Digital Personal Data Protection Act 2023 - Legal Analysis, Limitations And Comparison To The UK And EU GDPR
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
DIGITAL PERSONAL DATA PROTECTION ACT 2023:
LEGAL ANALYSIS, LIMITATIONS AND COMPARISON TO THE UK AND EU GDPR Sanskriti Sharma, Mugdha Damle, BBA LLB (Hons.), University of Mumbai Law Academy
ABSTRACT
This article is a general overview of the Digital Personal Data Protection Act,
2023 (DPDPA or The Act) and its various regulations. This Act applies to
all the data that is collected in digital form or is subsequently digitalized. Analysis of the Act shows that it also regulates the consent provided by the Data Principal to be valid consent only in specific actions of specific nature. The Act also introduces certain new terms and responsibilities on the various stakeholders that deal with the data and its processing. It further provides for procedures to be followed before the data can be collected by the Data Fiduciary. Provisions as to the responsibility in case of data breach and rights of Data Principal also have been covered under the Act. This article also highlights the general key differences and differences in compliance requirements between DPDPA and General Data Protection Regulations (GDPR).
Introduction
DPDPA completed its first year in August 2024; however, with the lack of rules to govern and explain the Act and its provisions in detail, the compliance is still underway. According to the reports of a Delhi based think-tank, around 85% of companies are considering the application of this Act [1]. Aruna Sharma, former secretary, Ministry of Electronics and Information Technology (MeitY) said the delay in notification of Rules has made the Act redundant. Union Minister Ashwini Vaishnaw has, however, on August 10, 2024, said that within the next 30 days the Rules shall be released and that they shall be digital by design. The Data Protection Board of India (DPBI or the board) shall also be constituted soon.
The DPDPA is an umbrella Act and has come into force in the backdrop of various consistentinconsistent data and privacy laws in India that were making the adjudication and redressal of data-related cases difficult. The Act has national as well as extraterritorial application for any goods and services that are made available to a data Principal in India (which is equivalent to data subjects in the EU and UK legislated GDPR). The DPDPA applies to all the data that is collected in digital form or is subsequently digitalized.
However, the Act doesn’t apply to personal data processed by an individual for any personal or domestic purpose, or personal data that is made or caused to be made publicly available by the data Principal to whom such personal data relates and a person who is under an obligation under any law for the time being in force in India to make such personal data publicly available. The purpose of The Act is to attribute sole responsibility to the main custodians of the data, referred to as the “Data Fiduciary” (similar to controllers under the GDPR), who shall be responsible for determining the purpose of the data and processing of the data.
It is defined u/s (2) as any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data; The Act imposes sole liability for data breach on the Fiduciary, irrespective of the data being processed by a third party or a Data Processor on behalf of the Fiduciary. The entity that shall be processing the data on behalf of the Fiduciary is called “Data Processor” u/s (2) (k) “Data Processor” means any person who processes personal data on behalf of a data fiduciary. Various companies in India shall now try to conform themselves to the definition of a data processor to avail the ‘no- responsibility’ advantage that a Data Fiduciary does not possess in the present scenario[2].
However, that makes it more crucial to understand the meaning and the distinction between the two new terms introduced by the Act as to who shall bear the responsibility in case of a data breach. To understand this, the focus should be directed on the conjunction ‘and’ in the definition of a Data Fiduciary, which plays a vital role in understanding the role and difference between a Data Fiduciary and a data processor. In simple terms, it is the Data Fiduciary one who is determining the purpose and processing of the data who shall be made liable in case of a data breach and not Principal one who is simply performing a task on behalf of the other. These roles can be best explained by an example: A goes to buy a laptop from B and gives his personal email and phone number to B to complete the purchase.
B then gives these personal details to C to send offers and discounts to A’s personal contact. In this scenario, though it is C who is directly contacting A to send details, it is B who has determined the purpose of the data, which in this scenario is to use it for sending offers, and has also determined the processing of the data for their means to be done by C. This makes B the Data Fiduciary and C the Data Processor.
It is also important to note that in this scenario, even if C were to directly collect the data from A, it would be a data processor, as its role would still be limited to processing the data on behalf of B, the Data Fiduciary. Moving forward, the Act has further underscored the responsibility of the data Fiduciaries to remove the data of the “Data Principal” in light of a request by the Principal to remove the same. However, the Act has emphasized the importance of a valid contract between the data Fiduciary and data processor for the same.
In such situations, the Fiduciary must do as stated u/s 6 (6), which is: If a Data Principal withdraws her consent to the processing of personal data under sub-section (5), the Data Fiduciary shall, within a reasonable time, cease and cause its Data Processors to cease processing the personal data of such Data Principal unless such processing without her consent is required or authorized under the provisions of this Act or the rules made thereunder or any other law for the time being in force in India. Legal analysis of the relation between the Data Fiduciary and Data Processor in India in the backdrop of the data shared and liability incurred: I.
Legal requirements to be fulfilled for processing the data The Act has restricted the scope of the data, which is to be processed by either the Data Fiduciary or the Processor, to only that information that has been consented to by the Principal to be processed. It also limits the consent by the Principal for the data to only those acts that are necessary and have a specified purpose. Sec. 5 of the Act also states that any and all data that is going to be collected by the Fiduciary shall be preceded with a notice to the Principal informing the Principal of the reason for collection of the said information, the method by which the Principal can exercise their rights of withdrawal of the said data, and the manner in which a complaint can be made by the Principal. The notice has to be in English or any language so specified in the 8th Schedule of the Constitution.
It is also required for the Fiduciaries in cases where the data has been taken before the commencement of this Act (11th August, 2023) to issue the notice to the Principals in a reasonable time, informing them the purpose of collection/processing of data, rights of the Principal, and the manner of compliance of the terms of consent. However, till the time the data Principal withdraws their consent for data to be processed, the said data can be processed by the fiduciary/data processor. The task of withdrawing consent should be as easy as the task of giving it. Furthermore, the consequences of withdrawal of the data shall be borne by the Principal themselves.
After the withdrawal of consent by the Principal, the data Fiduciary has to erase the personal data of the Principal and instruct the data processor for the same or as soon as the specified purpose for which the data was collected is served, unless retention of data is necessary for compliance of any law. II. Appointment of Consent Manager and Data Protection Officer Sec. 2(g) defines the role of a ‘Consent Manager’ as a person registered with the Board who acts as a single point of contact to enable a Data Principal to give, manage, review, and withdraw her consent through an accessible, transparent, and interoperable platform. Withdrawal of data from the Fiduciary shall be through the consent manager. He shall be accountable to the data Principal and shall be registered with the DPBI in the manner so prescribed in the Act.
A Data Protection Officer too, has to be appointed by the fiduciary, who shall meet the requirement so specified u/s 10 of the Act. He shall be the point of contact for the grievance redressal mechanism and shall evaluate the compliance of the Significant Data Fiduciary(i. e. , the class of data Fiduciaries that are notified u/s 10 of the Act by the central government) in accordance with the provisions of the Act. The details of the Data Protection Officer shall be published by the fiduciary. III. Responsibility in case of data breach The Act has put sole responsibility of data and any breach or misuse thereof upon the data fiduciary, irrespective of the fact that the data was processed by the data processor. Sec. 8 of the Act states the responsibilities of the data Fiduciary with respect to the data shared with the processor.
Any and all processing that is done by the Fiduciary or a data processor on its behalf shall be the direct and sole responsibility of the fiduciary, irrespective of any contract to the contrary. The data Fiduciary has to take all precautions against data breaches, even on behalf of the data processor. In a case of breach of data, the Fiduciary has to intimate the board as well as each data Principal regarding the same in a manner so prescribed. However, the Act does not provide prescribed specific deadlines for reporting the same. IV. Rights of Data Principal Sec. 11 of the Act specifies the various rights of the data Principal, which includes the right to obtain the names of all the Fiduciaries and data processors with whom the data of the Principal has been shared.
Data Principals shall enjoy several rights similar to those granted to data subjects under the GDPR (such as the right of access, rectification, or erasure); they will also be granted some new rights exclusive to the DPDPA, such as the right to an easily accessible and efficient means of grievance redressal (for example, through a grievance redressal officer) and the option to choose a person to represent the data Principal in exercising their rights in the event that the data Principal passes away or becomes incapable.
Comparative analysis
of DPDPA in comparison to the GDPR According to the DPDPA, data Fiduciaries can only legitimately treat personal data with the Data Principals' consent or for a few specific "legitimate uses. " These permissible uses include processing personal information that the data Principal voluntarily shares for a defined purpose (as long as the data Principal does not object); processing information in order to abide by legal requirements or court orders; processing information for hiring purposes; and processing information in response to disasters, epidemics, or medical emergencies. Similar to the GDPR, the DPDPA's consent standard states that consent must be "free, specific, informed, unconditional, and unambiguous with a clear affirmative action.
" However, in contrast to the GDPR, the DPDPA does not allow processing data based on the legal justifications of legitimate interests or contractual necessity [3]. Some additional key points of differences and compliance requirements from both Acts are as follows: • The DPDPA does not contain risk thresholds for the reporting of data breaches, which means that every breach of data shall be reportable to the impacted individuals regardless of the magnitude of the risk or harm, unlike the GDPR. These new breach reporting obligations apply in parallel to the existing requirements on organizations operating in India to report data breaches and certain other cyber incidents to CERT-In (Computer Emergency Response Team—India) if a computer in India is impacted or a computer system from India has caused the data breach. • There is no specific “right to nominate” under the GDPR.
The GDPR applies only to living individuals; there is no ability for data subjects to authorize another person to make data subject requests on their behalf after the data subject’s death. • Under the DPDPA, data Fiduciaries are mandated to appoint and have a grievance redressal mechanism and redress grievances as per the guidelines of the act. They shall also be mandated to adhere to the prescribed time periods of addressing and adjudicating the matter. • The right to approach the DPBI is subject to the data Principal first approaching the data fiduciary’s grievance redressal mechanism. It is therefore necessary to ensure that a grievance redressal mechanism is implemented to resolve grievances internally by the data Fiduciary and a situation wherein the data Principal directly invokes the right to approach the DPBI is avoided.
• Data subjects under the GDPR have the right not to be subject to a decision based solely on automated processing (i. e. , processing carried out without human intervention that has a legal or similarly significant effect on the data subject). However, to the contrary, the DPDPA does not provide the right to not be subject to automated decisionmaking in the act. • Under GDPR Data subjects have the right to request that their personal data be transmitted to another controller (subject to certain exceptions). The DPDPA does not provide the right to data portability, which means that a data Principal in India does not have the right to transfer his data from one Fiduciary to another. • Data subjects have the right to object to, or request that the controller restrict, processing in certain circumstances.
The DPDPA does not provide specific instances in which data Principals may object to, or restrict, the processing of personal data. Data Principals in India have the right to directly withdraw their consent, which then requires data Fiduciaries and processors to cease processing of such personal data entirely. • Under the GDPR, it is the right of a data subject to be informed regarding the use of the data that is being collected from them, which includes the ‘how’ and ‘why’ the data is collected. Although the requirements are similar in the DPDPA, it is upon the request of the data Principal that a data Fiduciary shall provide the summary of the data collected and all the Fiduciaries/ processors the data is transferred to.
The DPDPA further also provides that when the data is collected with consent, then relevant information regarding the need and use of the data be provided at the time of such collection. • The DPDPA strictly prohibits the transfer of data to restricted nations and does not provide any mechanisms to do the same; however, in GDPR there are steps provided for the transfer to be made to non-whitelisted jurisdictions.
However, looking into the various similarities between the two, the data subjects and the data Principals have the right to withdraw their consent. It is also made essential in both acts that such removal of consent process be made easy and understood by the Principal/subject. The easement of removal has been made essential. Further similarities in the two acts include the rights of rectification of data and access to the data that they have provided to the controller/fiduciary. Furthermore, both acts provide for proper data- agreements to be executed between the data fiduciary/controller and data processors. DPDPA- Limitations and its way forward in 2024 Although GDPR and DPDPA are on similar lines, it has been difficult for Indian firms and companies to comply with the Act, which is mainly due to the lack of any notification and Rules on the same.
Various industry giants are struggling to comply with the Act and to appoint the consent manager as specified therein. According to the reports, the National Commission for Protection of Child Rights is set to approach the MeitY to recommend mandating KYC-based systems for verifying children's age under the Act. Focus is also on AI tech companies and startups as they deal with humongous amounts of data for training and processing. They will be under the direct purview of the Act and thus will need to abide by the rules. It is necessary that the operation of the Act happens in a more phased manner so that all parties in the transaction are able to understand their roles, duties, functions, and liabilities.
Furthermore, it is essential that robust redressal mechanisms are put in place not only at the national level but even at each company level so that a data Principal is able to seek redressal for their complaints in a timely manner. Thus, there is a need for the constitution of DPBI and regulation of the rules for the Act that can assist in the operation of the Act and its vision to come to reality. Recommendations for Companies for Compliance with the DPDPA: It is recommended that firstly the organisation should determine its position as either the Data Fiduciary or processor. Also make a data mapping chart as to how the data is collected and how it is stored and processed, starting from the first step to the last. This will help the organisation to identify where and how safeguards regarding data protection and processing can be implemented.
A notice regarding the data that is taken from the data Principals be made to each one of the data Principals, notifying and informing them regarding the purpose behind the collection of the said data, the manner in which the data is processed, and the manner in which the consent for the said data can be withdrawn by the data Principals. The notice shall also include the grievance redressal mechanisms that shall be available to the data Principals. It is recommended that the organisation must prepare itself for data requests from the data Principals and have a robust system of grievance redressal and removal. Furthermore, if the purpose of the data that has been collected is served, then by way of notice, the said data be erased and the same be informed to the data processors and the data Principals that such action has been taken.
It is best suggested that all companies wait for the Rules to be released and then accordingly legally comply with the same; meanwhile it is also suggested that companies gather resources necessary for implementing the rules once released. Conclusion In conclusion, the Digital Personal Data Protection Act (DPDPA) represents significant change regarding data protection legislation in India, which reflects an increasing global focus on individual data privacy. As the DPDPA completes its first anniversary, there have been challenges faced by companies vying for full compliance due to a lack of detailed regulations and a slow rate of rule notifications. Yet within these challenges are the Act’s foci— accountability of data Fiduciaries; consent management; and breach reporting—which are intended at improving data protection standards while aligning them with international practices.
Moreover, it also outlines important roles of a data fiduciary, such as developing consent management systems, ensuring accuracy of all personal information in their possession, and responding promptly to incidents involving unauthorized access, use, or disclosure of personal information, among others. The data Fiduciaries’ separate identities from those of data processors is most crucial, highlighting their overall responsibility over any form or type of personal information in their custody. Other organizations need to be careful when applying these roles, as they must comprehend their obligations and implications that can arise after the occurrence of any incident involving personal information.
The DPDPA has some similarities to the GDPR, such as requirements on consent and rights to access and rectify data, but these differences include unique features that regulate stricter rules regarding transfer of data and reporting of breaches. Since the regulatory framework is changing, businesses should prepare for impending regulations and for the establishment of a Data Protection Board of India (DPBI). By first clarifying their roles in accordance with the Act, mapping their data processes, and establishing robust data protection measures as well as redressal mechanisms, organizations will ensure they comply effectively. The DPDPA will become fully operational; hence, steps have to be proactive, like appointing consent managers and being transparent with regards to how data should be handled.
In conclusion, although compliance might look difficult, things are going to change for the better when it comes to people’s personal information protection because everything is digitalized today; hence, the way forward is to block all holes through which thieves enter our homes using advanced systems known as DPDPA or any other system of their choice.
[1] Ashutosh Mishra, One year of DPDP Act: Firms in a fix over delayed implementation of rules, Business Standard- Economy, August 11, https://www.businessstandard.com/economy/news/one-year-of-dpdp-act-delayed-ruleshamper-india-s-dataprotection-law-124081100299_1.html [2] AZB Partners & Solicitors, Digital Personal Data Protection Act, 2023 – Key Highlights, September 11,2023 https://www.azbpartners.com/bank/digital-personal-data-protectionact2023-key-highlights/ [3] Latham & Watkim LLP, India’s Digital Personal Data Protection Act 2023 vs. the GDPR:
A Comparison pdf December 2023