Dec 17, 2019

Better walk with care Vikram Koppikar Worried. That’s the word that captures the general mood of India Inc when it comes to the Personal Data Protection Bill. The Bill, which was introduced in the Lok Sabha on December 11, 2019, has been sent to a joint select committee for further scrutiny. related news The final Bill eases some of the data localisation requirements of the previous version, but inserts certain provisions that are making companies lose sleep. The one exempting government agencies from the provisions of the Bill, if required, remains an eyesore. There is also some heartburn about access to non-personal data for policymaking and additional verification of social media firms that process large personal information. Data principal in this context is broadly defined as the person to whom the personal data relates to. It’s a question of trust when he or she shares personal information with various companies or data fiduciaries that collect or use such data. Having said that, there is no dearth of challenges as far as interpretation of the Bill, its enforcement and redressal mechanisms are concerned. We tried to untie the knots and did a quick analysis of what Corporate India can expect while negotiating this potential minefield. a) Applicability: Secton 3(31) defines data processing as an operation or set of operations performed on personal data, which may include operations such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, use, alignment or combination, indexing, disclosure by transmission… or destruction. Another section lays down the factors authorities will have to take into account while categorising a data fiduciary as “significant” — (a) volume (b) sensitivity of personal data processed. The above definitions would imply that organisations such as medical institutions and schools come under the ambit of the Bill as “significant data fiduciaries”, given that they handle medical records and other children-related information (Section 16). Whether these institutions are well equipped to comply with the same is anybody’s guess. b) Legislative overlap: It is common knowledge that the Bill has been modelled closely on the lines of GDPR (General Data Protection Regulation), which governs the rights of European Union subjects. Corporates may now face scenarios where there will be an inevitable overlap among the Bill, GDPR and other international data protection statutes. Section 2(A) states that the provision shall apply to “(a) the processing of personal data where such data has been collected, disclosed, shared or otherwise processed within the territory of India; (b) the processing of personal data by the State, any Indian company, any citizen of India or any person or body of persons incorporated or created under Indian law”. Read along with Section 3(31) above, it would imply that Indian companies which deal in “processing” of data in India are governed by the Data Protection Bill. However, personal data relating to EU citizens is required to be processed by GDPR irrespective of where it is processed. Industries such as business process outsourcing (BPO), knowledge process outsourcing (KPO) and other “back office” companies, which process overseas personal data in India, need clarity on which legislation will ultimately prevail. c) Lawful consent? “Legitimate interest” under GDPR is a concept that allows processing of personal data for more than one purpose based on various criteria. The Bill too has replicating parts. According to Section 5, the entity processing personal information shall process the same in a fair and reasonable manner and ensure privacy of the data principal. It has to be for the purpose consented to or connected with the same purpose. The data principal would reasonably expect that such personal information shall be used for the context and circumstances in which it’s collected. One close read of the paragraph brings up the question whether such consent can actually be lawfully considered to be obtained. d) Redressal mechanism: The Bill confers a host of rights on the data principal in relation to data processing, which include being updated about how, and why his/her data is processed. The principal will have the right to access in one place the identity of the data fiduciaries with whom his personal data is shared. These sections stipulate a composite “registry” of sorts. Given the multitude of industry that process personal information, it remains to be seen whether cross industry synchronisation can be arrived at to create such a registry.