Review of Definitions under the PDP

Pinned update

Open source Python tools for startups to implement privacy and do compliance Rumanu Bharadwaj presented a talk at The Fifth Elephant winter edition on differential privacy. Among other things, Rumanu explained how libraries such as Py… more

India’s Personal Data Protection (PDP) Bill has been in the news for multiple reasons. This includes tech giants such as Whatsapp unwilling to implement data protection policies until the Bill was passed in mid July ¹. In addition to this with the passage of the IT Rules, 2021 debates regarding Indian governance over data, through shifts in encryption policies were also heavily reported on ². One can also view Hasgeek’s ongoing research on the IT Rules, 2021 for further understanding of the complexity it poses to Indian’s today.

On 8 July, members of the JPC were elevated to ministerial positions, leaving the future of data protection regulation in India uncertain. Hence, there were concerns about the passage of PDP Bill without consultation with other members of the Joint Parliamentary Committee (JPC). Postponing the submission of the JPC report post the reconstitution of it’s members till the winter session in November 2021 ³.

Thus, the 2019 version is the latest draft of the PDP Bill that one can access and is the main frame of reference for our critique. The text of the Bill can be viewed at http://164.100.47.4/BillsTexts/LSBillTexts/Asintroduced/373_2019_LS_Eng.pdf

Peer review and feedback for the PDP Bill: Privacy Mode programme took the opportunity to submit a peer reviewed set of recommendations for the 2019 draft PDP Bill between 10 and 14 September. The peer reviewed recommendations document has been shared with:

B N Mohapatra of the Joint Parliamentary Committee (JPC) Secretariat.
P P Chaudhary, JPC Chairperson.
Ashwani Vaishnaw of MEITY.
Rajeev Chandrasekar of MEITY.
Piyush Goyal of the Department for Promotion of Industry and Internal Trade (DPIIT).
~30 representatives from Lok Sabha and Rajya Sabha.

Privacy Mode’s and Hasgeek’s vision is to foster peer review in the practice of technology. Solutions and problem solving approaches - those involving technology - need to be critiqued and discussed in public. The end goal is not a perfect solution. Discussing and acknowledging the pros and cons of different approaches - and putting it out there that vulnerabilities exist and must be watched - makes for sound technology (and policy) implementation.

Since 2010, Hasgeek has created platforms for practitioners to share case studies of technology (and subsequently legal and policy) implementations in the domains of data, large-scale infrastructure, Cloud infrastructure and systems engineering, security and most recently, data privacy. Tech practitioners - across a wide variety of companies and sectors - share their work at conferences and forums that Hasgeek organizes. Presenters are vetted through a process of peer review and feedback. Participants benchmark their organization’s practices against what their peers from the industry share at these platforms. A safe and welcoming environment is created to collectively introspect on emerging business, economic and societal challenges where technology has a role to play.

In the spirit of peer review, Hasgeek worked with the technology and startup ecosystems, especially between 2020 and 2021, to understand their views and concerns about privacy and data security. This submission to the JPC is consolidated from the concerns and recommendations voiced at the following forums:

Research on Non-Personal Data (NPD) with 50 representatives from engineering and product teams in startups, and with VCs and founders: The research and outreach are published at: https://hasgeek.com/PrivacyMode/non-personal-data/
Research conducted with practitioners from the tech industry between April and November 2020 on the state of privacy-tech and readiness to implement data protection in India: https://hasgeek.com/PrivacyMode/privacy-in-indian-tech-2020/ with participants from PayTech, Fintech, SaaS, social networking, and health tech.
India’s first Data Privacy Product and Engineering Conference organized in April 2021 brought practitioners from Fintech, Consumer Tech and SaaS companies to share experiential case studies about technology approaches and organizational processes for doing compliance, data security and privacy: https://hasgeek.com/rootconf/data-privacy-conference/videos.

The purpose of this submission is three-fold:

To present the concerns of tech practitioners from small⁴, medium and large businesses with the PDP Bill, and what they foresee as significant compliance challenges.
To request the JPC to carry out public consultations with software architects, product teams and legal teams from small, medium and large-sized organizations about potential technical challenges in implementing the PDP Bill.
To incorporate the spirit of peer review in the policy-making process, where practitioners can offer feedback on the ‘technique’ and technicalities of implementation, and safeguards that have to be put in place to ensure true data protection.

In this submission, we have highlighted the following concerns that small and medium enterprises have with regards to the PDP Bill:

Ambiguous definitions.
Data localization and international policy.
Costs of compliance.
Power of the Data Protection Authority (DPA) over Data Fiduciaries.
Governance of Non-Personal Data (NPD).

The key concerns and recommendations have been expanded in the following sections. Scroll down to read.

About the authors

- [Bhavani Seetharaman](https://hasgeek.com/Bhavani-21) is a Research Associate at Hasgeek. She has previously worked for the Centre for Budget and Policy Studies (CBPS), Microsoft Research India, and the University of Michigan, Ann Arbor.
- Nadika Nadja is a researcher (https://hasgeek.com/nadikanadja) at Hasgeek. She has worked across advertising, journalism, TV & film production as a writer, editor and researcher.

Acknowledgements

We thank the following individuals for reviewing this submission and for providing valuable inputs during its drafting.

Suman Kar, founder of security firm Banbreach, for participating in writing the early drafts of this submission. Suman’s work on data security includes analysis of predatory loan apps and impact on consumers - https://hasgeek.com/cashlessconsumer/killerloanapps-detecting-fake-fintech-apps/
Rajiv Onat, Senior Leader working on Data Platforms, for reviewing key concerns and adding nuance on operational aspects of compliance.
Yagnik Khanna, independent software architect and curator at Rootconf, for reviewing key concerns and adding nuance to compliance requirements from engineering and inclusion perspectives.
Sathish KS, Senior Engineering Leader, for reviewing key concerns and adding nuance on operational aspects of compliance. Sathish has also shared perspectives and concerns about the costs of compliance and impact on engineering processes under the proposed NPD framework at https://hasgeek.com/PrivacyMode/impact-of-non-personal-data-npd-framework-on-engineering-processes/videos

Contact details

If you have comments and inquiries, post them at https://hasgeek.com/PrivacyMode/pdp-bill/comments. Follow #PrivacyMode on Twitter

WhatsApp and the wait for Data Protection Bill - https://www.thehindubusinessline.com/business-laws/whatsapp-and-the-wait-for-data-protection-bill/article35266846.ece ↩︎
The Encryption Debate in India: 2021 Update- https://carnegieendowment.org/2021/03/31/encryption-debate-in-india-2021-update-pub-84215 ↩︎
JPC gets time to present report on personal data protection bill - https://www.livemint.com/news/india/jpc-to-seek-time-to-present-report-on-personal-data-protection-bill-11627017273374.html ↩︎
MSME defines small, medium and micro enterprises based on investments and turnover amounts https://msme.gov.in/know-about-msme. In this submission, based on recommendations by the reviewers, we have defined small, medium and micro enterprises based on the number of employees and the community the enterprise is working for. If the product is extremely niche and focuses on very small consumer groups, then the compliance with regards to data protection as well as the definition of Significant Data Fiduciary (SDF) must be carefully looked into. ↩︎

Hosted by

Privacy Mode

Deep dives into privacy and security, and understanding needs of the Indian tech ecosystem through guides, research, collaboration, events and conferences. Sponsors: Privacy Mode’s programmes are sponsored by: more

Supported by

Omidyar Network India

Omidyar Network India invests in bold entrepreneurs who help create a meaningful life for every Indian, especially the hundreds of millions of Indians in low-income and lower-middle-income populations, ranging from the poorest among us to the existing middle class. To drive empowerment and social i… more

AWS

We’re the world’s most comprehensive and broadly adopted cloud platform, offering over 200 fully featured services from data centers globally. As a hyperscale cloud service provider, AWS provides access to highly advanced computing tools on rent for startups and SMEs at affordable prices. We help t… more

Review of Definitions under the PDP

Submitted Sep 12, 2021

Ambiguous definitions for compliance (Clauses 14, 24)

Clause 14 states that personal data can be processed without consent. Specifically, Subclause 14(1)(c) states that any data in need of public interest shall be given this right without consent. Nowhere in the PDP Bill is there a definition of what constitutes public interest. This can lead to large-scale misinterpretation of the legislation. Further, protections are required to ensure that minority groups’¹ concerns are also included in the definitions of public interest.

On the other hand Subclause 14(1)(b) allows Data Fiduciaries (DF) to assume consent in certain cases which has legal ramifications. An example is the case of AOK Baden-Wuerttemberg² in Germany that used personal data from its customers for a raffle. Here, the company assumed that consent of the 500 participants was received. However, as per legal consent requirements, this was not the case. The company was subsequently fined 1.5 million dollars.

Clause 24 focuses on the actual process of data processing. It is important to understand that many businesses may have already started implementing their own data processing tools. But due to the arbitrary definitions of the process in the PDP Bill, their work may not be considered compliance ready. Therefore, it is necessary to provide clear articulation of what practices are deemed acceptable in each Subclause - 24(1)(a)(b)(c) - which look at the processes of de-identification and encryption, protection of integrity of personal data and steps necessary to prevent misuse of data, respectively. For example, StarMed Specialist Centre Ltd³ in Singapore reported a breach due to a Remote Desktop Protocol (RDP) Port left open, allowing for unauthorized access. Fiduciaries must know of all the possible risks and correct methods for implementation to avoid such situations. Without such clarity, many businesses may be investing in protocols that are not adequate, and can result in non-compliance, data breaches and penalization.

Definitions for governance (Clauses 26, 35, 86)

Clause 26 allows the Data Protection Authority (DPA) to have a final say in judging whether a business entity may be defined as a DF or a Significant Data Fiduciary (SDF). The DPA has the power to overwrite previous Subclauses which take into account aspects such as turnover and size of the organization. We know from penalization clauses that financial costs of non-compliance grow extensively when a DF is classified as an SDF. Without a clear code of conduct on how and why such judgements are allowed, many small business entities will not be able to financially recover from the compliance costs of PDP, especially if they are classified as SDF.

Similarly, Clause 35 allows the Central Government to have unbridled exemption powers over the governance of data that needs to be revisited. This is further accentuated by the Subclause 86(3) which allows the government to override the DPA’s authority.

Practitioners from the industry have highlighted that the DPA must focus on capacity building and upskilling for compliance and privacy roles and responsibilities. The DPA should partner with organizations that undertake such initiatives. As one of the participants at the Data Privacy Conference⁴ said:

“Technological implementations are overrated. Investment has to be done in people and setting up processes. To address something at the technical layer is easy if you have to enable say, encryption access management. The larger problem is people. Here, you need a lot of investment in the form of skill training and making them aware of what is required - the legalese and then implementation approaches and alternatives.”

Broad definition irrespective of varied stakeholders (Clauses 27, 50, 53)

Except for Clauses articulating financial penalizations, other aspects of governance remain the same despite having completely different effects on the ground. Aspects of governance remain vague and open to interpretation. Without clarity, many stakeholders will be confused, which may lead to further non-compliance. Instead, representatives from the community believe that there must be a fairer risk assessment protocol for different organizations and options for scaled down data processing practices for smaller organizations.

Since the DPA has the final authority over what can be defined as fair processing of personal data, this ambiguity does not help businesses who do not have adequate knowledge or support with regards to implementing data protection. Similarly, even the inquiry process may not be difficult for larger organizations to handle. But for smaller entities, this can lead to financial collapse. Therefore, it is important to take into account the nature of the organization and further details regarding their functioning when trying to govern businesses. Clause 27 provides a vivid example of how this can be confusing. Many entities can be defined as SDFs because they use social media technologies. Here, updating technology practices may have to be halted, stalling opportunities for innovation.

Definitions of Data that intersect (Clauses 3, 15)

Sensitive personal data under Subclause 3(36) includes financial data, health data, official identifiers, biometric data, sexual orientation, etc. In Clause 15, the Central Government once again has the final authority along with the DPA to define what may be considered sensitive personal data, defined by risks based on significant harm. It is important to address and pin down what significant harm means and the criteria for the same.
Under these Clauses, we see that there are concerns about the broad scope of personal data, and the DPA’s arbitrary use of power in defining what constitutes sensitive personal data.

In this document, we posit that it is important to take into account public interest concerns regarding the protection of minority and marginalised groups. This means that while formulating such a definition of public interest, representation from multiple stakeholders including, caste and tribe representation, religious minority representation, and representation from marginalised/alienated groups such as the LGBTQ community and disability groups, must be ensured. ↩︎
To read further on this case, refer to: https://edpb.europa.eu/news/national-news/2020/baden-wuerttemberg-state-commissioner-imposes-fine-aok-baden-wuerttemberg_en ↩︎
Read the case in further detail here: https://www.pdpc.gov.sg/Undertakings/Undertaking-by-StarMed-Specialist-Centre-Pte-Ltd ↩︎
Talks at the Data Privacy Conference are published at https://hasgeek.com/rootconf/data-privacy-conference/videos ↩︎

All submissions

Comments

Make a submission

Accepting submissions till 13 Sep 2021, 09:15 AM

Hosted by

Privacy Mode

Supported by

Omidyar Network India

AWS