DIGITAL PERSONAL DATA PROTECTION ACT, 2023 – FINALLY NOTIFIED!

Background

Six years after the Supreme Court ruled that the right to privacy falls within the ambit of Article 21 of the Constitution of India in Justice Puttaswamy (Retd) v. Union of India, India has finally enacted the Digital Personal Data Protection Act, 2023 (Act), published in the Gazette of India on 11 August 2023. The Act saw a tumultuous path towards enactment which started with the appointment of a special committee headed by Justice B N Srikrishna followed by the introduction of several drafts and severe criticisms surrounding them. This legal update is prepared with the objective to provide you with a brief overview of the Act and implications on its non-compliance as it is applicable to every organisation (small or large) in India.

Scope and Applicability | Personal Data

The Act defines ``personal data`` as any information that can pinpoint an individual’s identity and processing of personal data entails various activities such as gathering, storing, utilizing, and sharing of such data.

The Act covers the handling of digital personal data in India, whether collected online or offline, as long as it is in digital form. Additionally, the Act applies to processing personal data outside India if it is related to providing goods or services within India.

The Act however does not apply to personal data that is made publicly available by the person to whom such personal data relates; or to any other person who is obligated under any law for the time being in force in India to make such personal data publicly available.

Consent | Data Principal

The Act emphasises that before processing any personal data, a Data Fiduciary, i.e. a person who processes personal data (Data Fiduciary), must take consent from the Data Principal, i.e. the individual to whom the personal data relates (Data Principal). In order to take consent, the Data Fiduciaries must first provide a notice specifying the particular personal data to be collected and the specific purpose for which it will be used (Notice). The consent given by the Data Principal shall be limited only to the extent of the specific purpose as made out in the Notice and any consent taken beyond the specific purpose shall not be considered valid.

A Data Principal may also appoint a consent manager, i.e. a person registered under the Act to act as a single point of contact to enable a Data Principal to give, manage, review and withdraw their consent through an accessible, transparent and interoperable platform (Consent Manager). A Consent Manager shall be accountable to the Data Principal under the Act and a Data Principal shall have a right of redressal of grievances by the Consent Manager.

Further, Data Principals retain the right to revoke their consent at any time upon which the Data Fiduciary shall within a reasonable time cease and cause its data processor, i.e. a person who processes the personal data on behalf of a Data Fiduciary, to cease the processing of the personal data of such Data Principal.

Obligations of Data Fiduciaries

The Act places substantial responsibilities on the Data Fiduciaries. These obligations encompass making reasonable efforts to ensure data accuracy and completeness, establishing security measures to prevent data breaches, promptly notifying both the Data Protection Board of India and affected Data Principal in the event of a breach, and erasing personal data once its intended purpose is fulfilled and legal retention is no longer necessary. Further, if a Data Fiduciary sends personal data to a data processor, the Data Fiduciary is liable for the actions/ inactions of the data processor.

Rights and Duties of Data Principals

The Act further acknowledges the rights of the Data Principals. These rights encompass the ability to obtain information about how their data is being processed, request corrections or erasure of their personal information, nominate a representative in case of incapacity or death, and seek remedies from the Data Fiduciary of any grievance they may have. Certain responsibilities have also been imposed upon the Data Principal such as refraining from making false or unnecessary complaints and providing accurate information.

Cross-border Data Transfer

The Act allows personal data to be transferred beyond India, except to countries which may be specifically notified by the Central Government. This provision however does not restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India.

Significant Data Fiduciaries

Under the Act, the Central Government may notify any Data Fiduciary or class of Data Fiduciaries as a significant data fiduciary, on the basis of an assessment of relevant factors a such as the volume and sensitivity of personal data being processed, potential risk to the rights of Data Principal, impact on the sovereignty and integrity of India, security of the State and public order. Entities that are notified as significant data fiduciaries have to maintain extra compliances such as conducting independent and periodic data audits and appointing a data protection officer and an independent data auditor to gauge the impact of their actions and ensure compliance with the regulations.

Data Protection Board of India

The Act envisages the appointment of a Data Protection Board of India (Board) to be established through a notification by the Central Government to that effect. The Board shall act as the adjudicating body for any breach of personal data.

Breach of Personal Data

Personal data breach has been defined under the Act as any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.

1. In case of a breach of personal data, the Data Fiduciary must immediately inform the Board as well as the Data Principal, whose personal data was breached.

2. The Board would then inquire into the breach.

3. If the Board is of the opinion that there are insufficient grounds to proceed with the complaint, it may close the proceedings and impose costs if the Board believes that the complaint was frivolous.

4. If after inquiring into the complaint, the Board believes that there are sufficient grounds to proceed with the complaint, it shall conduct a further investigation into the complaint.

5. After investigating into the complaint, the Board may issue interim orders.

6. If the Board believes that there has been a breach of personal data, the Board may impose a penalty which can range from Rs 10,000 (Indian Rupees Ten Thousand) to Rs 250,00,00,000 (Indian Rupees Two Hundred and Fifty Crores). The specific penalties have been laid down in the Schedule of the Act.

7. While deciding the amount of the monetary penalty, the Board shall look into the following matters:

   • the nature, gravity and duration of the breach;
     
     
   • the type and nature of the personal data affected by the breach;
     
     
   • repetitive nature of the breach;
     
     
   • whether the person, as a result of the breach, has realised a gain or avoided any loss;
     
     
   • whether the person took any action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of such action;
     
     
   • whether the monetary penalty to be imposed is proportionate and effective, having regard to the need to secure observance of and deter breach of the provisions of the Act; and
     
     
   • the likely impact of the imposition of the monetary penalty on the person.
     

8. Any person aggrieved by the order of the Board may appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days from the date of receipt of Order of the Board, and the TDSAT shall dispose of the appeal within 60 days of the presentation of the appeal. The TDSAT shall have all the powers of a civil court.

9. Additionally, the Board has the power to direct any complaint to be resolved through mediation.

MHCO Comment:

In this age of inevitable digitalisation of all personal information, the Act comes as a welcome move to protect people’s privacy. However, a perusal of the Act shows that the Central Government has been given significant powers such as the powers of exclusion of specific Data Fiduciaries and instrumentalities of the State from the ambit of the Act and to notify a Data Fiduciary as a significant data fiduciary. Concerns about inordinate Executive interference may hence arise and this could alter the effectiveness of the Act. This would also make the Rules to be notified under the Act essential in carving out the operative aspects of the Act.

Further the Act suffers from the practical difficulty of a lack of timeline for the appointment of the Board by the Central Government without which the Act would be remain powerless. It is also very ambitious of the Act to envisage compliance with the heavy obligations imposed upon all the Data Fiduciaries, considering the wide ambit of the term, which would also cover under it the smallest of enterprises such as photocopy stores which receive bulks of personal data on a daily basis. Such obligations also include the establishment of grievance redressal mechanisms by every Data Fiduciary. The severity of the obligations imposed upon the Data Fiduciaries stands further enhanced when the burdensome penalties laid down under the Act are considered. The Act hence has a large feat to accomplish.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or legalupdates@mhcolaw.com for any assistance.

 On 2 June 2023, the Reserve Bank of India issued the draft Master Directions on Cyber Resilience and Digital Security Control for Payment System Operators (Draft Directions) with the objective of effectively addressing emerging information systems and cybersecurity risks. These Draft Directions lay down the framework for installing a governance mechanism for (a) identification; (b) assessment; (c) monitoring; and (d) management of cybersecurity risks including information security risks and vulnerabilities and specify baseline security measures for ensuring safe and secure digital payment transactions. This update will briefly analyse the Draft Directions.

Applicability of the Directions:

The provisions of these Directions are applicable to all authorised non-bank Payment System Operators (PSOs) such as Gpay, Paytm, Mastercard, Visa, Rupay etc. The Draft Directions are issued in order to effectively monitor, identify, control and manage cyber and technology related risks arising out of linkages of PSOs with unregulated entities who are part of their digital payments ecosystem.

Responsibility of Board of Directors:

The Draft Directions place the onus on the board of directors of the PSOs (Board) to formulate an Information Security Policy to manage information security risks. However, oversight of the same may be delegated to a sub-committee of the Board which shall meet at least once every quarter. Furthermore, the Board shall entrust the responsibility and accountability for implementation of the Information Security Policy and Cyberspace Resilience Framework; as well as for continuously assessing the overall information security posture of the PSO to a senior level executive e.g. Chief Information Security Officer (CISO).

The said policy shall be reviewed periodically and shall cover the minimum (a) roles of other key personnel; (b) measures to identify, assess, manage and monitor cyber security risk which also include various types of security controls for ensuring cyber resiliency along with processes for training and awareness of employees/stakeholders.

Salient Features:

The Draft Directions provide for the following information security measures:

1. PSOs shall prepare a distinct Board approved Cyber Crisis Management Plan to detect, contain, respond and recover from cyber threats and cyber-attacks.

2. The PSOs shall undertake a cyber risk assessment exercise relating to launch of new products, services, technologies or undertaking major changes to infrastructure or processes of existing product, services.

3. The PSOs shall maintain a record of all key roles, information assets, critical functions and processes, third-party service providers and their inter-connections and classify and document their levels of usage, criticality and business value.

4. The access to systems and different environments shall be based on the principle of least privilege.

5. The PSOs shall ensure that all its applications are subjected to rigorous security testing, such as source code review, etc through qualified agencies at adequate frequency in authenticated mode.

6. The PSOs shall put in place a comprehensive data leak prevention policy for confidentiality, integrity, availability and protection of business and customer information (both in transit and at rest) in respect of data available with it or at vendor managed facilities, commensurate with the criticality and sensitivity of the information held / transmitted.

7. The PSOs shall put in place a Board approved incident response mechanism, which shall include provisions to promptly notify its senior management, relevant employees and regulatory, supervisory and relevant public authorities, of cyber incidents.

8. The PSOs shall report any unusual incident including those involving cyber-attacks, outage of critical system, infrastructure, internal fraud, settlement delay etc, to the RBI in the Incident Reporting Format within 6 hours of detection. Any cyber security incident shall also be reported to CERT-In.

MHCO Comment:

The Draft Directions are a welcome step towards ensuring that the PSOs take adequate steps to protect themselves and the data available with it from emerging cyber security threats. These Draft Directions assume further significance due to the growing digital payments ecosystem in India, which is driven by a combination of government initiatives, increase in internet and smartphone usage and the rise of e-commerce.

This article was released on 12 June 2023.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or legalupdates@mhcolaw.com for any assistance.

 COMPETITION LAW UPDATE | GOOGLE LOSES ITS MONOPOLY

The National Company Law Appellate Tribunal (NCLAT) vide its Order in Google LLC & Others vs Competition Commission of India & Others dated 29 March 2023, upheld the ruling (Impugned Order) of the Competition Commission of India (CCI) passed against Google LLC (Google). Consequently, Google has been directed to deposit the amount of penalty imposed upon it by the CCI to the tune of INR 13.37 Billion for violation of the anti-competitive provisions laid down in the Competition Act 2002 (Act).

BACKGROUND:

Google had acquired Android Operating System (Android OS) back in 2005. Since then, Google has been the owner of the most used Operating System (OS) in India and hence enjoys a dominant position in the market for licensable OS for smartphones in India.

However, Google`s several practices were found to amount to abuse of dominant position as defined under the Act. Consequently, in October 2022, CCI held Google to be in violation of the anti-competitive regulations in force in India and for abusing its dominant position in multiple markets within the Android ecosystem.

CCI observed that Google operates and manages not only Android OS licensing, but also licenses its other proprietary applications such as YouTube, PlayStore, Google Search and Google Chrome.

Naturally, Original Equipment Manufacturers (OEMs) such as Samsung and Motorola, enter into multiple agreements with Google for grant of licenses for the use of Android OS and other Google applications in their smartphones. It was observed that through the conditional clauses in these agreements, such as preinstallation of the bouquet of Google apps on OEM devices and clauses meant to ensure total exclusion of its competitors, assure that Google continues to accord a significant competitive edge over its competitors. Such practices of Google have also created entry barriers for competitors of Google to enter or operate in the concerned markets.

Therefore, CCI imposed a monetary penalty of INR 13.37 Billion on Google under Section 27 of the Act for violating Section 4 of the Act (sited below) and further laid down certain directions to be complied with by Google. The Impugned Order was challenged before the NCLAT, wherein an order upholding the Impugned Order was passed on 29 March 2023.

RELEVANT STATUTORY PROVISIONS:

Section 4 of the Act defines dominant position as a position of strength enjoyed by an enterprise in the relevant market in India, which enables it to:

i. operate independently of competitive forces prevailing in the relevant market; or ii. affect its competitors or consumers or the relevant market in its favour.

Further, the aforesaid Section also provides that there shall be an abuse of dominant position if an enterprise or a group inter alia-

a) directly or indirectly, imposes unfair or discriminatory condition in purchase or sale of goods or service (excluding discriminatory conditions which may be adopted to meet the competition); or
b) limits or restricts technical or scientific development relating to goods or services to the prejudice of consumers; or
c) indulges in practice or practices resulting in denial of market access [in any manner]; or
d) makes conclusion of contracts subject to acceptance by other parties of supplementary obligations which, by their nature or according to commercial usage, have no connection with the subject of such contracts; or
e) uses its dominant position in one relevant market to enter into, or protect, other relevant market.

HELD:

NCLAT accepted the contention of the appellants that Section 4 of the Act requires an effect analysis in addition to a fact or per se analysis. That is to say, it is not sufficient if a dominant market player has engaged in abusive practices as defined under Section 4 of the Act, it must further be proven that such practices have had a real effect on the market and have not been ineffective.

Applying the effect analysis, NCLAT upheld the findings of CCI that Google was in violation of several provisions of the Act. Hence, Google is liable to pay a monetary penalty of INR 13.37 Billion. Further, NCLAT upheld six of the ten directions passed in the Impugned Order and the same were to be implemented within 30 days of the NCLAT Order. The upheld directions are as follows: : (1) OEMs to not be compelled to pre-install the entire bouquet of Google apps nor be directed as to their placement; (2) licensing of PlayStore to not be linked with pre-installation of Google apps; (3) no incentivization for ensuring exclusivity to Google services; (4) no anti-fragmentation obligations on the OEMs and complete freedom for them to develop devices based on other Operating Systems apart from Android; (5) to not prohibit OEMs from selling smart devices based on Android forks; (6) giving users the freedom to choose their default search engines along with the freedom to alter their default setups later.

MHCO Comment:

Considering that India is a growing market of start-ups and innovation, it becomes imperative that the established giants in the market are not allowed to create barriers to entrance or to the growth of newcomers and competitors. The sanctions imposed on Google are stringent and have the capacity to change the dominance enjoyed by Google. However, Google may appeal against the NCLAT Order thereby, further delaying compliance with the directions.

Further, NCLAT went beyond its judicial powers by holding that Section 4 of the Competition Act requires an effect analysis as opposed to just a fact analysis. Interestingly, NCLAT analysed that the CCI has in the past applied both approaches, and yet went on to hold that the only appropriate test to be applied under Section 4 of the Act is the effect analysis. Further, NCLAT failed to observe that while Section 3 of the Act specifically refers to effect as an essential ingredient therein, Section 4 doesn`t. This shows the express legislative intent to exclude the effect analysis from the purview of Section 4. NCLAT has hence gone beyond its powers and effectively carried out a legislative function.

This article was released on 4 May 2023.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or legalupdates@mhcolaw.com for any assistance.