Decoding The Digital Personal Data Protection Act - A Critical Analysis
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
DECODING THE DIGITAL PERSONAL DATA PROTECTION
ACT: A CRITICAL
ANALYSIS
Harshita, Law Centre - ll, Faculty of Law, University of Delhi
ABSTRACT
In an era, where every online activity of ours leaves a digital footprint- from ordering food to endless scrolling through reels even that latest online payment- safeguarding personal information in this vast cyber world is of utmost importance. But amidst this digital connectivity, how does one ensure security of his/her data from exploitation, that’s when Digital Personal Data Protection Act emerges as an answer to this crucial question. The act, passed in 2023, has at-least given a start to the data protection in this country and this article critically analyses the provisions of this act to answer whether the act balances the interests of individuals and legitimate concerns of the state. By exploring the nuances of this regulation, the analysis can contribute to a deeper understanding and clarity of the act for different stakeholders through a simpler language used in the article.
While, the article acknowledges the legislative objectives behind this act, but whether those objectives have been fulfilled is an answer that this article seeks.
I.
INTRODUCTION
According to the "Internet in India Report, 2022", jointly released by The Internet and Mobile Association of India (IAMAI) and KANTAR in May 2023, 52% of India's population, totalling
759 million people, are active internet users i.e. they visit the web at least once a month1. The
report also forecasts that by 2025, the number of Internet users will grow to around 900 million people. In light of this escalating digital footprint, the need for protection of digital data of individuals became paramount and thus the Indian Parliament passed the Digital Personal Data Protection Bill, which received the President’s assent on 11th August, 2023 and became an Act. The primary purpose of The Digital Personal Data Protection Act (hereinafter referred to as “The Act”) as mentioned in the statement of object and reasons of the act is to create a balance in protecting the personal data of individuals along with processing of such data for lawful purposes. It imposes relevant obligations on data fiduciaries for the protection of individual data from misuse. In simpler terms, the act safeguards the personal data of citizens along with responsible management of data.
The Act holds immense importance as it is the first legislation that officially recognizes the privacy rights of individuals protecting the individuals from the breach or unlawful use of their data. Although, as much importance as it holds in the digital sphere, it is imperative to mention here that the act is yet to come into effect in the country since the rules for the act have not been notified in the official gazette (as of April 2024).
II. HISTORICAL
BACKGROUND
The Constitution of India does not explicitly mention Privacy as a fundamental right in Part III but this right has travelled a prolonged journey of judicial pronouncements over the years. While everyone might associate the judgment of Puttuswamy as a stepping stone for the act but before the leading judgment a committee was set up by the Planning Commission in 2012 under the chairmanship of Justice AP Shah to review the then international practices on privacy and thus fill the gap of Privacy law in India accordingly. The committee in its report outlined nine principles that were central to and defined the Right to Privacy.2 These recommended
1 Kantar & IAMAI, Internet in India, (2022), p-16,
https://www. iamai. in/sites/default/files/research/Internet%20in%20India%202022_Print%20version. pdf. 2 Justice AP Shah, Report of the Group of Experts on Privacy, Cis India, (March 24, 2024, 8:40 PM), https://cisindia. org/internet-governance/blog/report-of-group-of-experts-on-privacy. pdf. principles were to form the basis of India’s proposed privacy law and can be seen in the current Data Protection Act. However, the above-mentioned principles remained overlooked for undisclosed reasons but later in 2017 came the pivotal judgment of Justice K Puttuswamy v. Union of India (2017)3 where a nine-judge bench assembled to interpret the validity of the Right to Privacy as a fundamental right. The Court in this case unanimously held the Right to Privacy as a fundamental right and partially overruled 2 important judgments i. e. MP Sharma v. Satish Chandra (1954)4 and Kharak Singh v.
State of Uttar Pradesh (1962)5 and held that Privacy is a constitutionally protected right which primarily emerges from the guarantee of life and personal liberty in Article 21 of the constitution, thereby making right to privacy as a fundamental right under Article 21 of the constitution. Furthermore, the Court suggested the Union government establish a robust framework for data protection and stated “The creation of such regime requires a careful and sensitive balance between individual interests and legitimate concerns of the state”. 6 To honour the judgment of the Court, the Union government constituted a committee under the chairmanship of Justice B N Srikrishna, which submitted a draft bill on Personal Data Protection in 2018, but the same went through a lot of changes before it was accepted as Digital Privacy Data Protection Act, 2023. III.
IMPORTANT TERMINOLOGIES The Act being the first law on privacy in the country has tried to be as comprehensive as possible to enhance the clarity and understanding of the act and thus defines important terminologies under Section 2 (hereinafter referred to as “Sec”) Some of the relevant terminologies have been explained below: A. The Act defines personal data under Sec 2(t) as information of an individual through which he/she is identifiable.
3 2017 AIR 4161.
4 1954 AIR 300.
51963 AIR 1295.
6 2017 AIR 4161.
B. Personal data breach according to the act, encompasses any illegal processing of personal data that includes any unintentional disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data that jeopardizes its availability, confidentiality, or integrity. 7 C. Any set of operations performed on digital personal data is referred to as processing of data which includes collecting, arranging, organizing, structuring, adapting, retrieving, combining, disclosing etc. 8 D. Data Principal has been defined as an individual to whom the personal information pertains. 9 E. Furthermore, the Act defines Data Fiduciary under Sec 2(i) as a person or a group of persons who determines the purpose and means of processing the data of data principal. F. Lastly, the act defines a Data Processor as any person who processes the data.
10 For instance: If a person visits a website and fills in his/her information for delivery of a product such as name, address, and contact, such person is data principal here, the data shared with the website is the personal data of data principal, the company’s website collecting the information is data fiduciary and the company i. e. data fiduciary might hire any person or a company to process the collected data, such hired person or company will be data processor. IV. SALIENT FEATURES OF THE ACT It is essential to examine an act’s basic basic components to analyze it critically. Here we examine, a few crucial elements essential to this comprehension. A.
Use of she/her pronouns: The act's Section 2(y) specifies that "'she' in relation to an individual includes the reference to such individual irrespective of gender," thus the act breaks the traditional norms of using he/him in legislative acts and also challenges the 7 Digital Personal Data Protection Act (DPDP Act), § 2(u), No. 22, Acts of Parliament, 2023, (India).
8 Id. at § 2(x)
9 DPDP Act, supra note 7 , at § 2(j)
10 DPDP Act, supra note 7, at § 2(k)
existing linguistic conventions while introducing gender neutrality and inclusivity in the act. This sets an impressive precedent for future legislation. 11 B. Applicability of the Act: The Act only applies to digital personal data or non-digital data which is digitized subsequently within the territory of India. However, the act also applies to data processed outside India if such processing is in connection with any activity relating to the offering of goods or services to data principals within the territory of India. For instance, Amazon is an American company that collects the data of Indian citizens, the act’s obligations will apply to Amazon as well as they are offering goods and services to people in India. C.
Non Applicability: The Act does not apply to data processed for domestic or personal use or personal data made publicly available by data principal herself or any other person under a legal obligation. For example, individuals sharing their details through vlogging or blogging will not be covered under the act as such data has been shared by the individuals themselves. D. Consent and Notice: The Act makes it mandatory to obtain consent to process the personal data of a data principal except for certain legitimate uses and such consent should be free, specific, informed, unconditional and unambiguous with clear affirmative action by the data principal for the specified purpose of the processing of data.
A notice has to be provided to the data principal, along with or preceding every request for consent, informing the data principal about the personal data and the proposed purpose of processing so that the individual knows for what purpose his/her data is going to be used. A notice should be simple, clear and should be available in any language mentioned in the Eight Schedule of the Constitution. 12 E. Retrospective effect of the Act: In the case where consent for processing of personal data was given before the commencement of the act, the data fiduciary as soon as it is practical shall provide a notice providing details of the data collected and the purpose for the same.
11 Saurabh Binal & Ayushman Singh, Empowering Gender Neutrality
DPDP Act’s Use of Feminine Pronouns to Refer to All Genders, Fox Mandal, (March 27, 2024, 9:56 AM), https://www.foxmandal.in/empoweringgender-neutrality-dpdp-acts-use-of-feminine-pronouns-to-refer-to-allgenders/#:~:text=In%20a%20remarkable%20stride%20towards,address%20individuals%20of%20all%20genders. 12 AZB PARTNERS, https://www.azbpartners.com/bank/digital-personal-data-protection-act-2023-keyhighlights/ (last visited at Mar27, 10:45 PM).
F. Limit on processing of personal data: The data processing should be done only for the specified purpose for which the consent has been sought. The Act further makes it clear that the processing of data shall be limited to the personal data necessary for the specified purpose. For example: While using a food delivery app, the app may require consent for your address for food delivery and also a contact list which is not needed for delivery of food, thus the consent for processing of personal data shall be limited to address only. G. Withdrawal of Consent: In cases where consent is the basis of processing personal data, the act provides the data principal a right to withdraw her consent at any time, the process of which should be equally simple to that of granting the consent.
The consequences of such a withdrawal shall be borne by the data principal and shall not affect the processing of personal data before the withdrawal is made. After the withdrawal of consent, the data fiduciary shall within a reasonable time cease and cause its data processor to cease the processing of such data of the data principal by its data processor. 13 The definition of reasonable time is however unclear. H.
Legitimate Uses: As discussed above, apart from the situations where consent is mandatorily required, there are certain situations where personal data can be processed without the express consent of data principal and such situations are; voluntary disclosure by the data principal; use of data by state or any of its instrumentalities for providing benefit or subsidy or service to the data principal; for performance of function under law; medical emergency involving a threat to life or immediate threat to health of data principal; for compliance with any judgment, decree or order issued under the law; any threat to public health; to ensure safety in case of disaster. I.
Obligations of Data Fiduciary: The Act imposes some obligations on data fiduciary which include engaging with a data processor for processing of personal data of data principal; providing clear and concise notice to the data principal; obtaining verifiable consent before processing children’s data; implementing technical and organizational to ensure effective adherence to the act; causing the erasure of data either on the withdrawal of consent by the data principal or after the purpose for which the data was collected is
13 DPDP Act, supra note 7 at § 6(6)
being met; reporting the breach of personal data (if any) to Data Protection board and data principals; establishing an effective mechanism for grievance redressal. J.
Children’s data: Processing of a child’s data can only be done after verifiable consent from the lawful guardians or parents has been taken. It is important to note here that the definition of child has been given in the act as an individual who has not completed the age of 18 years. Any processing of data that might cause a detrimental effect on the wellbeing of a child or behavioral monitoring or tracking or targeted advertising directed at children has been strictly prohibited by the act. K.
Significant Data Fiduciary: The concept of Significant Data Fiduciary has been introduced by the act and a data fiduciary will be designated as a significant data fiduciary by the Indian Government based on an assessment of such relevant factors including volume and sensitivity of personal data processed, public order, risk to the rights of data principals and other factors given in Section of the act. 14 The data fiduciary designated as a significant data fiduciary has to honor a few obligations including appointing Data Protection Officer based in India; appointing an independent data auditor to evaluate compliance and conducting Data Protection Impact Assessment (DPIA) & periodic audits. L.
Exemptions: The Act also provides certain exemptions to data fiduciaries from its obligations except for being responsible for its data processor and taking responsible safeguards for protecting the data, these exemptions include the processing of data for enforcing any legal right; the processing of data for performance of any judicial or quasijudicial function; the processing of data for any prevention or investigation of a crime; processing of data within India of non-resident individuals under a foreign contract; the processing of data for a merger or amalgamation as approved by the courts or an authority; the processing of data to locate defaulters of any payment and to gain insight on their financial assets and liabilities.
Furthermore, the provisions of this act shall not apply to the processing of personal data by the state or any of its instrumentalities which may be notified by the central government 14 Max Landaw, 6 Things You Need to Know About India’s Digital Personal Data Protection Bill of 2023, Lexology, (Mar 29, 2024, 10:07 AM), https://www. lexology. com/library/detail. aspx? g=a7ddfd7c-caba-4a90- 8460-1a1dd32e4fce. for protecting the integrity of the nation; security of a state; maintaining friendly relations with other states or for research or statistical purpose that won’t be affecting the decisions of data principal. Additionally, considering the nature and volume of data being processed the central government may notify certain data fiduciaries or significant data fiduciaries including startups exempting the applicability of certain provisions of the act on them. M.
Rights of Data Principal: The Act confers certain rights to the data principal concerning the processing of personal data which are crucial in safeguarding individual privacy, these rights have been discussed below in detail:
1 Right to access information
A summary of the personal data which is being processed by the data fiduciary can be requested by data principals. Furthermore, the data principal has the option to inquire about other data fiduciaries that have access to her data. However, the right to inquire about other data fiduciaries shall not be available if the data by the other data fiduciaries was shared for the prevention or prosecution of any cyber incidents. 15
2 Right to correction and erasure of personal data
The Act provides individuals the right to correct the inaccurate data or complete or update the incomplete data. The right further stretches to the erasure of data by data principal that is no longer needed and such erasure has to be done on the part of data fiduciary unless retention of such data is necessary by the law.
3 Right of grievance redressal
The Act ensures that individuals have the right to register a grievance with the data fiduciary if there has been a breach of any obligation on the part of data fiduciary, this right of grievance redressal has to be exhausted by the individual before approaching the data protection board.
4 Right to nominate
Individuals can nominate any other person to exercise the above rights in the event of death or incapacity of the individual. N. Duties of data principal: No wonder, rights and duties are two sides of the same coin as data principals have to comply with some duties as given in the act which include compliance with the legal requirements; providing authentic information and not 15 Sunila Awasthi & Nipun Sawhney, The Data Principal’s Handbook: Navigating the DPDP Act, AZB Partners, (April 2, 2024, 9:20 PM), https://www. azbpartners. com/bank/the-data-principals-handbook-navigating-thedpdp-act/. suppressing any information while providing personal data; duty to not register any false or frivolous complaint. O. Processing of personal data outside India: The transfer of personal data to any country or territory outside India can be restricted by a notification of the central government. P.
Data Protection Board: to effectively regulate the act, provision is made for the establishment of a Data Protection Board (hereinafter referred to as “the board”). This independent body will be constituted by a notification from the Central Government and shall be headed by a chairperson and other members to be appointed by the Central Government itself. The body has been empowered with various powers and functions including investigating data breaches on complaints by data principals or references made by state or central government, issuing remedial measures, imposing penalties, giving the parties an opportunity to be heard, and ordering directives for parties to be complied with.
Furthermore, for performing functions that the board has been entrusted with, the board has been enshrined with the powers of a civil court and appeals against the board shall lie to the Telecom Disputes Settlement and Appellate Tribunal. Q. Consent Manager: The Act introduces the concept of Consent Manager, defined in Sec 2(g) as a person registered with the board who acts as a single point of contact to enable a data principal to give, manage, review, and withdraw her consent through an accessible platform. The registration of the consent manager is subject to such conditions that are yet to be specified in the rules of the act. In simple language, consent managers will act as trusted intermediaries between data principals and data fiduciaries V.
EYEING THE ACT FROM A CRITICAL LENS The Act is no short of a victory for the country as it is the first privacy law enacted in India and while the intentions of the lawmakers are noble, however, few ambiguities might need to be addressed and after looking at the act from a critical lens few of these ambiguities have been discussed below. A. Absence of regulations: The Act has been divided into 9 chapters and 44 sections in total and came into effect on 11th August 2023 after the assent from the President of India, however, the rules of the act have yet not been published (as of April 2024) which makes it difficult for the effective enactment of the act. Moreover, the 21-page act contains “as may be prescribed” 28 times, thus undermining the public’s ability to understand the scope of the act without the rules. B.
Exclusion of Non-Digital Data: The General Data Protection Regulation(GDPR), the European Union’s data protection law, covers both digital and non-digital data, however, the Indian Privacy law is notably silent on the processing of non-digital personal data focusing solely only on digital data, thereby raising questions on the comprehensiveness of the legislation. 16 C. Lack of clarity: Sec 6(6) of the act says that after the withdrawal of consent by data principal for processing of data, the data fiduciary has to cease the processing of an individual’s data within a reasonable time, however, how much time would be deemed as reasonable time has not been specified leaving a room for interpretation of such an important clause.
Furthermore, under Sec 8(5), one of the obligations of a data fiduciary is to take reasonable security safeguards to prevent the data breach of individuals, nonetheless, the act does not set forth what will constitute those reasonable security safeguards, thus again leaving this crucial aspect unanswered. 17 D. Data Processor’s accountability: The Act casts significant obligations on data fiduciaries but remains completely silent on the accountability of data processors in case of a breach of personal data, thus highlighting a potential gap with data fiduciary bearing the sole responsibility in data breach cases and undermining the principle of shared responsibility. 18 E.
Independence of Data Protection Board: The Act clearly states that civil court or any other court shall not have the jurisdiction to entertain the cases that fall under the purview of the Data Protection Board but what grabs everyone’s attention is that the the chairperson and the other members of the board shall be appointed by the central government thus making it difficult for one to understand how this data protection board will be an 16 Johm Brittas & Aneesh Babu, What Lies Beneath the PR Blitz on the New Data Protection Act? , The Wire, (April 11, 2024, 8:45 PM), https://thewire. in/government/what-lies-beneath-the-pr-blitz-on-the-new-dataprotectionact#:~:text=The%20DPDP%20Act%20introduces%20ambiguity,of%20non%2Ddigital%20personal%20data.
17 Nivedita Krishna, The Digital Personal Data Protection Act, 2023: Some relief but many questions, Times of India, (April 04, 2024, 6:20 PM), https://timesofindia. indiatimes. com/blogs/niveditas-musings-on-techpolicy/the-digital-personal-data-protection-act-2023-some-relief-but-many-questions/.
18 Brittas, Supra note 12
independent body free from the clutches of the union government. Furthermore, given that the board will be established by the central government, how would the board ensure impartiality, particularly in situations where complaints are made against the state entities? F. Central Government’s unending powers: The Act has drawn criticism for granting significant powers to the Central Government across various sections which have been explained below:
1. The Act under Sec 17(2)(a) exempts the state instrumentalities from the provisions of
the act in case processing of data is deemed essential for upholding India’s sovereignty, state security, friendly relations with foreign states, maintenance of public order, or prevention of incitement to any cognizable offence related to these concerns. However, this broad discretion given to the state instrumentalities raises an important question of transparency and potential infringement of individual’s privacy rights that might happen if such a power is not used judiciously. Additionally, 17(3) authorizes the central government to notify few data fiduciaries or classes of data fiduciaries including startups exempting them from certain provisions of the act, undoubtedly the provision can be beneficial for small entities or startups, however, this again raises a question of potential misuse of authority keeping the data on stake.
2. The Act further grants immunity to the central government, the board, its chairperson
or any member from any suit or legal proceedings against anything that is done in good faith under the provisions of the act, however on a positive note, this does protect them from unnecessary legal repercussions but on the other hand the broader scope of ‘good faith’ can be used as a shield in case of misconduct.
3. Lastly, the act grants the central government the authority to request from the board
or data fiduciary or intermediary to furnish any information for this act, while this authority may seem important in terms of effective implementation of the act but raises concern regarding arbitrary power given to the government to gather any information whatsoever. G. Voluntary Undertaking: Sec 32 introduces the concept of voluntary undertaking which grants the board to accept voluntary undertakings from entities found to be non-compliant with the Act’s provisions to stop further inquiry. The voluntary undertaking may include an undertaking to take such actions within such time as may be determined by the board. Undoubtedly, the provision may introduce cooperation in the proceedings but in essence, can turn out to be a loophole as it will be seen as a viable alternative for offenders to escape penalties.
This can lead to a situation where offenders can dodge heavy fines by giving a mere undertaking thereby undermining the act’s effectiveness. H. Amendment to Right to Information (RTI) Act: Last but not least, the act has brought a significant amendment in the Right to Information Act’s (RTI) Sec 8(1)(j) which provided exemption from disclosure of information under RTI only of that personal information which has no public activity or interest. 19 However, with the advent of India’s privacy law, the section has been amended to “information that relates to personal information”.
Before this amendment, the section exempted the disclosure of personal information that had no relationship to any public activity or interest but provided authority to the Central Public Information Officer (CPIO) or State Public Information Officer (SPIO) for disclosure of such information if it is satisfied that such information was for larger public interest however, the amended provision now does not grant an authority for disclosure of any personal information even if it is for larger public interest. This amendment broadens the scope of information that can be shielded under the purview of this section from now onwards thereby hindering the core objective of RTI which is to bring transparency and accountability in governance. VI.
CONCLUSION
Clive Humby rightly coined the phrase “Data is the new oil”, encapsulating its immense value in today's digital economy. Thus the enactment of the Digital Privacy Data Protection Act is undoubtedly a way forward in addressing the issue of data protection. However, certain concerns do exist with regard to balancing the rights of individuals and granting authority to 19 Kishalaya Pal & Kanika Verma, The DPDP Act: Need for an Objective Legislation instead of a Vague Notion of ‘Balancing Rights and Public Interest’, CLS, NLU Odisha, (April 6, 2024, 4:30 PM), https://clsnluo. com/2023/09/23/the-dpdp-act-need-for-an-objective-legislation-instead-of-a-vague-notion-ofbalancing-rights-and-public-interest/. the government.
In an era where digital advancement is essential for any country, and there are infinite threats to privacy every single day, it seems like the act lags in terms of providing effective protection. However, it is imperative to note here that the rules for the act have not yet been specified thus once the rules are published, it will be easier for people to have much-needed clarity to understand the law. Overall, one cannot deny that the act is a great start towards data protection and once the guidelines are issued, it will be easier to realise its full potential for ensuring data protection of individuals.