement of the provisions of the Bill post its notification as an enforceable legislation. Since the necessary subject matter expertise may be limited on short notice and out of budget for certain companies, we intend to release a series of guidance documents that will attempt to simplify the operational requirements of the legislation.</p>
<p style="text-align: justify;">Certain news reports had earlier suggested that the Joint Parliamentary Committee reviewing the Bill has proposed <a class="external-link" href="https://economictimes.indiatimes.com/news/politics-and-nation/parliamentary-panel-examining-personal-data-protection-bill-recommends-89-changes/articleshow/80138488.cms">89 new amendments and a new clause</a>. The nature and content of these amendments so far remain unclear. However, we intend to start the series by addressing some frequently asked questions around meeting the requirements of publishing a privacy notice and shall make the relevant changes post notification of the new Bill. The solutions provided in this guidance document are mostly based on international best practices and any changes in the solutions based on Indian guidelines and the revised PDP Bill will be redlined in the future.</p>
<p style="text-align: justify;">The frequently asked questions and other specific examples on complying with the requirements of publishing a privacy policy have been compiled based on informal discussions with stakeholders, unsolicited queries from smaller organizations and publicly available details from conferences on the impact of the Bill. We intend to conduct extensive empirical analysis of additional queries or difficulties faced by smaller organizations towards achieving compliance post the notification of the new Bill. Regardless, any smaller organizations(NGOs, start-ups etc.) interested in discussing compliance related queries can get in touch with us.</p>
<hr />
<p style="text-align: justify;">Click to download the <a href="https://cis-india.org/internet-governance/guide-to-personal-data-protection-bill.pdf" class="internal-link">full report here</a>. The report was reviewed by Pallavi Bedi and Amber Sinha.</p>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/blog/shweta-reddy-september-17-2021-a-guide-to-drafting-privacy-policy-under-personal-data-protection-bill'>https://cis-india.org/internet-governance/blog/shweta-reddy-september-17-2021-a-guide-to-drafting-privacy-policy-under-personal-data-protection-bill</a>
</p>
No publishershwetarInternet GovernanceData ProtectionPrivacy2021-09-20T10:34:40ZBlog EntryBeyond the PDP Bill: Governance Choices for the DPA
https://cis-india.org/internet-governance/blog/trishi-jindal-and-s-vivek-beyond-the-pdp-bill
<b>This article examines the specific governance choices the Data Protection Authority (DPA) in India must deliberate on vis-à-vis its standard-setting function, which are distinct from those it will encounter as part of its enforcement and supervision functions.</b>
<p style="text-align: justify;">The Personal Data Protection Bill, 2019, was introduced in the Lok Sabha on 11 December 2019. It lays down an overarching framework for personal data protection in India. Once revised and approved by Parliament, it is likely to establish the first comprehensive data protection framework for India. However, the provisions of the Bill are only one component of the forthcoming data protection framework It further proposes setting up the Data Protection Authority (DPA) to oversee the final enforcement, supervision, and standard-setting. The Bill consciously chooses to vest the responsibility of administering the framework with a regulator instead of a government department. As an independent agency, the DPA is expected to be autonomous from the legislature and the Central Government and capable of making expert-driven regulatory decisions in enforcing the framework.</p>
<p style="text-align: justify;">Furthermore, the DPA is not merely an implementing authority; it is also expected to develop privacy regulations for India by setting standards. As such, it will set the day-to-day obligations of regulated entities under its supervision. Thus, the effectiveness with which it carries out its functions will be the primary determinant of the impact of this Bill (or a revised version thereof) and the data protection framework set out under it.</p>
<p style="text-align: justify;">The final version for the PDP Bill may or may not provide the DPA with clear guidance regarding its functions. In this article, we emphasise the need to look beyond the Bill and instead examine the specific governance choices the DPA must deliberate on vis-à-vis its standard-setting function, which are distinct from those it will encounter as part of its enforcement and supervision functions.</p>
<p style="text-align: justify;"><strong>A brief timeline of the genesis of a distinct privacy regulator for India</strong></p>
<p style="text-align: justify;">The vision of an independent regulator for data protection in India emerged over the course of several intervening processes that set out to revise India’s data protection laws. In fact, the need for a dedicated data protection regulation for India, with enforceable obligations and rights, was debated years before the <a href="https://thewire.in/government/privacy-aadhaar-supreme-court">Aadhaar</a>, <a href="https://www.thehindu.com/news/national/urgent-need-for-data-protection-laws-experts/article23314655.ece">Cambridge Analytica</a>, and <a href="https://www.livemint.com/opinion/online-views/pegasus-has-given-privacy-legislation-a-jab-of-urgency-11628181453098.html">Pegasus</a><sup> </sup>revelations captured the public imagination and mainstreamed conversations on privacy.</p>
<p style="text-align: justify;">The <a href="https://cis-india.org/internet-governance/draft-bill-on-right-to-privacy">Right to Privacy Bill, 2011</a>, which never took off, recognised the right to privacy in line with Article 21 of the Constitution of India, which pertains to the right to life and personal liberty. The Bill laid down express conditions for collecting and processing data and the rights of data subjects. It also proposed setting up a Data Protection Authority (DPA) to supervise and enforce the law and advise the government in policy matters. Upon review by the Cabinet, it was <a href="https://cis-india.org/internet-governance/draft-bill-on-right-to-privacy">suggested</a> that the Authority be revised to an Advisory Council, given its role under the Bill was limited.</p>
<p style="text-align: justify;">Subsequently, in 2012, the AP Shah Committee Report <a href="https://cis-india.org/internet-governance/blog/report-of-group-of-experts-on-privacy.pdf">recommended</a> a principle-based data protection law, focusing on set standards while refraining from providing granular rules, to be enforced through a co-regulatory structure. This structure would consist of central and regional-level privacy commissioners, self-regulatory bodies, and data protection officers appointed by data controllers. There were also a few private members’ bills <a href="https://saveourprivacy.in/media/all/Brief-PDP-Bill-25.12.2020.pdf">introduced</a> between 2011 and 2019.</p>
<p style="text-align: justify;">None of these efforts materialised, and the regulatory regime for data protection and privacy remained embedded within the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules). Though the <a href="https://www.meity.gov.in/writereaddata/files/GSR313E_10511%281%29_0.pdf">SPDI Rules</a> require body corporates to secure personal data, their enforcement is <a href="https://www.indiacode.nic.in/show-data?actid=AC_CEN_45_76_00001_200021_1517807324077&orderno=49">limited</a> to cases of negligence in abiding by these limited set of obligations pertaining to sensitive personal information only, and which have caused wrongful loss or gain – a high threshold to prove for aggrieved individuals. Otherwise, the <a href="https://www.meity.gov.in/writereaddata/files/GSR314E_10511%281%29_0.pdf">Intermediary Guidelines</a>, 2011 require all intermediaries to generally follow these Rules under Rule 3(8). The enforcement of these obligations is <a href="https://www.ikigailaw.com/dispute-resolution-framework-under-the-information-technology-act-2000/#acceptLicense">entrusted</a> to adjudicating officers (AO) appointed by the central government, who are typically bureaucrats appointed as AOs in an ex-officio capacity.</p>
<p style="text-align: justify;">By 2017, the Aadhaar litigations had provided additional traction to the calls for a dedicated and enforceable data protection framework in India. In its judgement, the Supreme Court <a href="https://main.sci.gov.in/supremecourt/2012/35071/35071_2012_Judgement_24-Aug-2017.pdf">recognised</a> the right to privacy as a fundamental right in India and stressed the need for a dedicated data protection law. Around the same time, the Ministry of Electronics and Information Technology (MeitY) constituted a <a href="https://pib.gov.in/newsite/PrintRelease.aspx?relid=169420">committee of experts</a> under the chairmanship of Justice BN Srikrishna. The Srikrishna Committee undertook public consultations on a 2017 <a href="https://www.meity.gov.in/writereaddata/files/white_paper_on_data_protection_in_india_171127_final_v2.pdf">white paper</a>, which culminated in the nearly comprehensive <a href="https://www.meity.gov.in/writereaddata/files/Personal_Data_Protection_Bill,2018.pdf">Personal Data Protection Bill, 2018</a>, and an accompanying <a href="https://www.meity.gov.in/writereaddata/files/Data_Protection_Committee_Report.pdf">report</a>. This 2018 Bill outlined a regulatory framework of personal data processing for India and defined data processing entities as fiduciaries, which owe a duty of care to individuals to whom personal data relates. The Bill provided for the setting up of an independent regulator that would, among other things, specify further standards for data protection and administer and enforce the provisions of the Bill.</p>
<p style="text-align: justify;">MeitY invited public comments on this Bill and tabled a revised version, the Personal Data Protection <a href="http://164.100.47.4/BillsTexts/LSBillTexts/Asintroduced/373_2019_LS_Eng.pdf">Bill</a>, 2019 (PDP Bill), in the Lok Sabha in December 2019. Following public pressure calling for detailed discussions on the Bill before its passing, it was referred to a <a href="http://loksabhaph.nic.in/Committee/CommitteeInformation.aspx?comm_code=73&tab=1">Joint Parliamentary Committee</a> (JPC) constituted for this purpose. It currently remains under review; the JPC is <a href="https://www.hindustantimes.com/india-news/need-state-level-data-protection-authorities-joint-parliamentary-committee-mp-amar-patnaik-101632679181340.html">reportedly</a> expected to table its report in the 2021 Winter Session of Parliament. Though the Bill is likely to undergo another <a href="https://www.hindustantimes.com/india-news/over-100-drafting-changes-proposed-to-jpc-on-data-protection-bill-101631730726756.html">round of revisions</a> following the JPC’s review, this is the closest India has come to realising its aspirations of establishing a dedicated and enforceable data protection framework.</p>
<p style="text-align: justify;">This Bill carries forward the choice of a distinct regulatory body, though <a href="https://thewire.in/tech/india-data-protection-authority-needs-constitutional-entrenchment">questions remain</a> on the degree of its independence, given the direct control granted to the central government in appointing its members and funding the DPA.</p>
<p style="text-align: justify;"><strong>Conceptualising an Independent DPA</strong></p>
<p style="text-align: justify;">The Srikrishna Committee’s 2017 white paper and its 2018 report on the PDP Bill discuss the need for a regulator in the context of <em>enforcement</em> of its provisions. However, the DPA under the PDP Bill is tasked with extensive powers to frame detailed regulations and codes of conduct to inform the day-to-day obligations of data fiduciaries and processors. To be clear, the standard-setting function for a regulator <a href="https://ssrn.com/abstract=1393647">entails</a> laying down the standards based on which regulated entities (i.e. the data fiduciaries) will be held accountable, and the manner in which they may conduct themselves while undertaking the regulated activity (i.e. personal data processing). This is in addition to its administrative and enforcement, and quasi-judicial functions, as outlined below:</p>
<p style="text-align: justify;"><strong>Functions of the DPA under the PDP Bill 2019</strong></p>
<p style="text-align: justify;"><strong><img src="https://cis-india.org/home-images/PDPBill.png/@@images/93bcf598-962a-48f1-b1b1-78933dac5d27.png" alt="null" class="image-inline" title="PDP" /></strong></p>
<p style="text-align: justify;">At this stage, it is important to note that the choice of regulation via a regulator is distinct from the administration of the Bill by the central or state governments. Creating a distinct regulatory body allows government procedures to be replaced with expert-driven decision-making to ensure sound economic regulation of the sector. At the same time, the independence of the regulatory authority <a href="https://www.oxfordhandbooks.com/view/10.1093/law/9780198704898.001.0001/oxfordhb-9780198704898">insulates it</a> from political processes. The third advantage of independent regulatory authorities is the scope for ‘operational flexibility’, which is embodied in the relative autonomy of its employees and its decision-making from government scrutiny.</p>
<p style="text-align: justify;">This is also the rationale provided by the Srikrishna Committee in stating their choice to entrust the administration of the data protection law to an independent DPA. The 2017 white paper that preceded the 2018 Srikrishna Committee Report proposed a distinct regulator to provide expert-driven enforcement of laws for the highly specialised data protection sphere. Secondly, the regulator would serve as a single point of contact for entities seeking guidance and will ensure consistency by issuing rules, standards, and guidelines. The Srikrishna Committee Report concretised this idea and proposed a sector-agnostic regulator that is expected to <a href="https://www.meity.gov.in/writereaddata/files/Data_Protection_Committee_Report.pdf">undertake</a> expertise-driven standard-setting, enforcement, and adjudication under the Bill.<sup> </sup> The PDP Bill carries forward this conception of a DPA, which is distinct from the central government.</p>
<p style="text-align: justify;">Conceptualised as such, the DPA has a completely new set of questions to contend with. Specifically, regulatory bodies require additional safeguards to overcome the legitimacy and accountability questions that <a href="https://www.oxfordhandbooks.com/view/10.1093/law/9780198704898.001.0001/oxfordhb-9780198704898">arise</a> when law-making is carried out not by elected members of the legislature, but via the unelected executive. The DPA would need to incorporate democratic decision-making processes to overcome the deficit of public participation in an expert-driven body. Thus, the meta-objective of ensuring autonomous, expertise-driven, and legitimate regulation of personal data processing necessitates that the regulator has sufficient independence from political interference, is populated with subject matter experts and competent decision-makers, and further has democratic decision-making procedures.</p>
<p>Further, the standard-setting role of the regulator does not receive sufficient attention in terms of providing distinct procedural or substantive safeguards either in the legislation or public policy guidance.</p>
<h3>Reconnaissance under the PDP Bill: How well does it guide the DPA?</h3>
<p style="text-align: justify;">At this time, the PDP Bill is the primary guidance document that defines the DPA and its overall structure. India also lacks an overarching statute or binding framework that lays down granular guidance on regulation-making by regulatory agencies.</p>
<p style="text-align: justify;">The PDP Bill, in its current iteration, sets out skeletal provisions to guide the DPA in achieving its objectives. Specifically, the Bill provides guidance limited to the following:</p>
<ol>
<li style="text-align: justify;"><em>Parliamentary scrutiny of regulations:</em> The DPA must table all its regulations before the Parliament. This is meant to accord <a href="https://www.nipfp.org.in/media/medialibrary/2018/08/WP_237_2018_0ciIwuT.pdf">legislative scrutiny</a> to binding legal standards promulgated by unelected officials.</li>
<li style="text-align: justify;"><em>Consistency with the Act:</em> All regulations should be consistent with the Act and the rules framed under it. This integrates a standard of administrative law to a limited extent within the regulation-making process. </li></ol>
<p style="text-align: justify;">However, India’s past track record <a href="https://prsindia.org/theprsblog/how-well-does-parliament-examine-rules-framed-under-various-laws">indicates</a> that regulations, once tabled before the Parliament, are rarely questioned or scrutinised. Judicial review is typically based on ‘thin’ procedural considerations such as whether the regulation is unconstitutional, arbitrary, <em>ultra vires</em>, or goes beyond the statutory obligations or jurisdiction of the regulator. In any event, judicial review is possible only when an instrument is challenged by a litigant, and, therefore, it may not always be a robust <em>ex-ante</em> check on the exercise of this power. A third challenge arises where instruments other than regulations are issued by the regulator. These could be circulars, directions, guidelines, and even FAQs, which are <a href="https://www.nipfp.org.in/media/medialibrary/2018/08/WP_237_2018_0ciIwuT.pdf">rarely bound</a> by even the minimal procedural mandate of being tabled before the Parliament. To be sure, older regulators including the Reserve Bank of India (RBI) and the Securities and Exchange Board of India (SEBI) also face similar issues, which they have attempted to address through various methods including voluntary public consultations, stakeholder meetings, and publication of minutes of meetings. These are useful tools for the DPA to consider as well.</p>
<p>Apart from these, specific guidance is provided with respect to issuing and approving codes of practice and issuing directions as follows:</p>
<ol>
<li style="text-align: justify;">Codes of practice: The DPA is required to (i) ensure transparency,<a href="file:///C:/Users/Admin/AppData/Local/Temp/211105_Governance%20Choices%20for%20the%20DPA%20(1).docx#_ftn1"><sup><sup>[1]</sup></sup></a> (ii) consult with other sectoral regulators and stakeholders, and (iii) follow a procedure to be prescribed by the central government prior to the notification of codes of practice under the Bill.<a href="file:///C:/Users/Admin/AppData/Local/Temp/211105_Governance%20Choices%20for%20the%20DPA%20(1).docx#_ftn2"><sup><sup>[2]</sup></sup></a></li>
<li style="text-align: justify;">Directions: The DPA may issue directions to individual, regulated entities or their classes from time to time, provided these entities have been given the opportunity to be heard by the DPA before such directions are issued.<a href="file:///C:/Users/Admin/AppData/Local/Temp/211105_Governance%20Choices%20for%20the%20DPA%20(1).docx#_ftn3"><sup><sup>[3]</sup></sup></a></li></ol>
<p style="text-align: justify;">However, the meaning of transparency and the process for engaging with sectoral regulators remains unspecified under the Bill. Furthermore, the central government has been provided vast discretion to formulate these procedures, as the Bill does not specify the principles or outcomes sought to be achieved via these procedures. The Bill also does not specify instances where such directions may be issued and in which form.</p>
<p>Thus, as per its last publicly available iteration, the Bill remains silent on the following:</p>
<ul>
<li>The principles that may guide the DPA in its functioning.</li>
<li>The procedure to be followed for issuing regulations and other subordinate legislation under the Bill.</li>
<li style="text-align: justify;">The relevant regulatory instruments, other than regulations and codes of practice – such as circulars, guidelines, FAQs, etc. – that may be issued by the DPA.</li>
<li>The specifics regarding the members and employees within the DPA who are empowered to make these regulations.</li></ul>
<p style="text-align: justify;">It is unclear whether the JPC will revise the DPA’s structure or recommend statutory guidance for the DPA in executing any of its functions. This is unlikely, given that parent statutes for other regulators typically omit such guidance. As a result, the DPA may be required to make intentional and proactive choices on these matters, much like their regulatory counterparts in India. These are discussed in the section below.</p>
<h3 style="text-align: justify;">Envisaging a Proactive Role for the DPA</h3>
<p>As the primary regulatory body in charge of the enforcement of the forthcoming data protection framework, what should be the role of the DPA in setting standards for data protection?</p>
<p style="text-align: justify;">The complexity of the subject matter, and the DPA’s role as the frontline body to define day-to-day operational standards for data protection for the entire digital economy, necessitates that it develop transparent guiding principles and procedures. Furthermore, given that the DPA’s autonomy and capacity are currently unclear, the DPA will need to make deliberate choices regarding how it conducts itself. In this regard, the skeletal nature of the PDP Bill also allows the DPA to determine its own procedures to carry out its tasks effectively.</p>
<p style="text-align: justify;">This is not uncommon in India: various regulators have devised frameworks to create benchmarks for themselves. The Airports Economic Regulatory Authority (AERA) is <a href="http://aera.gov.in/aera/upload/uploadfiles/files/AERAACT.pdf">obligated</a> to follow a dedicated consultation process as per an explicit transparency mandate under the parent statute. However, the Insolvency and Bankruptcy Board of India (IBBI) has, on its own initiative, <a href="https://ibbi.gov.in/webadmin/pdf/legalframwork/2018/Oct/IBBI(Mechamism%20for%20Issuing%20Regulations)%20Regulations,%202018_2018-10-26%2011:59:43.pdf">formulated regulations</a> to guide its regulation-making functions. In other cases, consultation processes have been integrated into the respective framework through judicial intervention: the Telecom Regulatory Authority of India (TRAI) has been mandated to undertake consultations through <a href="https://clpr.org.in/wp-content/uploads/2018/10/Cellular-Operators-v.-TRAI.pdf">judicial interpretation</a> of the requirement for transparency under the Telecom Regulatory Authority of India Act, 1997 (TRAI Act).</p>
<p style="text-align: justify;">In this regard, we develop a list of considerations that the DPA should look to address while carrying out its standard-setting functions. We also draw on best practices by Indian regulators and abroad, which can help identify feasible solutions for an effective DPA for India.</p>
<p><strong>The choice of regulatory instruments</strong></p>
<p style="text-align: justify;">The DPA is empowered to issue regulations, codes of practice, and directions under the Bill. At the same time, regulators in India routinely issue other regulatory instruments to assign obligations and clarify them. Some commonly used regulatory instruments are outlined below. The terms used for instruments are not standard across regulators, and the list and description set out below outline the main concepts and not fixed labels for the instruments.</p>
<p><strong><em>Overview of regulatory instruments</em></strong><em> </em></p>
<table>
<tbody>
<tr>
<td>
<p> </p>
</td>
<td>
<p><strong>Circulars and Master Circulars</strong></p>
</td>
<td>
<p><strong>Guidelines</strong></p>
</td>
<td>
<p><strong>FAQs</strong></p>
</td>
<td>
<p><strong>Directions</strong></p>
</td>
</tr>
<tr>
<td>
<p><strong>Content</strong></p>
</td>
<td>
<p>Circulars are used to prescribe detailed obligations and prohibitions for regulated entities and can mimic regulations. Master circulars consolidate circulars on a particular topic periodically.</p>
</td>
<td>
<p>These may be administrative or substantive, depending on the practice of the regulator in question.</p>
</td>
<td>
<p>Issued in public interest by regulators to clarify the regulatory framework administered by them. They cannot prescribe new standards or create obligations.</p>
</td>
<td>
<p>Issued to provide focused instructions to individual entities or class of entities in response to an adjudicatory action or in lieu of a current challenge.</p>
</td>
</tr>
<tr>
<td>
<p><strong>Binding character</strong></p>
</td>
<td>
<p>They are generally <a href="https://indiankanoon.org/doc/1588871/">binding</a> in the <a href="https://indiankanoon.org/doc/1316639/">same manner</a> as regulations and rules. However, if they go beyond the parent Act or existing rules and regulations, they may be <a href="https://indiankanoon.org/doc/15876695/">struck down</a> following a judicial review.</p>
</td>
<td>
<p>They may or may not be binding depending upon the language employed or the regulator’s practice.</p>
</td>
<td>
<p>Unclear whether these are binding and to what extent. However, crucial clarifications on important concepts sometimes emerge from FAQs.</p>
</td>
<td>
<p>Binding in respect of the class of regulated entities to whom this is issued.</p>
</td>
</tr>
<tr>
<td>
<p><strong>Parliamentary scrutiny</strong></p>
</td>
<td colspan="4">
<p>Unlike regulations, these do not have to be laid before the Parliament.</p>
</td>
</tr>
</tbody>
</table>
<p style="text-align: justify;">Thus, all these instruments, to varying degrees, have <a href="https://www.ncaer.org/news_details.php?nID=1399">been used</a> to create binding obligations for regulated entities. The <a href="https://www.nipfp.org.in/media/medialibrary/2018/08/WP_237_2018_0ciIwuT.pdf">choice of regulatory instrument</a> is not made systematically. Indeed, even a <a href="https://www.bis.org/bcbs/publ/d321.pdf">hierarchy of instruments</a> and their functions are not clearly set out by most regulators. The <a href="https://www.nipfp.org.in/media/medialibrary/2018/08/WP_237_2018_0ciIwuT.pdf">rationale</a> for deciding why a circular is issued as against a regulation is also unclear. A study on regulatory performance in India by Burman and Zaveri (2018) has <a href="https://static1.squarespace.com/static/59c0077a9f745650903ac158/t/5cb62147104c7ba2eaf637e4/1555439944606/Burman+V2.pdf">highlighted</a> an over-reliance on instruments such as circulars. As per their study, between 2014 and 2016, RBI and SEBI issued 1,016 and 122 circulars, as against 48 and 51 regulations, respectively. These circulars are not bound by the same pre-consultative mandate nor are they mandated to be laid before the Parliament. While circulars may have been intended for routine to routinely used to lay down administrative or procedural requirements, the study narrows its frame of reference to circulars which lay down substantive regulatory requirements. In this instance, it is unclear why parliamentary scrutiny is mandated for regulations alone, and not for instruments like circulars and directions, even though they lay down similarly substantive requirements. Furthermore, there have also been<a href="https://indiacorplaw.in/2014/11/are-sebis-faqs-binding-on-partiessebi.html"> instances</a> where certain instruments like FAQs have gone beyond their advisory scope to provide new directions or definitions that were not previously shared under binding instruments like regulations or circulars.</p>
<p>The DPA has been provided specific powers to issue regulations, codes of practice, and directions. However, the rationale for issuing one instead of the other has been <a href="https://www.medianama.com/2020/01/223-pdp-bill-2019-data-protection-authority/">absent</a> from the PDP Bill so far. In such a scenario, it is important that the DPA transparently outlines the <em>types</em> of instruments it wishes to use, whether they are binding or advisory, and the procedure to be followed for issuing each.</p>
<p><strong>Pre-legislative consultative rule-making</strong></p>
<ol></ol>
<p>Participatory and consultative processes have emerged as core components of democratic rule-making by regulators. Transparent consultative mechanisms could also ameliorate capacity challenges in a new regulator (particularly for technical matters) and help enhance public confidence in the regulator.</p>
<p style="text-align: justify;">In India, several regulators have adopted consultation mechanisms even when there is no specific statutory requirement. <a href="https://www.sebi.gov.in/sebiweb/home/HomeAction.do?doListing=yes&sid=4&smid=35&ssid=38">SEBI</a> and <a href="https://ibbi.gov.in/public-comments/comments-on">IBBI</a> routinely issue discussion papers and consultation papers. The RBI also issues draft instruments <a href="https://www.rbi.org.in/Scripts/DraftNotificationsGuildelines.aspx">soliciting comments</a>. As discussed previously, TRAI and AERA have distinct transparency mandates under which they carry out consultations before issuing regulations. However, these processes are not mandated all forms of subordinate legislation. Taking cognizance of this, the Financial Sector Legislative Reform Committee (FSLRC) has <a href="https://dea.gov.in/sites/default/files/fslrc_report_vol1_1.pdf">recommended</a> transparency in the regulation-making process. This was <a href="https://dea.gov.in/sites/default/files/Handbook_GovEnhanc_fslrc_2.pdf">carried forward</a> by the Financial Stability and Development Council (FSDC), which recommended that consultation processes should be a prerequisite for all subordinate legislations, including circulars, guidelines, etc. A <a href="https://static1.squarespace.com/static/59c0077a9f745650903ac158/t/5cb62147104c7ba2eaf637e4/1555439944606/Burman+V2.pdf">study</a> on regulators’ adherence to these mandates, spanning TRAI, AERA, SEBI, and RBI, demonstrated that this pre-consultation mandate is followed inconsistently, if at all. Predictable consultation practices are therefore critical.</p>
<p style="text-align: justify;">Furthermore, the study stated that it <a href="https://static1.squarespace.com/static/59c0077a9f745650903ac158/t/5cb62147104c7ba2eaf637e4/1555439944606/Burman+V2.pdf">could not determine</a> whether the consultation processes yielded meaningful participation, given that regulators are not obligated to disclose how public feedback was integrated into the rule-making process. Subordinate legislations issued in the form of circulars and guidelines also do not typically undergo the same rigorous consultation processes. Thus, an ideal consultation framework would <a href="https://ec.europa.eu/info/sites/default/files/better_regulation_joining_forces_to_make_better_laws_en_0.pdf">comprise</a>:</p>
<ul>
<li style="text-align: justify;">Publication of the draft subordinate legislation along with a detailed explanation of the policy objectives. Further, the regulator should publish the internal or external studies conducted to arrive at the proposed legislation to <a href="https://legalinstruments.oecd.org/public/doc/669/51f6da97-c198-4c93-922f-1a5d80beae86.pdf">engender</a> meaningful discussion.</li>
<li>Permitting sufficient time for the public and interested stakeholders to respond to the draft.</li>
<li>Publishing all feedback received for the public to assess, and allowing them to respond to the feedback.</li></ul>
<p>However, beyond specifying the manner of conducting consultations, it will be important for the DPA to determine where they are mandatory and binding, and for which type of subordinate legislations. These are discussed in the next section.</p>
<p><strong>Choice of consultation mandates for distinct regulatory instruments</strong></p>
<ol></ol>
<p style="text-align: justify;">While the Bill provides for consultation processes for issuing and approving codes of practice, no such mechanism has been set out for other instruments. Nevertheless, specifying consultation mandates for different regulatory instruments is important to ensure that decision-making is consistent and regulation-making remains bound by transparent and accountable processes. As discussed above, regulatory instruments such as circulars and FAQs are not necessarily bound by the same consultation mandates in India. This distinction has been clarified in more sophisticated administrative law frameworks abroad. For instance, under the Administrative Procedures Act in the United States (US), all substantive rules made by regulatory agencies are <a href="https://www.reginfo.gov/public/reginfo/Regmap/regmap.pdf">bound</a> by a consultation process, which requires notice of the proposed rule-making and public feedback. This does <a href="https://www.federalregister.gov/uploads/2011/01/the_rulemaking_process.pdf">not preclude</a> the regulatory agency from issuing clarifications, guidelines, and supplemental information on the rules issued. These documents do not require the consultation process otherwise required for formal rules. However, they cannot be used to expand the scope of the rules, set new legal standards, or have the effect of amending the rules. Nevertheless, agencies are not precluded from choosing to seek public feedback on such documents.</p>
<p style="text-align: justify;">Similarly, the Information Commissioner’s Office in the United Kingdom (UK) takes into consideration <a href="https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/">public consultations</a> and <a href="https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/ico-call-for-views-on-employment-practices/">surveys</a> while issuing toolkits and guidance for regulated entities on how to comply with the data protection framework in the UK.</p>
<p style="text-align: justify;">Here, the DPA may choose to subject strictly binding instruments like regulations and codes of practice to pre-legislative consultation mandates, while softer mechanisms like FAQs may be subject to the publication of a detailed outline of the policy objective or online surveys to invite non-binding, advisory feedback. For each of these, the DPA will nonetheless need to create specific criteria by which it classifies instruments as binding and advisory, and further outline specific pre-legislative mandates for each category.</p>
<p><strong>Framework for issuing regulatory instruments and instructions</strong></p>
<ol></ol>
<p style="text-align: justify;">While the DPA is likely to issue several instruments, the system based on which these instruments will be issued is not yet clear. Without a clearly thought-out framework, different departments within the regulator <a href="https://www.nipfp.org.in/media/medialibrary/2018/08/WP_237_2018_0ciIwuT.pdf">typically issue</a> a series of directions, circulars, regulations, and other instruments. This raises questions regarding the consistency between instruments. This also requires stakeholders to go through multiple instruments to find the position of law on a given issue. Older Indian regulators are now facing challenges in adapting their ad hoc system into a framework. For example, the RBI currently issues a series of circulars and guidelines that are periodically consolidated on a subject-matter basis as Master Circulars and Master Directions. These are then updated and published on their website. IBBI also publishes <a href="https://ibbi.gov.in/uploads/publication/e42fddce80e99d28b683a7e21c81110e.pdf">handbooks</a> and <a href="https://ibbi.gov.in/publication/information-brochures">information brochures</a> that consolidate instruments in an accessible manner.</p>
<p style="text-align: justify;">While these are useful improvements, these practices cannot keep pace with rapid changes in regulatory instructions and are not complete or user-friendly (for example, the subject-matter based consolidation does not allow for filtering regulatory instructions by entity). Other jurisdictions have developed different techniques such as formal codification processes to consolidate regulations issued by government agencies under one <a href="https://www.govinfo.gov/help/cfr">unified code</a>, <a href="https://www.oaic.gov.au/privacy/privacy-registers/privacy-codes-register/">register</a>, or <a href="https://www.handbook.fca.org.uk/handbook">handbook</a>, websites that allow for searches based on different parameters (subject-matter, type of instrument, chronology, entity-based), and <a href="https://www.handbook.fca.org.uk/handbook-guides">guides</a> tailored to different types of entities. The DPA, as a new regulator, can learn from this experience and adopt a consistent framework right from the beginning.</p>
<p style="text-align: justify;">Further, an ethos of responsive regulation also requires the DPA to evaluate and revise directions and regulations periodically, in response to market and technology trends. A commitment to periodic evaluation of subordinate legislations entrenched in the rules is critical to reducing the dependence on officials and leadership, which may change. For instance, the <a href="https://www.ibbi.gov.in/webadmin/pdf/whatsnew/2018/Oct/Mechanism%20for%20issuing%20regulations%20October%20after%20Board%20meeting%20final_2018-10-22%2020:42:06.pdf">IBBI</a> has set out a mandatory review of regulations issued by it every three years.</p>
<p><strong>Dedicating capacity for drafting subordinate legislations</strong></p>
<ol></ol>
<p style="text-align: justify;">The DPA has been granted the discretion to appoint experts and staff its offices with the personnel it needs. A <a href="https://www2.deloitte.com/content/dam/Deloitte/nl/Documents/risk/deloitte-nl-risk-reports-resources.pdf">study</a> of European data protection authorities shows that by the time the General Data Protection Regulation, 2016 became effective, most of the authorities increased the number of employees with some even reporting a 240% increase. The annual spending on the authorities also went up for most countries. While these authorities do not necessarily frame subordinate legislations, they nonetheless create guidance toolkits and codes of practice as part of their supervisory functions.</p>
<p style="text-align: justify;">In this regard, the DPA will need to ensure it has dedicated capacity in-house to draft subordinate legislations. Since regulators are generally seen as enforcement authorities, there is inadequate investment in capacity-building for drafting legislations in India.</p>
<p style="text-align: justify;">Moreover, considering the multiplicity of instruments and guidance documents the DPA is expected to issue, it may seek to create templates for these instruments, along with compulsory constituents of different types of instruments. For instance, the Office of the Australian Information Commissioner is required to include a <a href="https://www.oaic.gov.au/privacy/guidance-and-advice/guidelines-for-developing-codes/">mandatory set of components</a> while issuing or approving binding industry codes of practice.</p>
<h3 style="text-align: justify;">Conclusion</h3>
<p style="text-align: justify;">The Personal Data Protection Bill, 2019 (in the final form recommended by the JPC and accepted by the MeitY) will usher in a new chapter in India’s data protection timeline. While the Bill will finally effectuate a nearly comprehensive data protection framework for India, it will also establish a new regulatory framework that sets up a new regulator, the DPA, to oversee the new data protection law. This DPA will be empowered to regulate entities across sectors and is likely to determine the success of the data protection law in India.</p>
<p style="text-align: justify;">Furthermore, the DPA must not only contend with the complexity of markets and the fast pace of technological change, but it must also address <a href="https://blog.theleapjournal.org/2018/02/a-pragmatic-approach-to-data-protection.html">anticipated</a> regulatory capacity deficits, low levels of user literacy, the number and diversity of enities within its regulatory ambit, and the need to secure individual privacy within and outside the digital realm.</p>
<p style="text-align: justify;">Thus, looking ahead, we must account for the questions of governance that the forthcoming DPA is likely to face, as these will directly impact how entities and citizens engage with the DPA. In India, regulatory agencies adopt distinct choices to fulfil their functions. Regulators have also <a href="https://static1.squarespace.com/static/59c0077a9f745650903ac158/t/5cb62147104c7ba2eaf637e4/1555439944606/Burman+V2.pdf">fared variably</a> in ensuring transparent and accountable decision-making driven by demonstrable expertise. Even if the final form of the PDP Bill does not address these gaps, the DPA has the opportunity to integrate benchmarks and best practices as discussed above within its own governance framework from the get-go as it takes on its daunting responsibilities under the PDP Bill.</p>
<p style="text-align: justify;"><em>(<span id="docs-internal-guid-6bf51b9e-7fff-d2ac-d0fb-f42bcdd7f599">The authors are Research Fellow, Law, Technology and Society Initiative and Project Lead, Regulatory Governance Project respectively at the National Law School of India University, Bangalore. Views are personal.)</span></em></p>
<em>
</em>
<p style="text-align: justify;"><span id="docs-internal-guid-6bf51b9e-7fff-d2ac-d0fb-f42bcdd7f599"><em>This post was reviewed by Vipul Kharbanda and Shweta Mohandas</em><br /></span></p>
<h3 style="text-align: justify;">References</h3>
<ul>
<li style="text-align: justify;">For a discussion on distinct regulatory choices, please see TV Somanathan, <em>The Administrative and Regulatory State</em> in Sujit Choudhary, Madhav Khosla, et al. (eds), <a href="https://www.oxfordhandbooks.com/view/10.1093/law/9780198704898.001.0001/oxfordhb-9780198704898">Oxford Handbook of the Indian Constitution</a> (2016).</li>
<li style="text-align: justify;">On best practices for consultative law-making, see generally <em>European Union Better Regulation </em><a href="https://ec.europa.eu/info/sites/default/files/better_regulation_joining_forces_to_make_better_laws_en_0.pdf"><em>Communication</em></a>, <em>Guidelines for Effective Regulatory Consultations </em>(<a href="https://www.tbs-sct.gc.ca/rtrap-parfa/erc-cer/erc-cer-eng.pdf">Canada</a>), and<em> </em><a href="https://read.oecd-ilibrary.org/governance/the-governance-of-regulators_9789264209015-en#page81"><em>OECD</em></a><em> </em><em>Best Practice Principles for Regulatory Policy: The Governance of Regulators</em>,<em> 2014.</em></li></ul>
<hr align="left" size="1" width="33%" />
<p><a href="file:///C:/Users/Admin/AppData/Local/Temp/211105_Governance%20Choices%20for%20the%20DPA%20(1).docx#_ftnref1"><sup><sup>[1]</sup></sup></a> Personal Data Protection Bill 2019, § 50(3).</p>
<p><a href="file:///C:/Users/Admin/AppData/Local/Temp/211105_Governance%20Choices%20for%20the%20DPA%20(1).docx#_ftnref2"><sup><sup>[2]</sup></sup></a> Personal Data Protection Bill 2019, § 50(4).</p>
<p><a href="file:///C:/Users/Admin/AppData/Local/Temp/211105_Governance%20Choices%20for%20the%20DPA%20(1).docx#_ftnref3"><sup><sup>[3]</sup></sup></a> Personal Data Protection Bill 2019, § 51.</p>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/blog/trishi-jindal-and-s-vivek-beyond-the-pdp-bill'>https://cis-india.org/internet-governance/blog/trishi-jindal-and-s-vivek-beyond-the-pdp-bill</a>
</p>
No publisherTrishi Jindal and S.VivekInternet GovernanceData ProtectionPrivacy2021-11-10T07:32:33ZBlog EntryThe PDP Bill 2019 Through the Lens of Privacy by Design
https://cis-india.org/internet-governance/blog/the-pdp-bill-2019-through-the-lens-of-privacy-by-design
<b>This paper evaluates the PDP Bill based on the Privacy by Design approach. It examines the implications of Bill in terms of the data ecosystem it may lead to, and the visual interface design in digital platforms. This paper focuses on the notice and consent communication suggested by the Bill, and the role and accountability of design in its interpretation. </b>
<h2>Background</h2>
<div> </div>
<p>The Personal Data Protection (PDP) Bill, 2019 was introduced in the Lok Sabha on December 11, 2019 by the Minister of Electronics and Information Technology. The Bill aims to provide for protection of personal data of individuals, and establishes a Data Protection Authority for the same <a class="external-link" href="https://www.prsindia.org/billtrack/personal-data-protection-bill-2019">[1]</a>. The PDP Bill, 2019 contains several clauses that have implications on the visual design of digital products. These include the specific requirements for communication of notice and consent at various stages of the product. The Bill also introduces the Privacy by Design policy. Privacy by Design (PbD), as a concept, was proposed by Ann Cavoukian in the 1990s, with the purpose of approaching privacy from a design-thinking perspective <a class="external-link" href="https://iab.org/wp-content/IAB-uploads/2011/03/fred_carter.pdf">[2]</a>. She describes this perspective to be holistic, interdisciplinary, integrative, and innovative. The approach suggests that privacy must be incorporated into networked data systems and technologies, by default <a class="external-link" href="https://iab.org/wp-content/IAB-uploads/2011/03/fred_carter.pdf">[3]</a>. It challenges the practice of enhancing privacy as an afterthought. It expects privacy to be a default setting, and a proactive (not reactive) measure that would be embedded into a design in its initial stage and throughout the life cycle of the product <a class="external-link" href="https://www.smashingmagazine.com/2019/04/privacy-ux-aware-design-framework/">[4]</a>. While PbD is a conceptual framework, it’s application can change the way digital platforms are created and the way in which people interact with them. From devising a business model, to making technological decisions, PbD principles can make privacy integral to the processes and standards of a digital platform.</p>
<p><br />The PDP Bill states that data fiduciaries are required to prepare a Privacy by Design policy and have it certified by the Data Protection Authority. According to the Bill, the policy would contain the managerial, organisational, business practices and technical systems designed to anticipate, identify and avoid harm to the data principal <a class="external-link" href="http://164.100.47.4/BillsTexts/LSBillTexts/Asintroduced/373_2019_LS_Eng.pdf">[5]</a>. It would mention if the technology used in the processing of personal data is in accordance with the certified standards. It would also comprise of the ways in which privacy is being protected throughout the stages of processing of personal data, and that the interest of the individual is accounted for in each of these stages. Once certified by the Data Protection Authority, the data fiduciaries are also required to publish this policy on their website <a class="external-link" href="https://sflc.in/key-changes-personal-data-protection-bill-2019-srikrishna-committee-draft">[6]</a>. This forces the data fiduciaries to envision privacy as a fundamental requirement and not an afterthought. Such a policy would have a huge impact in the way digital platforms are conceptualised, both from the technological and the design point of view. The adoption of this policy by digital platforms would enable people to know if their privacy is protected by the companies, and what are the various steps being taken for this purpose. Besides the explicit Privacy by Design policy, the PDP Bill, 2019, also recommends the regulations for data minimisation, establishment of the Data Protection Authority (DPA), and the development of a consent framework. These steps are also part of the Privacy by Design approach.</p>
<p><br />This paper evaluates the PDP Bill based on the Privacy by Design approach. The Bill’s scope includes both the conceptual and technological aspects of a digital platform, as well as the interface aspect that the individual using the platform faces. The paper will hence analyse how PbD approach is reflected in both these aspects. At the conceptual level, it will look at the data ecosystem that the Bill unwittingly creates, and at the interface level, it will critically analyse the Bill’s implication on the notice and consent communication in the digital products. This includes the several points of communication or touchpoints between a company and an individual using their service, as dictated by the Bill, and how they would translate into visual design. Visual design forms an integral part of digital platforms. It is the way in which the platforms interact with the individuals. The choices made by individuals are largely driven by the visual structuring and presentation of information on these platforms. Presently, the interface design in several platforms is being used to perpetuate unethical data practices in the form of dark patterns. Dark Patterns are deceptive user interface interactions, designed to mislead or trick users to make them do something they don’t want to do<a class="external-link" href="https://uxdesign.cc/dark-patterns-in-ux-design-7009a83b233c"> [7]</a>. The design of the notice and consent touchpoints can significantly influence the enforcement of this Bill, and how it benefits individuals. Moreover, digital platforms may technically follow the regulations but can still be manipulative through their interface design. Thus, the role and accountability of design becomes crucial in the interpretation of the data protection regulations.</p>
<p> </p>
<p>The full paper can be read <a href="https://cis-india.org/internet-governance/the-pdp-bill-2019-through-the-lens-of-privacy-by-design/at_download/file" class="external-link">here</a>.</p>
<p>[1] <a class="external-link" href="https://www.prsindia.org/billtrack/personal-data-protection-bill-2019">https://prsindia.org/billtrack/personal-data-protection-bill-2019</a> </p>
<p>[2] <a class="external-link" href="https://iab.org/wp-content/IAB-uploads/2011/03/fred_carter.pdf">https://iab.org/wp-content/IAB-uploads/2011/03/fred_carter.pdf</a></p>
<p>[3] <a class="external-link" href="https://iab.org/wp-content/IAB-uploads/2011/03/fred_carter.pdf">https://iab.org/wp-content/IAB-uploads/2011/03/fred_carter.pdf</a></p>
<p>[4] <a class="external-link" href="https://www.smashingmagazine.com/2019/04/privacy-ux-aware-design-framework/">https://www.smashingmagazine.com/2019/04/privacy-ux-aware-design-framework/</a></p>
<p>[5] <a class="external-link" href="http://164.100.47.4/BillsTexts/LSBillTexts/Asintroduced/373_2019_LS_Eng.pdf">http://164.100.47.4/BillsTexts/LSBillTexts/Asintroduced/373_2019_LS_Eng.pdf</a></p>
<p>[6] <a class="external-link" href="https://sflc.in/key-changes-personal-data-protection-bill-2019-srikrishna-committee-draft">https://sflc.in/key-changes-personal-data-protection-bill-2019-srikrishna-committee-draft</a></p>
<p>[7] <a class="external-link" href="https://uxdesign.cc/dark-patterns-in-ux-design-7009a83b233c">https://uxdesign.cc/dark-patterns-in-ux-design-7009a83b233c</a></p>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/blog/the-pdp-bill-2019-through-the-lens-of-privacy-by-design'>https://cis-india.org/internet-governance/blog/the-pdp-bill-2019-through-the-lens-of-privacy-by-design</a>
</p>
No publisherSaumyaa Naidu, Akash Sheshadri, Shweta Mohandas, and Pranav M Bidare; Edited by Arindrajit Basu, Shweta Reddy; With inputs from Amber SinhaDesignInternet GovernanceData ProtectionPrivacy2020-11-13T07:51:03ZBlog EntryThe Wolf in Sheep's Clothing: Demanding your Data
https://cis-india.org/internet-governance/blog/the-wolf-in-sheeps-clothing-demanding-your-data
<b>The increasing digitalization of the economy and ubiquity of the Internet, coupled with developments in Artificial Intelligence (AI) and Machine Learning (ML) has given rise to transformational business models across several sectors.</b>
<p> </p>
<p>This piece was originally published in <a class="external-link" href="https://telecom.economictimes.indiatimes.com/tele-talk/the-wolf-in-sheep-s-clothing-demanding-your-data/4497">The Economic Times Telecom</a>, on 8 September, 2020.<span class="css-901oao css-16my406 r-1qd0xha r-ad9z0x r-bcqeeo r-qvutc0"></span></p>
<p>The increasing digitalization of the economy and ubiquity of the <a href="https://telecom.economictimes.indiatimes.com/tag/internet">Internet</a>, coupled with developments in <a href="https://telecom.economictimes.indiatimes.com/tag/artificial+intelligence">Artificial Intelligence</a>
(AI) and Machine Learning (ML) has given rise to transformational
business models across several sectors. These developments have changed
the very structure of existing sectors, with a few dominant firms
straddling across many sectors. The position of these firms is
entrenched due to the large amounts of data they have, and usage of
sophisticated algorithms that deliver very targeted service/content and
their global nature.<br /><br /></p>
<p>Such data based network businesses
are generally multi-sided platforms subject to network effects and
winner takes all phenomena, often, making traditional competition
regulation inappropriate. In addition, there has been concern that such
companies hurt competition as they are owners of large amounts of data
collected globally, the very basis on which new services are predicated.
Also since users have an inertia to share their data on multiple
platforms, new companies find it very challenging to emerge. Several of
the large companies are of US origin. Several regions/countries such as
EU, UK, India are concerned that while these companies benefit from the
data of their citizens or their <a href="https://telecom.economictimes.indiatimes.com/tag/devices">devices</a>,
SMEs and other companies in their own countries find it increasingly
difficult to remain viable or achieve scale. With the objective of
supporting enterprises, including SMEs in their own countries, Europe,
UK India are in different stages of data regulation initiatives.<br /><br /></p>
<p>In India, the <a href="https://telecom.economictimes.indiatimes.com/tag/personal+data+protection">Personal Data Protection</a>
(PDP) Bill, 2019 deals with the framework for collecting, managing and
transferring of Personal Data of Indian citizens, including mandating
sharing of anonymized data of individuals and non-personal data for
better targeting of services or policy making. In addition, the Report
by the Committee of Experts (CoE) on Non Personal Data (NPD) came up
with a Framework for Regulating NPD. Since the NPD Report is a more
recent phenomenon, this articles analyzes some aspects of it.<br /><br /></p>
<p>According
to CoE, non-personal data could be of two types. First, data or
information which was never about an individual (e.g. weather data).
Second, data or information that once was related to an individual (e.g.
mobile number) but has now ceased to be identifiable due to the removal
of certain identifiers through the process of ‘anonymisation’. However,
it may be possible to recover the personal data from such anonymized
data and therefore, the distinction between personal and non-personal is
not clean. In any case, the PDP bill 2019 deals with personal data. If
the CoE felt that some aspect of personal data (including anonymized
data) were not adequately dealt with, it should work to strengthen it.
The current approach of the CoE is bound to create confusion and
overlapping jurisdiction. Since anonymized data is required to be
shared, there are disincentives to anonymization, causing greater risk
to individual privacy.<br /><br /></p>
<p>A new class of business based on a “<em>horizontal classification cutting across different industry sectors</em>” is defined. This refers to any business that derives “<em>new or additional economic value from data, by collecting, storing, processing, and managing data</em>”
based on a certain threshold of data collected/processed that will be
defined by the regulatory authority that is outlined in the report. The
CoE also recommends that “<em>Data Businesses will provide, within India, open access to meta-data and regulated access to the underlying data</em>” without any remuneration. Further, “<em>By
looking at the meta-data, potential users may identify opportunities
for combining data from multiple Data Businesses and/or governments to
develop innovative solutions, products and services. Subsequently, data
requests may be made for the detailed underlying data</em>”.<br /><br /></p>
<p>With
increasing digitalization, today almost every business is a data
business. The problem in such categorization will be with the definition
of thresholds. It is likely that even a small video sharing app or an
AR/VR app would store/collect/process/transmit more data than say a
mid-sized bank in terms of data volumes. Further, with increasing
embedding of <a href="https://telecom.economictimes.indiatimes.com/tag/iot">IoT</a>
in various aspects of our lives and businesses (smart manufacturing,
logistics, banking etc), the amount of data that is captured by even
small entities can be huge.<br /><br /></p>
<p>The private sector, driven by
profitability, identifies innovative business models, risks capital and
finds unique ways of capturing and melding different data sets. In
order to sustain economic growth, such innovation is necessary. The
private sector would also like legal protection over these aspects of
its businesses, including the unique IPR that may be embedded in the
processing of data or its business processes. But mandating such onerous
requirements on sharing by the CoE is going to kill any private
initiative. Any regulatory regime must balance between the need to
provide a secure environment for protecting data of incumbents and
making it available to SMEs/businesses.<br /><br /></p>
<p>Meta data
provides insights to the company’s databases and processes. These are
source of competitive advantage for any company. Meta data is not
without a context. The basis of demanding such disclosure is mandated
with the proposed NPD Regulator who would evaluate such a purpose. In
practice, purposes are open to interpretation and the structure of
appeal mechanism etc is going to stall any such sharing. Would such
mandates of sharing not interfere with the existing Intellectual
Property Rights? Or the freedom to contract? Any innovation could easily
be made available to a competitor that front-ends itself with a
start-up. To mandate making such data available would not be fair.
Further, how would the NPD regulator even ensure that such data is used
for the purpose (which the proposed regulator is supposed to evaluate)
that it is sought for? In Europe, where such <a href="https://telecom.economictimes.indiatimes.com/tag/data+sharing">data sharing</a>
mandates are being considered, the focus is on public data. For private
entities, the sharing is largely based on voluntary contributions.
Compulsory sharing is mandated only under restricted situations where
market failure situations are not addressed through Competition Act and
provided legitimate interest of the data holder and existing legal
provisions are taken into account.<br /><br /></p>
<p>Further, the
compliance requirements for such Data Businesses is very onerous and
makes a mockery of “minimum government” framework of the government. The
CoE recommends that all Data Businesses, whether government NGO, or
private “<em>to disclose data elements collected, stored and processed, and data-based services offered</em>”. As if this was not enough, the CoE further recommends that “<em>Every
Data Business must declare what they do and what data they collect,
process and use, in which manner, and for what purposes (like disclosure
of data elements collected, where data is stored, standards adopted to
store and secure data, nature of data processing and data services
provided). This is similar to disclosures required by pharma industry
and in food products</em>”. Such disclosures are necessary in these
industries as the companies in this sector deal with critical aspects of
human life. But are such requirements necessary for all activities and
businesses? As long as organizations collect and process data, in a
legal manner, within the sectoral regulation, why should such
information have to be “reported”? Further, such bureaucratic processes
and reporting requirements are only going to be a burden to existing
legitimate businesses and give rise to a thriving regulatory license
raj.<br /><br /></p>
<p>Further questions that arise are: How is any
compliance agency going to make sure that all the underlying metadata is
made available in a timely manner? As companies respond to a dynamic
environment, their analysis and analytical tools change and so does the
metadata. This inherent aspect of businesses raises the question: At
what point in time should companies make their meta-data available? How
will the compliance be monitored?<br /><br /></p>
<p>Conclusion: The CoE
needs to create an enabling and facilitating an environment for data
sharing. The incentives for different types of entities to participate
and contribute must be recognized. Adequate provisions for risks and
liabilities arising out data sharing need to be thought through.
National initiatives on data sharing should not create an onerous
reporting regime, as envisaged by the CoE, even if digital.<br /><br /></p>
<p class="article-disclaimer"><em>DISCLAIMER:
The views expressed are solely of the author and ETTelecom.com does not
necessarily subscribe to it. ETTelecom.com shall not be responsible for
any damage caused to any person/organisation directly or indirectly.</em></p>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/blog/the-wolf-in-sheeps-clothing-demanding-your-data'>https://cis-india.org/internet-governance/blog/the-wolf-in-sheeps-clothing-demanding-your-data</a>
</p>
No publisherRekha JainInternet GovernanceData ProtectionArtificial Intelligence2020-11-10T17:44:13ZBlog EntryA Compilation of Research on the PDP Bill
https://cis-india.org/internet-governance/blog/compilation-of-research-on-data-protection
<b>The most recent step in India’s initiative to create an effective and comprehensive Data Protection regime was the call for comments to the Personal Data Protection Bill, 2019, which closed last month. Leading up to the comments, CIS has published numerous research pieces with the goal of providing a comprehensive overview of how this legislation would place India within the global scheme, and how the local situation has developed, as well as analysing its impacts on citizens’ rights.</b>
<p> </p>
<p>In addition to general and clause-by-clause comments and recommendations, we
have compiled an annotated version of the Personal Data Protection
Bill, which lays out our <a class="external-link" href="https://cis-india.org/internet-governance/blog/comments-to-the-personal-data-protection-bill-2019">commentary</a> in an easy-to-follow format.</p>
<p> </p>
<p><img src="https://cis-india.org/internet-governance/pdp-bill-compilation-post-image/" alt="null" width="100%" /></p>
<p> </p>
<p>Below, you can find our other recent research on Data Protection:</p>
<p> </p>
<ul><li>Pallavi Bedi has put together a <a class="external-link" href="https://cis-india.org/internet-governance/blog/divergence-between-the-general-data-protection-regulation-and-the-personal-data-protection-bill-2019">note</a> on the Divergence between EU’s General Data Protection Regulation (GDPR) and the Personal Data Protection Bill.</li></ul>
<div> </div>
<ul><li>In addition, Pallavi has also <a class="external-link" href="https://cis-india.org/internet-governance/blog/comparison-of-the-personal-data-protection-bill-with-the-general-data-protection-regulation-and-the-california-consumer-protection-act-2">contrasted</a> the Personal Data Protection Bill with the GDPR and California Consumer Protection Act, in the contexts of jurisdiction and scope, rights of the data principal, obligations of data fiduciaries, exemptions, data protection authority, and breach of personal data. </li></ul>
<div> </div>
<ul><li>On IAPP’s blog <em>Privacy Perspectives</em>, D. Shweta Reddy has <a class="external-link" href="https://iapp.org/news/a/grade-sheet-for-indias-adequacy-status/">assessed</a> whether the Personal Data Protection Bill 2019 is sufficient for India to receive adequacy status from the EU.</li></ul>
<div> </div>
<ul><li>Along with Justin Sherman, Arindrajit Basu has <a class="external-link" href="https://www.lawfareblog.com/key-global-takeaways-indias-revised-personal-data-protection-bill">outlined</a> the key global takeaways from the Personal Data Protection Bill 2019 on <em>Lawfare</em>.</li></ul>
<div> </div>
<ul><li>On <em>The Diplomat</em>, Arindrajit has also <a class="external-link" href="https://thediplomat.com/2020/01/the-retreat-of-the-data-localization-brigade-india-indonesia-and-vietnam/">traced</a> the narrowing localization provisions in India, as well as Vietnam and Indonesia, and studied the actors and geopolitical tussle that has shaped these provisions.</li></ul>
<div> </div>
<ul><li>Through a string of publicly available submissions, press statements, and other media reports, Arindrajit and Amber Sinha have <a class="external-link" href="https://www.epw.in/engage/article/politics-indias-data-protection-ecosystem">tracked</a> the political evolution of the data protection ecosystem in India, and how this has, and will continue to impact legislative and policy developments on <em>EPW Engage</em>.</li></ul>
<div> </div>
<ul><li>Gurshabad Grover and Tanaya Rajwade have <a class="external-link" href="https://thewire.in/tech/indias-privacy-bill-regulates-social-media-platforms">written</a> on <em>The Wire</em> about how the Personal Data Protection Bill regulates social media.</li></ul>
<div> </div>
<ul><li>Amber was also a guest on <em>Suno India’s <a class="external-link" href="https://www.sunoindia.in/cyber-democracy/personal-data-protection-bill-what-does-it-mean-for-your-right-to-privacy/">Cyber Democracy podcast</a></em>, with Srinivas Kodali, to discuss how the latest version of the Personal Data Protection Bill will impact the right to privacy.
</li></ul>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/blog/compilation-of-research-on-data-protection'>https://cis-india.org/internet-governance/blog/compilation-of-research-on-data-protection</a>
</p>
No publisherpranavinternet governanceInternet GovernanceData ProtectionPrivacy2020-03-05T08:04:24ZBlog EntryDivergence between the General Data Protection Regulation and the Personal Data Protection Bill, 2019
https://cis-india.org/internet-governance/blog/divergence-between-the-general-data-protection-regulation-and-the-personal-data-protection-bill-2019
<b></b>
<p>Our note on the divergence between the General Data Protection Regulation and the Personal Data Protection Bill can be downloaded as a PDF <a href="https://cis-india.org/internet-governance/divergence-between-the-gdpr-and-pdp-bill-2019" class="internal-link" title="Divergence between the GDPR and PDP Bill 2019">here</a>.</p>
<p>The European Union’s General Data
Protection Regulation (GDPR), replacing the 1995 EU Data Protection Directive
came into effect in May 2018. It harmonises the data protection regulations
across the European Union. In India, the Ministry of Electronics and
Information Technology had constituted a Committee of Experts (chaired by
Justice Srikrishna) to frame recommendations for a data protection framework in
India. The Committee submitted its report and a draft Personal Data Protection
Bill in July 2018 (2018 Bill). Public comments were sought on the bill till
October 2018. The Central Government revised the Bill and introduced the
revised version of the Personal Data Protection Bill (PDP Bill) on December 11,
2019 in the Lok Sabha.</p>
<p>The PDP Bill has incorporated certain
aspects of the GDPR, such as requirements for notice to be given to the data
principal, consent for processing of data, establishment of a data protection
authority, etc. However, there are some differences and in this note we have highlighted
the areas of divergence between the two. It only includes
provisions which are common to the GDPR and the PDP Bill. It does not include
the provisions on (i) Appellate Tribunal, (ii) Finance, Account and Audit; and
(iii) Non- Personal Data. </p>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/blog/divergence-between-the-general-data-protection-regulation-and-the-personal-data-protection-bill-2019'>https://cis-india.org/internet-governance/blog/divergence-between-the-general-data-protection-regulation-and-the-personal-data-protection-bill-2019</a>
</p>
No publisherPallavi BediInternet GovernanceData ProtectionPrivacy2020-02-21T11:08:50ZBlog Entry Comments to the Personal Data Protection Bill 2019
https://cis-india.org/internet-governance/blog/comments-to-the-personal-data-protection-bill-2019
<b>The Personal Data Protection Bill, 2019 was introduced in the Lok Sabha on December 11, 2019. </b>
<p> </p>
<h4>Please view our general comments below, or download as PDF <a href="https://cis-india.org/accessibility/blog/cis-general-comments-to-the-pdp-bill-2019" class="internal-link" title="CIS' General Comments to the PDP Bill 2019">here</a>.</h4>
<h4>Our comments and recommendations can be downloaded as PDF <a href="https://cis-india.org/accessibility/blog/cis-comments-pdp-bill-2019" class="internal-link" title="CIS Comments PDP Bill 2019">here</a>.</h4>
<h4>We have also prepared an annotated version of the Bill, where our detailed comments and recommendations can be viewed alongside the Bill, available as PDF <a href="https://cis-india.org/accessibility/blog/annotated-ver-pdp-bill-2019" class="internal-link" title="Annotated ver PDP Bill 2019">here</a>.</h4>
<hr />
<h2>General Comments</h2>
<h3>1. Executive notification cannot abrogate fundamental rights <br /></h3>
<p>In 2017, the Supreme Court in K.S. Puttaswamy v Union of India [1] held the right to privacy to be a fundamental right. While this right is subject to reasonable restrictions, the restrictions have to meet a three fold requirement, namely (i) existence of a law; (ii) legitimate state aim; (iii) proportionality.Under the 2018 Bill, the exemption to government agencies for processing of personal data from the provisions of the Bill in the ‘interest of the security of the State’ [2] was subject to a law being passed by Parliament. However, under Clause 35 of the present Bill, the Central Government is merely required to pass a written order exempting the government agency from the provisions of the Bill.Any restriction on the right to privacy will have to comply with the conditions prescribed in Puttaswamy I. An executive order issued by the central government authorising any agency of the government to process personal data does not satisfy the first requirement laid down by the Supreme Court in Puttaswamy I — as it is not a law passed by Parliament. The Supreme Court while deciding upon the validity of Aadhar in K.S. Puttaswamy v Union of India [3] noted that “an executive notification does not satisfy the requirement of a valid law contemplated under Puttaswamy. A valid law in this case would mean a law passed by Parliament, which is just, fair and reasonable. Any encroachment upon the fundamental right cannot be sustained by an executive notification.”</p>
<p> </p>
<h3>2. Exemptions under Clause 35 do not comply with the legitimacy and proportionality test</h3>
<p>The lead judgement in Puttaswamy I while formulating the three fold test held that the restraint on privacy emanate from the procedural and content based mandate of Article 21 [4]. The Supreme Court in Maneka Gandhi v Union India [5] had clearly established that “mere prescription of some kind of procedure cannot ever meet the mandate of Article 21. The procedure prescribed by law has to be fair, just and reasonable, not fanciful, oppressive and arbitrary” [6]. The existence of a law is the first requirement; the second requirement is that of ‘legitimate state aim’. As per the lead judgement this requirement ensures that “the nature and content of the law which imposes the restriction falls within the zone of reasonableness mandated by Article 14, which is a guarantee against arbitrary state action” [7]. It is established that for a provision which confers upon the executive or administrative authority discretionary powers to be regarded as non-arbitrary, the provision should lay down clear and specific guidelines for the executive to exercise the power [8]. The third test to be complied with is that the restriction should be ‘proportionate,’ i.e. the means that are adopted by the legislature are proportional to the object and needs sought to be fulfilled by the law. The Supreme Court in Modern Dental College & Research Centre v State of Madhya Pradesh [9] specified the components of proportionality standards —</p>
<ol><li>A measure restricting a right must have a legitimate goal;</li>
<li>It must be a suitable means of furthering this goal;</li>
<li>There must not be any less restrictive, but equally effective alternative; and</li>
<li>The measure must not have any disproportionate impact on the right holder</li></ol>
<p>Clause 35 provides extensive grounds for the Central Government to exempt any agency from the requirements of the bill but does not specify the procedure to be followed by the agency while processing personal data under this provision. It merely states that the ‘procedure, safeguards and oversight mechanism to be followed’ will be prescribed in the rules.The wide powers conferred on the central government without clearly specifying the procedure may be contrary to the three fold test laid down in Puttaswamy I, as it is difficult to ascertain whether a legitimate or proportionate objective is being fulfilled [10].</p>
<p> </p>
<h3>3. Limited powers of Data Protection Authority in comparison with the Central Government</h3>
<p>In comparison with the last version of the Personal Data Protection Bill, 2018 prepared by the Committee of Experts led by Justice Srikrishna, we witness an abrogation of powers of the Data Protection Authority (Authority), to be created, in this Bill. The powers and functions that were originally intended to be performed by the Authority have now been allocated to the Central Government. For example:</p>
<ol><li>In the 2018 Bill, the Authority had the power to notify further categories of sensitive personal data. Under the present Bill, the Central Government in consultation with the sectoral regulators has been conferred the power to do so.</li>
<li>Under the 2018 Bill, the Authority had the sole power to determine and notify significant data fiduciaries, however, under the present Bill, the Central Government has in consultation with the Authority been given the power to notify social media intermediaries as significant data fiduciaries.</li></ol>
<p>In order to govern data protection effectively, there is a need for a responsive market regulator with a strong mandate and resources. The political nature of the personal data also requires that the governance of data, particularly the rule-making and adjudicatory functions performed by the Authority are independent of the Executive.</p>
<p> </p>
<h3>4. No clarity on data sandbox</h3>
<p>The Bill contemplates a sandbox for “ innovation in artificial intelligence, machine-learning or any other emerging technology in public interest.” A Data Sandbox is a non-operational environment where the analyst can model and manipulate data inside the data management system. Data sandboxes have been envisioned as a secure area where only a copy of the company’s or participant companies’ data is located [11]. In essence, it refers to the scalable and creation platform which can be used to explore an enterprise’s information sets. On the other hand, regulatory sandboxes are controlled environments where firms can introduce innovations to a limited customer base within a relaxed regulatory framework, after which they may be allowed entry into the larger market after meeting certain conditions. This purportedly encourages innovation through the lowering of entry barriers by protecting newer entrants from unnecessary and burdensome regulation. Regulatory sandboxes can be interpreted as a form of responsive regulation by governments that seek to encourage innovation – they allow selected companies to experiment with solutions within an environment that is relatively free of most of the cumbersome regulations that they would ordinarily be subject to, while still subject to some appropriate safeguards and regulatory requirements. Sandboxes are regulatory tools which may be used to permit companies to innovate in the absence of heavy regulatory burdens. However, these ordinarily refer to burdens related to high barriers to entry (such as capital requirements for financial and banking companies), or regulatory costs. In this Bill, however, the relaxing of data protection provisions for data fiduciaries would lead to restrictions of the privacy of individuals. Limitations to a fundamental rights on grounds of ‘fostering innovation’ is not a constitutional tenable position, and contradict the primary objectives of a data protection law.</p>
<p> </p>
<h3>5. The primacy of ‘harm’ in the Bill ought to be reconsidered</h3>
<p>While a harms based approach is necessary for data protection frameworks, such approaches should be restricted to the positive obligations, penal provisions and responsive regulation of the Authority. The Bill does not provide any guidance on either the interpretation of the term ‘harm,’ [12] or on the various activities covered within the definition of the term. Terms such as ‘loss of reputation or humiliation’ ‘any discriminatory treatment’ are a subjective standard and are open to varied interpretations. This ambiguity in the definition will make it difficult for the data principal to demonstrate harm and for the DPA to take necessary action as several provisions are based upon harm being caused or likely to be caused.Some of the significant provisions where ‘harm’ is a precondition for the provision to come into effect are —</p>
<ol><li>Clause 25: Data Fiduciary is required to notify the Authority about the breach of personal data processed by the data fiduciary, if such breach is likely to cause harm to any data principal. The Authority after taking into account the severity of the harm that may be caused to the data principal will determine whether the data principal should be notified about the breach.</li>
<li>Clause 32 (2): A data principal can file a complaint with the data fiduciary for a contravention of any of the provisions of the Act, which has caused or is likely to cause ‘harm’ to the data principal.</li><li>Clause 64 (1): A data principal who has suffered harm as a result of any violation of the provision of the Act by a data fiduciary, has the right to seek compensation from the data fiduciary.</li></ol>
<p>Clause 16 (5): The guardian data fiduciary is barred from profiling, tracking or undertaking targeted advertising directed at children and undertaking any other processing of personal data that can cause significant harm to the child.</p>
<p> </p>
<h3>6. Non personal data should be outside the scope of this Bill</h3>
<p>Clause 91 (1) states that the Act does not prevent the Central Government from framing a policy for the digital economy, in so far as such policy does not govern personal data. The Central Government can, in consultation with the Authority, direct any data fiduciary to provide any anonymised personal data or other non-personal data to enable better targeting of delivery of services or formulation of evidence based policies in any manner as may be prescribed.It is concerning that the data protection bill has specifically carved out an exception for the Central Government to frame policies for the digital economy and seems to indicate that the government plans to freely use any and all anonymized and/or non-personal data that rests with any data fiduciary that falls under the ambit of the bill to support the digital economy including for its growth, security, integrity, and prevention of misuse. It is unclear how the government, in practice, will be able to compel organizations to share this data. Further, there is a lack of clarity on the contours of the definition of non-personal data and the Bill does not define the term. It is also unclear whether the Central Government can compel the data fiduciary to transfer/share all forms of non-personal data and the rights and obligations of the data fiduciaries and data principals over such forms of data. Anonymised data refers to data which has ‘ irreversibly’ been converted into a form in which the data principal cannot be identified. However, as several instances have shown ‘ irreversible’ anonymisation is not possible. In the United States, the home addresses of taxi drivers were uncovered and in Australia individual health records were mined from anonymised medical bills [13]. In September 2019, the Ministry of Electronics and Information Technology, constituted an expert committee under the chairmanship of Kris Gopalkrishnan to study various issues relating to non-personal data and to deliberate over a data governance framework for the regulation of such data.The provision should be deleted and the scope of the bill should be limited to protection of personal data and to provide a framework for the protection of individual privacy. Until the report of the expert committee is published, the Central Government should not frame any law/regulation on the access and monetisation of non-personal/ anonymised data nor can they create a blanket provision allowing them to request such data from any data fiduciary that falls within the ambit of the bill. If the government wishes to use data resting with a data fiduciary; it must do so on a case to case basis and under formal and legal agreements with each data fiduciary.</p>
<p> </p>
<h3>7. Steps towards greater decentralisation of power</h3>
<p>We propose the following steps towards greater decentralisation of powers and devolved jurisdiction —</p>
<ol><li>Creation of State Data Protection Authorities: A single centralised body may not be the appropriate form of such a regulator. We propose that on the lines of central and state commissions under the Right to Information Act, 2005, state data protection authorities are set up which are in a position to respond to local complaints and exercise jurisdiction over entities within their territorial jurisdictions.</li>
<li>More involvement of industry bodies and civil society actors: In order to lessen the burden on the data protection authorities it is necessary that there is active engagement with industry bodies, sectoral regulators and civil society bodies engaged in privacy research. Currently, the Bill provides for involvement of industry or trade association, association representing the interests of data principals, sectoral regulator or statutory Authority, or an departments or ministries of the Central or State Government in the formulation of codes of practice. However, it would be useful to also have a more active participation of industry associations and civil society bodies in activities such as promoting awareness among data fiduciaries of their obligations under this Act, promoting measures and undertaking research for innovation in the field of protection of personal data.</li></ol>
<p> </p>
<h3>8. The Authority must be empowered to exercise responsive regulation</h3>
<p>In a country like India, the challenge is to move rapidly from a state of little or no data protection law, and consequently an abysmal state of data privacy practices to a strong data protection regulation and a powerful regulator capable of enabling a state of robust data privacy practices. This requires a system of supportive mechanisms to the stakeholders in the data ecosystem, as well as systemic measures which enable the proactive detection of breaches. Further, keeping in mind the limited regulatory capacity in India, there is a need for the Authority to make use of different kinds of inexpensive and innovative strategies.We recommend the following additional powers for the Authority to be clearly spelt out in the Bill —</p>
<ol><li>Informal Guidance: It would be useful for the Authority to set up a mechanism on the lines of the Security and Exchange Board of India (SEBI)’s Informal Guidance Scheme, which enables regulated entities to approach the Authority for non-binding advice on the position of law. Given that this is the first omnibus data protection law in India, and there is very little jurisprudence on the subject from India, it would be extremely useful for regulated entities to get guidance from the regulator.</li>
<li>Power to name and shame: When a DPA makes public the names of organisations that have seriously contravened data protection legislation, this is a practice known as “naming and shaming.” The UK ICO and other DPAs recognise the power of publicity, as evidenced by their willingness to co-operate with the media. The ICO does not simply post monetary penalty notices (MPNs or fines) on its websites for journalists to find, but frequently issues press releases, briefs journalists and uses social media. The ICO’s publicity statement on communicating enforcement activities states that the “ICO aims to get media coverage for enforcement activities.”</li>
<li>Undertakings: The UK ICO has also leveraged the threats of fines into an alternative enforcement mechanism seeking contractual undertakings from data controllers to take certain remedial steps. Undertakings have significant advantages for the regulator. Since an undertaking is a more “co-operative”solution, it is less likely that a data controller will change it. An undertaking is simpler and easier to put in place. Furthermore, the Authority can put an undertaking in place quickly as opposed to legal proceedings which are longer.</li></ol>
<p> </p>
<h3>9. No clear roadmap for the implementation of the Bill</h3>
<p>The 2018 Bill had specified a roadmap for the different provisions of the Bill to come into effect from the date of the Act being notified [14]. It specifically stated the time period within which the Authority had to be established and the subsequent rules and regulations notified.The present Bill does not specify any such blueprint; it does not provide any details on either when the Bill will be notified or the time period within within which the Authority shall be established and specific rules and regulations notified. Considering that 25 provisions have been deferred to rules that have to be framed by the Central Government and a further 19 provisions have been deferred to the regulations to be notified by the Authority the absence and/or delayed notification of such rules and regulations will impact the effective functioning of the Bill.The absence of any sunrise or sunset provision may disincentivise political or industrial will to support or enforce the provisions of the Bill. An example of such a lack of political will was the establishment of the Cyber Appellate Tribunal. The tribunal was established in 2006 to redress cyber fraud. However, it was virtually a defunct body from 2011 onwards when the last chairperson retired. It was eventually merged with the Telecom Dispute Settlement and Appellate Tribunal in 2017.We recommend that Bill clearly lays out a time period for the implementation of the different provisions of the Bill, especially a time frame for the establishment of the Authority. This is important to give full and effective effect to the right of privacy of the <br />individual. It is also important to ensure that individuals have an effective mechanism to enforce the right and seek recourse in case of any breach of obligations by the data fiduciaries.For offences, we suggest a system of mail boxing where provisions and punishments are enforced in a staggered manner, for a period till the fiduciaries are aligned with the provisions of the Act. The Authority must ensure that data principals and fiduciaries have sufficient awareness of the provisions of this Bill before bringing the provisions for punishment are brought into force. This will allow the data fiduciaries to align their practices with the provisions of this new legislation and the Authority will also have time to define and determine certain provisions that the Bill has left the Authority to define. Additionally enforcing penalties for offences initially must be in a staggered process, combined with provisions such as warnings, in order to allow first time and mistaken offenders from paying a high price. This will relieve the fear of smaller companies and startups who might fear processing data for the fear of paying penalties for offences.</p>
<p> </p>
<h3>10. Lack of interoperability</h3>
<p>In its current form, a number of the provisions in the Bill will make it difficult for India’s framework to be interoperable with other frameworks globally and in the region. For example, differences between the draft Bill and the GDPR can be found in the grounds for processing, data localization frameworks, the framework for cross border transfers, definitions of sensitive personal data, inclusion of the undefined category of ‘critical data’, and the roles of the authority and the central government.</p>
<p> </p>
<h3>11. Legal Uncertainty</h3>
<p>In its current structure, there are a number of provisions in the Bill that, when implemented, run the risk of creating an environment of legal uncertainty. These include: lack of definition of critical data, lack of clarity in the interpretation of the terms ‘harm’ and ‘significant harm’, ability of the government to define further categories of sensitive personal data, inclusion of requirements for ‘social media intermediaries’, inclusion of ‘non-personal data’, framing of the requirements for data transfers, bar on processing of certain forms of biometric data as defined by the Central Government, the functioning between a consent manager and another data fiduciary, the inclusion of an AI sandbox and the definition of state. To ensure the greatest amount of protection of individual privacy rights and the protection of personal data while also enabling innovation, it is important that any data protection framework is structured and drafted in a way to provide as much legal certainty as possible.</p>
<p> </p>
<h3>Endnotes</h3>
<p>1. (2017) 10 SCC 641 (“Puttaswamy I”).</p>
<p>2. Clause 42(1) of the 2018 Bill states that “Processing of personal data in the interests of the security of the State shall not be permitted unless it is authorised pursuant to a law, and is in accordance with the procedure established by such law, made by Parliament and is necessary for, and proportionate to such interests being achieved.”</p>
<p>3. (2019) 1 SCC 1 (“Puttaswamy II”)</p>
<p>4. Puttaswamy I, supra, para 180.</p>
<p>5. (1978) 1 SCC 248.</p>
<p>6. Ibid para 48.</p>
<p>7. Puttaswamy I supra para 180.</p>
<p>8. State of W.B. v. Anwar Ali Sarkar, 1952 SCR 284; Satwant Singh Sawhney v A.P.O AIR 1967 SC1836.</p>
<p>9. (2016)7 SCC 353.</p>
<p>10. Dvara Research “Initial Comments of Dvara Research dated 16 January 2020 on the Personal Data Protection Bill, 2019 introduced in Lok Sabha on 11 December 2019”, January 2020, https://www.dvara.com/blog/2020/01/17/our-initial-comments-on-the-personal-data-protection-bill-2019/ (“Dvara Research”).</p>
<p>11. “A Data Sandbox for Your Company”, Terrific Data, last accessed on January 31, 2019, http://terrificdata.com/2016/12/02/3221/.</p>
<p>12. Clause 3(20) — “harm” includes (i) bodily or mental injury; (ii) loss, distortion or theft of identity; (ii) financial loss or loss of property; (iv) loss of reputation or humiliation; (v) loss of employment; (vi) any discriminatory treatment; (vii) any subjection to blackmail or extortion; (viii) any denial or withdrawal of service,benefit or good resulting from an evaluative decision about the data principal; (ix) any restriction placed or suffered directly or indirectly on speech, movement or any other action arising out of a fear of being observed or surveilled; or (x) any observation or surveillance that is not reasonably expected by the data principal.</p>
<p>13. Alex Hern “Anonymised data can never be totally anonymous, says study”, July 23, 2019 https://www.theguardian.com/technology/2019/jul/23/anonymised-data-never-be-anonymous-enough-study-finds.</p>
<p>14. Clause 97 of the 2018 Bill states“(1) For the purposes of this Chapter, the term ‘notified date’ refers to the date notified by the Central Government under sub-section (3) of section 1. (2)The notified date shall be any date within twelve months from the date of enactment of this Act. (3)The following provisions shall come into force on the notified date-(a) Chapter X; (b) Section 107; and (c) Section 108. (4)The Central Government shall, no later than three months from the notified date establish the Authority. (5)The Authority shall, no later than twelve months from the notified date notify the grounds of processing of personal data in respect of the activities listed in sub-section (2) of section 17. (6)The Authority shall no, later than twelve months from the date notified date issue codes of practice on the following matters-(a) notice under section 8; (b) data quality under section 9; (c) storage limitation under section 10; (d) processing of personal data under Chapter III; (e) processing of sensitive personal data under Chapter IV; (f ) security safeguards under section 31; (g) research purposes under section 45; (h) exercise of data principal rights under Chapter VI; (i) methods of de-identification and anonymisation; (j) transparency and accountability measures under Chapter VII. (7)Section 40 shall come into force on such date as is notified by the Central Government for the purpose of that section.(8)The remaining provision of the Act shall come into force eighteen months from the notified date.”</p>
<p> </p>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/blog/comments-to-the-personal-data-protection-bill-2019'>https://cis-india.org/internet-governance/blog/comments-to-the-personal-data-protection-bill-2019</a>
</p>
No publisherAmber Sinha, Elonnai Hickok, Pallavi Bedi, Shweta Mohandas, Tanaya RajwadeInternet GovernanceData ProtectionPrivacy2020-02-21T10:13:35ZBlog EntryDanish Expert Group on Data Ethics
https://cis-india.org/internet-governance/news/danish-expert-group-on-data-ethics
<b>Amber Sinha was one of the stakeholders who provided inputs to the Danish Expert Group on Data Ethics in June 2018 during their visit to New Delhi. The Expert Group has prepared and submitted its final report.</b>
<p style="text-align: justify; "><span>In April the Danish Expert Group on Data Ethics commenced work on developing recommendations on Data Ethics for the Danish Government. The expert group have now handed over their recommendations to the Danish Minister of Industry, Business and Financial Affairs. <a class="external-link" href="http://cis-india.org/internet-governance/files/data-for-the-benefit-of-people">Read the report</a>.<br /></span></p>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/news/danish-expert-group-on-data-ethics'>https://cis-india.org/internet-governance/news/danish-expert-group-on-data-ethics</a>
</p>
No publisherAdminInternet GovernanceData ProtectionData ManagementPrivacy2018-12-01T04:42:42ZNews ItemSFLC Round Table Discussion on Personal Data Protection Bill
https://cis-india.org/internet-governance/news/sflc-round-table-discussion-on-personal-data-protection-bill
<b>Shweta Mohandas participated in a Round Table Discussion on Personal Data Protection Bill, orgnanised by SFLC on September 25, 2018 in Bangalore. She also moderated the first session - Data Protection Principles (Rights and Obligations).</b>
<p>See the agenda of the <a class="external-link" href="http://cis-india.org/internet-governance/files/agenda-for-round-table-for-data-protection">event here</a>.</p>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/news/sflc-round-table-discussion-on-personal-data-protection-bill'>https://cis-india.org/internet-governance/news/sflc-round-table-discussion-on-personal-data-protection-bill</a>
</p>
No publisherAdminInternet GovernanceData ProtectionPrivacy2018-10-02T03:16:19ZNews ItemA Series of Op-eds on Data Protection
https://cis-india.org/internet-governance/blog/a-series-of-op-eds-on-data-protection
<b>I wrote a short series of three op-eds for Asia Times this week.</b>
<p style="text-align: justify; ">The first article "<a class="external-link" href="http://www.atimes.com/user-consent-key-data-protection-india/">User consent is the key to data protection in India</a>" examines the debate around consent and the arguments made to discard it. I question the premise of big data exceptionalism, particularly in the absence of any mature governance models which address use regulation.</p>
<p style="text-align: justify; ">In the second article "Robust economic argument for a sound Indian data protection law", I examine the substance of the argument of 'innovation' as a legitimate competing interest with respect to privacy, and questionthe economic arguments made in support of innovation enabled by unregulated access to data.</p>
<p style="text-align: justify; ">In the third article "<a class="external-link" href="http://www.atimes.com/indias-data-protection-needs-graded-enforcement-mechanism/">India’s data protection law needs graded enforcement mechanism</a>", I look at the two competing arms of regulation - enforcement and compliance, and how a balance of two is need in India,with an empowered regulator and drawing from the principles from responsive regulation theory.</p>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/blog/a-series-of-op-eds-on-data-protection'>https://cis-india.org/internet-governance/blog/a-series-of-op-eds-on-data-protection</a>
</p>
No publisheramberData GovernanceInternet GovernanceData ProtectionPrivacy2018-02-19T02:08:28ZBlog EntryThe Fundamental Right to Privacy - A Visual Guide
https://cis-india.org/internet-governance/blog/the-fundamental-right-to-privacy-a-visual-guide
<b>Privacy is the ability of an individual or group to seclude themselves, or information about themselves, and thereby express themselves selectively. This visual guide to the story of privacy law in India and the recent judgement of the Puttaswamy v.
Union of India case is developed by Amber Sinha (research and content) and Pooja Saxena (design and conceptualisation).
</b>
<p> </p>
<h4>The Fundamental Right to Privacy - A Visual Guide: <a href="https://cis-india.org/internet-governance/files/amber-sinha-and-pooja-saxena-the-fundamental-right-to-privacy-a-visual-guide/at_download/file">Download</a> (PDF)</h4>
<hr />
<iframe src="//www.slideshare.net/slideshow/embed_code/key/1MMYCXyxa2YBip" frameborder="0" marginwidth="0" marginheight="0" scrolling="no" height="485" width="595"> </iframe>
<p> </p>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/blog/the-fundamental-right-to-privacy-a-visual-guide'>https://cis-india.org/internet-governance/blog/the-fundamental-right-to-privacy-a-visual-guide</a>
</p>
No publisheramberPrivacyInternet GovernanceFeaturedData GovernanceData Protection2018-02-16T05:31:37ZBlog EntryUnpacking Data Protection Law: A Visual Representation
https://cis-india.org/internet-governance/blog/unpacking-data-protection-law-a-visual-representation
<b>This visual explainer unpacking data protection law was developed by Amber Sinha (research) and Pooja Saxena (design), and published as part of the Data Privacy Week celebrations on the Privacy International blog. Join the conversation on Twitter using #dataprivacyweek.</b>
<p> </p>
<h4>Cross-posted from <a href="https://medium.com/@privacyint/unpacking-data-protection-300e51c5f9b5" target="_blank">Privacy International blog</a>.</h4>
<h4>Credits: Flag illustrations, when not created by the authors, are from <a href="http://www.freepik.com/" target="_blank">Ibrandify / Freepik</a>.</h4>
<hr />
<img src="https://github.com/cis-india/website/blob/master/img/AS-PS_UnpackingDataProtectionLaw_2018_01.png?raw=true" alt="Data protection law systems are usually seen as a dichotomy between the United State of America and the European Union" width="80%" />
<img src="https://github.com/cis-india/website/blob/master/img/AS-PS_UnpackingDataProtectionLaw_2018_02.png?raw=true" alt="This dichotomy is not an accurate representation of the issue. Today, close to a hundred countries follow the omnibus approach, while less than a dozen, including the US, use the sectoral approach." width="80%" />
<img src="https://github.com/cis-india/website/blob/master/img/AS-PS_UnpackingDataProtectionLaw_2018_03.gif?raw=true" alt="If too many laws apply to the same actor, compliance becomes difficult. As a result, the sectoral approach to data protection is becoming less relevant." width="80%" />
<img src="https://github.com/cis-india/website/blob/master/img/AS-PS_UnpackingDataProtectionLaw_2018_04.png?raw=true" alt="Data protection regulation involve interaction between regulators and industry." width="80%" />
<img src="https://github.com/cis-india/website/blob/master/img/AS-PS_UnpackingDataProtectionLaw_2018_05.gif?raw=true" alt="To be an effective data protection regulator, an entire range of regulatory tools are required, which the regulator can use to reward, support and sanction." width="80%" />
<p> </p>
<p>
For more details visit <a href='https://cis-india.org/internet-governance/blog/unpacking-data-protection-law-a-visual-representation'>https://cis-india.org/internet-governance/blog/unpacking-data-protection-law-a-visual-representation</a>
</p>
No publisheramberData GovernanceInternet GovernanceData ProtectionPrivacy2018-02-15T13:22:00ZBlog Entry