BUSINESS MANDATE
fountainhead of excellence
1 MAY 2022
21
MAY 2022
BUSINESS MANDATE
fountainhead of excellence
The world was shaken up in 2018 with the advent of GDPR. DPA 2021 is not on the distant horizon but has already entered into our day‐to‐day obligations as “Due Diligence” under Information Technology Act 2000 ﴾ITA 2000﴿.
R Ravichandran, IRS
where we addressed the financial sector information,
Chief Commissioner Income Tax
I
of
information. Personal information include our buying
n the Nineties, I was working Director
Shipping, shipping,
as
Deputy in
DG
Mumbai.
In
managing
containers like how to position them, where they can be stuffed and how to get them transmitted was a big challenge. So we used to collect a lot of information from thirty to forty thousand ports, all over the world on the container / cargo movement. All these data used to be very sensitive information which would benefit everyone, including the user, customs, custom house agents and shipping lines. The challenge was in managing the safety and security of the data. Honestly, in the Nineties, nobody thought about data protection or privacy. Data was always collected to promote business interests. In 2000, when I was working in SEBI, we had a committee on data protection along with RBI, 22
MAY 2022
which has two parts—personal and non-personal behaviour, preferences, etc., which we now share openly on social media and sometimes get trapped by them. The personal information has become a marketable commodity, and it is available for a price.
Mountain of information The government also collects information diligently for official purposes like taxation. Income tax department collects third-party information through the Central Information Bureau and the Statement of Financial Transaction mechanism. We are able to capture 95% of the financial transactions done by an individual, including banking, non-banking or chit fund transactions. Lending, borrowing, deposits, buying or selling properties and stocks or foreign exchange transactions—all are now captured. This was around 30,000 pieces of information in 1994. It grew to 30 crore pieces in 2015. Since then, there has been an
BUSINESS MANDATE
fountainhead of excellence
Everybody collects data in some
explosion in collection of information. Today, we collect
form. When a government
about 300 lakh crore pieces of information. With PAN and Aadhar seeding, we now have one common
collects data, they have a
identifier and can map a person's complete financial
system and process to deal with
profile. 26AS can give 50 types of information. Such
it, but when a private entity
information is necessary to collect taxes. But what kind
collects data, there is the
of data protection and privacy issues do I need to deal
question of how they deal with
with? After all, the data belongs to the stakeholders
data. We need to have a
who provide the data. At IT department, I am only a
regulation.
custodian of the data. Everybody collects data in some form. When a government collects data, they have a system and process to deal with it, but when a private entity collects data, there is the question of how they deal with data. We need to have a regulation. Data protection
professionals, focussing on Indian law. We also created a framework for the industry.
DPA’s Legacy
is a fundamental right and it is in a very nascent stage. Implementation is a big challenge.
India has been trying to get the Data Protection Act (DPA) for decades now. In fact, in 2006, a bill called Personal Data Protection Bill (PDPB) 2006 was presented in
A Bird’s Eye View of DPA 2021
the
parliament
along
with
the
Information
Technology Act Amendment Bill 2006. The Amendment Act 2006 became 2008 and it got passed. But everybody forgot about PDPB 2006. Every time the government
Na Vijayashankar ﴾Naavi﴿ Data Governance and Data Protection Consultant
F India
oundation of Data Protection Professionals (FDPPI)
organisation
is
in an of
professionals. In 2018, after GDPR came in, I wondered how companies will face the challenge if 4% penalty is levied for GDPR non-compliance. With this objective, we formed FDPPI in 2018 as a not-for-profit Section 8 company. Since then, we have been conducting many outreach programmes. We have conducted two certification programmes for our own data protection 24
MAY 2022
wants to come up with the legislation, there is always the problem of balancing the requirements of the industry on the one hand, privacy activists on the other hand and the government itself. The distinction between personal data and non-personal plus personal data came only after privacy became an important aspect. That is why even today the distance between cyber security and personal data security is high and the Joint Parliamentary Committee (JPC) ultimately decided that we will call this as Data Protection Act, instead of Personal Data Protection Act. They took an easy way out to merge the two. But from compliance point of view, it creates a lot more complications. The DPA 2021 was earlier called Personal Data Protection
BUSINESS MANDATE
fountainhead of excellence
with a focus on personal data. Now the title has been
After the data breach happens, ITA2000 will also
changed. In the applicability clause, it is said that this
wake up. Corporates are more afraid of being in jail for
Act shall apply to non-personal data also, including
two or three years rather than paying a heavy fine. The
anonymised personal data. This has confused people.
fine may be paid by the company. Such a thing
What then happens to the Information Technology Act?
happened in the 2004 baazee.com case. Its Director
The IT Act 2000 is anyway a data protection act in
Avinash Bajaj fought in the Supreme Court for 8 to 10
terms of both personal and non-personal data.
years to avoid criminal liability. The IT Act will continue
Contravention of IT Act can lead to both civil and
to be relevant even after DPA 2021.
criminal liabilities. People don't realize that India already has a data protection act since 2000.
fact, a challenge for compliance people. Where does
Difference between ITA and DPA
ITA compliance end and DPA 2021 begin? How do they
We need to draw boundaries between DPA 2021 and the IT Act. You cannot say that Section 88 of ITA2000 is not applicable for personal data. It will continue to have impact, particularly when it comes to criminal offences. DPA 2021 will mostly focus on compliance. Before a data breach happens, what should an organization do in terms of compliance? What is the penalty if they don't have suitable measures? That will be the focus of DPA 2021.
Finding out the difference between the two is, in
both combine? For this, we have prepared Data Protection Compliance Standard of India (DPCSI), which is inclusive of ITA 2000 compliance.
Compliance instead of complaints Objections will continue to be there for the Act. The complaint that the government is having more powers than what is necessary or companies are not being properly prevented from collecting personal data will remain and privacy activists will never be satisfied with
BUSINESS MANDATE
fountainhead of excellence
25 MAY 2022
for compliance readiness. DPA2021compliance is more
complicated than GDPR because GDPR applies only to
In some countries, when data
personal data coming here from EU region. We should
protection law was introduced,
use the available time to build a culture in the industry.
they gave one or two years’
Let us not be distracted by what they say in the media
time for implementation and
that this act will never come and if it comes startups
came out with staggered
will get affected or our ease of doing business index
implementation of fines. India also may do that.
will get affected. It is their business to write. We in the industry can participate in the discussions, if possible, and at the same time, quietly undertake compliance measures.
No room for complacency When companies start their journey towards any law. Whether it is GDPR or anything else, they will
compliance, professionals such as auditors have to help
continue to have their complaints.
these companies and they have to start their journey
In India, we are always fighting against the government. We talk of surveillance raj. But in the corporate sector, we should steer clear of this. Let us
much before the companies do. This act is inevitable. It will come, if not today, maybe in the next three months or whatever.
understand and accept that there will be no unanimity.
Let us not have the complacency that until the Act
The industry should not be distracted by such
comes, no damage will occur to the company. It may
complaints but instead look at compliance. Now,
be true in the case of IT Act where, unless you prove
ultimately, if the Government passes it through, then
the cause of action and say that XYZ has suffered
we will not be able to say that Section 35 is not good
damage, he can’t go to either the adjudicator or the
or 33-34 on data localization is not acceptable. Those
court. Whereas with DPA, it is not like that. Even if
arguments will become irrelevant. You have to
there is no data breach and nobody has suffered a
immediately look at what needs to be complied with.
damage, compliance is still required.
That is why FDPPI is bringing the focus on the compliance view of DPA 2021.
introduced, they gave one or two years’ time for
It’s a long journey
implementation
Compliance is a journey and not an overnight possibility for any company. For employees to understand the data privacy needs and assimilate that into the culture, it will take time. Then comes the question of having technology, tools and policies. For large organizations, even six months is not sufficient 26
MAY 2022
In some countries, when data protection law was and
came
out
with
staggered
implementation of fines. India also may do that.
Courts, cases and informed judgments There have been many court cases—one each in Madras, Odissa, Delhi and Bombay. In all these cases, courts have quoted that right to be forgotten is a right
BUSINESS MANDATE
fountainhead of excellence
to privacy. They are quoting this from GDPR. The Odissa court quoted sections of the personal data protection bill 2019, which many of us may dismiss as
However, compliance has to be customized. What is relevant
a bill. They are not even talking about DPA 2021, which
for Infosys cannot be applicable
is the JPC approved version of PDPB.
for another small IT company. A
This means that courts have started looking at the
standard for health industry
environment of what the industry is expected to be—in India and outside. They are using it in their judgments
may not be sufficient for fintech
and giving decisions. Today, it may not be a decision
companies.
to impose a penalty. But our courts can quote rulings in foreign courts like the USD 887 Mn fine imposed on Amazon by the Luxembourg Supervisory Authority, for prospective leakage of data and the-not-so-goodcompliance. A CFO may suggest to take a cyber-
compliance, and impose fines in India too.
insurance. If you want to bring down the insurance
Compliance by design
cover and thus the premium amount, to that extent,
A CEO’s responsibility is to ensure Privacy by Design and Security by Design which are all part of Compliance by Design. It is not restricted to the technology aspects and to think that only the CTO is
you should think of compliance and mitigation policies.
Option to develop codes
responsible is wrong. The entire business and
Section 50 of DPA says that different industry
professionals should be aware of what is required for
segments, if they want, may develop codes of practice
compliance. Before you go into a trade negotiation and
as applicable to them for compliance and that such
sign some contract, you should know that this is data
codes can be reviewed and accredited. You don't have
protection related and there will be consequences. The
to be bound by an ISO 27701 only or some other
decision to be compliant lies with the board. That is
framework.
the reason why Indian law says that a Data Protection
The government is telling the industry to develop
Officer (DPO) should be a Key Managerial Person
some self-regulatory practices. Such a provision was
(KMP).
there in IT Act also. But we never looked at the law. We
A CEO, CFO, the independent director, the company
think that the law is made only by the government and
secretary are the kinds of designations which fit into
either we oppose it and be non-compliant and face the
KMP definition. Now the DPO is also put in that group,
consequences or keep blaming the government.
which essentially recognizes that the activity of a DPO
FDPPI is now focusing on sectoral development of
is at the top level of the business. The Board and CEOs
codes of practice. We have developed a general
must recognize the need for compliance. Let us not
umbrella code of practice, which we have called as the
blame a CFO for non-sanction of finances for
Data Protection Compliance Standard of India (DPCSI)
BUSINESS MANDATE
fountainhead of excellence
27 MAY 2022
gives more time for us to do some preparatory work.
I am not trying to support the
With
government, but before DPA
perspective, let us look at the Act.
2021 is passed, industries
this
objective
and
focus
on
compliance
The essence of DPA 2021 in a nutshell:
should respond and try to
• The objective is to protect the privacy of individuals.
develop self‐regulatory
• The law applies to certain kinds of data and
practices.
certain kinds of activities. • It
prescribes
some
actions
-
the
data
processing requirements and then compliance requirements by default. and it is good enough as a general framework. However,
• It provides certain rights to data principals.
compliance has to be customized. What is relevant for
• There are penalties, which may go up to four percent of the global turnover.
Infosys cannot be applicable for another small IT company. A standard for health industry may not be
• Penalties may arise for non-compliance, even
sufficient for fintech companies. Even educational
when there is no data breach or wrongful
institutions and MMA have to be data protection
harm caused.
compliant. There is no exemption for NGOs or
• There is a section, which talks of criminal
government organizations. In banks, SBI and HDFC
punishment up to 3 years imprisonment,
Bank can follow a certain code which need not be
which extends to individuals and corporate
applicable for Repco or a Co-operative Bank.
executives including the Directors. ***
I am not trying to support the government, but before DPA 2021 is passed, industries should respond and try to develop self-regulatory practices. We at FDPPI are looking at interested corporate people who can be our members. Companies proactive in developing the codes of practice will take the leadership in their sector.
Capgemini; Rohan K George, Advocate, Samvad Partners; Nagendra Javagal, Director, FDPPI; Dr Mahesh Ranjan Nayak, Product Manager, Tata Health; Ramesh
• 27 July 2018-PDPB 2018 – Based on Justice
Venkatraman, Portfolio Manager, QMS and ISMS, Carl Zeiss; Venkataramani Suresh, Co-Founder, Karkinos
Srikrishna Committee • 11 Dec 2019-PDPB 2019 – Revised with public
Health Care; R Vittal Raj, Cyber Risk Assurance Consultant; Govind Srinivasan, Management Systems
comments • 16 Dec 2021-DPA 2021/22 – Reviewed by JPC The more, the government postpones the Act, it 28
discussions include Geetha Jayaraman, GRC Expert,
Kalyanaraman, AVP, Risk & Compliance, HCL; Nikhil
The timeline so far:
MAY 2022
Eminent panellists who participated in the panel
Practitioner, Paramount Dataware Pvt Ltd and Rupak Nagarajan, Associate Director, KPMG.
BUSINESS MANDATE
fountainhead of excellence