Have a safety catch not lock

Have a safety catch not lock

On August 24, 2017, the Supreme Court recognised the right to privacy as a fundamental right guaranteed under the Constitution. As a result, a committee of experts appointed by the ministry of electronics and information technology under the chairmanship of former Supreme Court Justice B N Srikrishna released the first draft of the Personal Data Protection Bill, 2018, on July 27, 2018.

The Bill draws features from various global privacy laws, including the EU’s General Data Protection Regulation (GDPR). But it comes bundled with challenges, loopholes and unanswered questions. In its extraterritorial application, for instance, the proposed Bill applies to any entity not established within India that provides goods and services to individuals within India, as well as to any activity involving the profiling of persons in India.

But where do we draw the line? Consider an e-commerce business having a website hosted in the US accessible from India. The website would track users (including Indian residents) visiting the website, specific products searched for, and general preferences via cookies or similar tracking mechanisms. However, if the company is primarily focused on servicing US-based customers, would the law be applicable just because its website is accessible within India?

Key criteria, such as the use of local domain address, local languages, Indian currency and content targeting Indians will play a key role in determining the extraterritorial application not currently specified under the proposed Bill.

The proposed Bill explicitly calls out that the law won’t apply to the processing of anonymised data. However, in the definition of anonymisation, the data fiduciary is required to apply standards specified by the authority for anonymisation. Interestingly, excluding anonymised data from the law would considerably bring down the obligations on entities, both in private and public sector. However, this data could be used for targeted advertisements or running political campaigns, which, if not adequately regulated, may cause harm to specific groups of individuals.

In many ways, the proposed Bill is a verdict on data localisation. It suggests that all entities must maintain one copy of personal data within India. Further, it also requires that critical personal data shall only be processed in India, while it also lists specific circumstances in which data, other than critical personal data, shall be transferred outside the country. Here again, the Bill mandates requirements, including approval of the country in question by GoI, consent of data principle, and appropriate contractual clauses.

While the intent of the Bill to ensure security of personal data is laudable, it is restrictive in many ways from a business perspective. Once it is clearly established that a target country has got a positive data protection regime with reciprocal arrangement for enforcement, why should there be a differential treatment between personal data and critical personal data with respect to data transfer? Further, the concept of creating a local copy may have been built on the premise of better availability of data from a law enforcement and national security perspective.

Availability of data stored in countries with positive data protection regimes will typically be available to data fiduciary, but only in extreme instances (e.g., during war). Given this, certain types of personal data may require a local copy from the perspective of the State’s interest. However, having a onesize-fits-all approach of having a copy of all personal data is not prudent.

Data localisation and restriction of transfer will impact business across multiple industries that are today cloudled. It can impact the low asset business model of startups, and also hike the cost of doing business in general across industries.

The proposed Bill requires mandatory notification of personal data breaches to the authority, if such a breach is likely to cause harm to the individuals concerned. Data breach notification is clearly the right way forward. However, a few open-ended elements remain.

The authority is to determine whether a data breach needs to be reported to the affected individuals or not. This creates a bottleneck, and comes in the way of timely notification to affected parties so as to take precautionary measures to prevent further damage. Further, the draft Bill does not specify any timeline for notification once the breach is identified. In the case of GDPR, for instance, it is 72 hours once the breach is identified. Additional guidelines need to be issued to help companies better determine what constitutes a personal data breach and when it qualifies notification to the authority.

As the Bill is currently submitted to GoI, one would be interested to see what shape it takes, and whether it stays true to its key objective: to “ensure growth of the digital economy while keeping personal data of citizens secure and protected”.