On 11th August 2023, the Draft Digital Personal Data Protection Bill, 2023 received President of India’s assent after passage in both the Houses of the Parliament and became a law i.e. Digital Personal Data Protection Act, 2023 (“DPDP Act”). The DPDP Act has been notified by the Government. This Act provides a framework for processing of digital personal data in a manner that recognises the right of individuals to protect their personal data and the need to process personal data for lawful purposes.
By way of brief background, in 2017, a Committee of Experts headed by Justice B.N. Srikrishna (Retd.) (“Srikrishna Committee”) was constituted to identify key data protection issues and provide a legislative framework for data protection in the country. The Srikrishna Committee submitted its report in 2018 along with a draft of the Personal Data Protection Bill, 2018. Thereafter, the Personal Data Protection Bill, 2019 (“2019 PDP Bill”) was tabled before the Parliament and later referred to the Joint Parliamentary Committee (“JPC”) which published its report in 2021 along with a draft Data Protection Bill, 2021. However, on 3rd August 2022, the Government of India withdrew the 2019 PDP Bill from the Parliament. Later that year, on 18th November 2022, the Ministry of Electronics and Information Technology (“MeitY”) released the Digital Personal Data Protection Bill 2022 (“Draft DPDP Bill 2022”) for stakeholder consultations. Finally, in the 2023 Monsoon Session of the Parliament, the Draft Digital Personal Data Protection Bill, 2023 was tabled before the Parliament which, after going through the Parliamentary procedure, has now become the law in India. The DPDP Act is the first consolidated legislation governing personal data protection and privacy in India.
| S.no. | Topic | GDPR | DPDP Act |
| 1. | Cross border data transfer | Codifies cross-border transfer of data and allows for transfer of personal data to a third country basis the adequacy test or the specified safeguards (i.e., Standard Contractual Clauses). | Cross-border transfer of data will be based on a negative list. No provision of any principles for assessing adequacy of countries that may be barred/restricted by the Central Government. Further, if there is a higher degree of restriction on transfer of personal data outside India in any other law, then the same must be followed. This would mean that sectoral laws like RBI’s localisation mandate for payment system data will continue to be applicable. |
| 2. | Notice | The GDPR requires providing information in the notice relating to the recipients or categories of recipients of the personal data, the period of retention of such data, and transfer of data. | The Notice requirements have been stripped down significantly in the DPDP Act and corresponding requirements of notice are not present. Information relating to processing activities and recipients can be accessed by the Data Principal upon request. |
| 3. | Personal Data Breach Notification | Data Controllers required to notify affected individuals without undue delay only if it is likely to result in a “high risk” to individuals. | Data Fiduciaries are required to notify affected Data Principals for any breach of personal data without any guidance on scale or severity of such breach. |
| 4. | Public Authority | Each Member State is required to establish an ‘independent’ public authority responsible for monitoring the application of the GDPR. | While the Board is required to be an independent body, in practise it may not enjoy ‘independence’ from the Central Government as the appointment of employees in the Board will be subject to Government approval and also their conditions of service, etc. will be prescribed by such Government. |
| 5. | Right to be forgotten | The GDPR specifically caters to the Right to be Forgotten when personal data has been published and requires that a Controller, in response to a request for the deletion of data that was previously made public, would need to “take reasonable steps” to inform any third parties that may be processing the data of the Data Subject who has requested deletion. There is also an obligation under the GDPR to communicate the deletion request directly to any known recipients of the data unless it would be impossible or would require disproportionate effort. | While the DPDP Act provides a right to erasure and a Data Fiduciary on receipt of such a request must erase the personal data of the Data Principal, it does not have any obligation to erase personal data that has been published by the Data Fiduciary or by its Data Processors that have been provided this data by the Data Fiduciary. |
| 6. | Age of consent | The GDPR imposes additional obligations when collecting consent from children under the age of 16 (or, at an age set between 13 and 16 by Member State law). | The DPDP Act defines a child as an individual under 18 years of age. The Central Government can notify a lower age for processing of children’s data if it is satisfied that the Data Fiduciary has ensured that processing of personal data of children is in a “verifiably safe” manner. Such Data Fiduciaries would be exempt from the applicability of all or any of the special obligations relating to child’s data. |
the Central Government, to direct any agency of the Central Government or an intermediary to block access to information, where it is satisfied that it is necessary or expedient to do so after giving an opportunity of being heard to the Data Fiduciary. Every intermediary who receives such direction is bound to comply with such direction.
Overriding Effect: Once enacted, the DPDP Act will replace Section 43A of the Information Technology Act, 2000 (“IT Act”) that provides the right to seek compensation from a body corporate that is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain while possessing, dealing or handling any sensitive personal data or information. Consequently, the DPDP Act will also replace the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011. Additionally, the DPDP Act also seeks to amend the Right to Information Act, 2005 and as per the amendment, there is no requirement to disclose any “information which relates to personal information”
The operationalization of the DPDP Act would be contingent on various rules/notifications issued by the Government of India and the DPDP Act will be implemented in phases through separate notifications.
By notifying the DPDP Act, the Government has taken a significant step towards introducing a comprehensive stand-alone legislation governing data protection and privacy in India. While the DPDP Act is largely based on the GDPR, there are significant departures from the GDPR. For instance, GDPR codifies cross-border transfer of data provisions and allows for transfer of personal data to a third country basis the adequacy test or specified safeguards. However, the DPDP Act does not provide any such threshold for crossborder transfer of personal data. Further, while the GDPR provides for the right to be forgotten, the DPDP Act does not specifically provide such right.
There are many concerns with the provisions of the DPDP Act. Notably, many terms used in the DPDP Act, such as “verifiable consent”, “detrimental effect on the well-being” of a child, “as soon as reasonably practicable” (for providing notice to Data Principals who had provided consent before commencement of the Act), have not been defined, leaving such terms open to interpretation. Further, the Central Government has broad powers, under the DPDP Act, to prescribe rules, regulations, and notifications in various areas, such as notice, data breach reporting, children’s digital personal data, list of countries for cross-border transfer etc. thereby giving excessive power to the government to notify the nuances of such provisions which would be critical in the effective implementation and compliance of the DPDP Act.
The DPDP Act also confers excessive powers to the Central Government allowing it to call for any information from a Data Fiduciary/Intermediary. The DPDP Act does not provide any guidance or safeguards in respect of the information that can be called for by the Government. Moreover, in addition to the Section 69A of the IT Act, the Central Government is also empowered under the DPDP Act to issue directions to an intermediary (albeit upon satisfaction of certain conditions) to block access, if it is in the ‘interest of the general public’, to information identified by the government.
Moreover, unlike the IT Act, the DPDP Act does not provide the right to seek compensation to the affected person in the event of any negligence on the part of the Data Fiduciary in implementing and maintaining reasonable security practices and procedures leading to a wrongful loss or wrongful gain while possessing, dealing or handling any sensitive personal data or information. To seek compensation from the erring Data Fiduciary, a Data Principal who suffers a civil wrong can invoke legal liability as a claimant against the person committing such wrongful act for compensatory damages, under tort law.
Furthermore, the compliance costs are likely to increase in light of the requirements, inter alia, to provide the option to access the contents of the notice and request for consent in English or any of 22 languages mentioned in the Eighth Schedule of the Indian Constitution. Further, the DPDP Act imposes a mandate of reporting data breaches to the Board and affected Data Principals. This would be in addition to the mandate of reporting cyber incidents to the Indian Computer Emergency Response Team as per the IT Act and rules and directions issued therein.
The DPDP Act prescribes hefty penalties (upto INR 250 crores, depending on the nature of the breach) for any non-compliance with its provisions on not only the Data Fiduciary but also the Data Principal.
While the DPDP Act codifies the rights and duties of Data Fiduciaries and Data Principals, Government’s approach in notifying various provisions of the DPDP Act and the timelines it seeks to provide to entities for transitioning and making appropriate administrative changes in a way that do not disrupt ongoing operations of businesses would be pivotal in the compliance and implementation of the DPDP Act.
This area of law in India is now an evolving landscape, and complete clarity will be available once the phased implementation of the DPDP Act is complete, and the corresponding delegated legislation is passed by Parliament and notified.
In May 2023, the National Commission for Protection of Child Rights (“NCPCR”) issued Guidelines for Child and Adolescent Participation in the Entertainment Industry (“Guidelines”)
The Guidelines supersede its previous iteration of 2011 and have been revised to ensure the welfare of children who are working in the entertainment industry and have taken into consideration the nature of issues that were brought before the NCPCR as well as the growing use of social media platforms and OTT platforms for creating entertainment content.
Some of the key features of the Guidelines are as follows:
The Guidelines issued by the NCPCR are a much needed upgrade to the 2011 Guidelines, given the popularity, ubiquitous use and exposure to Internet based entertainment sector and its impact on children who participate and consume this content.
However, the Guidelines appear to be a consolidation of all the prevailing laws, governing children/adolescents and their participation in the entertainment sector, mostly reproducing the provisions under various laws and not providing any clarity on the overlapping nature of the powers conferred under these laws to various authorities. Further, the Guidelines require production houses to register all child artists with the District Magistrate, however, the registration will be valid only for 6 months at a time. While this provision is important to ensure safety and security of children, it is pertinent to note that the Guidelines are not mandatory under law thereby frustrating the very rationale of introducing a registration mechanism. Moreover, the 6 months’ term for validity of registration places onerous obligations on media and production houses which would likely deter such media/ production houses from following the Guidelines.
Accordingly, while the intention behind introducing the Guidelines is vested in the interest of children and child artists, the execution of these Guidelines and its impact on ease of doing business will become clear in fulness of time.
On 27th June, The Ministry of Environment, Forest and Climate Change (“MoEFCC”) issued a notification containing the Draft of the Green Credit Programme Implementation Rules, 2023 (“Green Credit Rules”) for public consultation. The Green Credit Programme aims to leverage a competitive market-based approach for Green Credits thereby incentivising voluntary environmental actions of various stakeholders such as private sector industries and companies as well as other entities. The Green Credit Programme will enable such entities to meet their existing obligations, stemming from other legal frameworks, by taking actions which are able to converge with activities relevant for generating or buying Green Credits. The key highlights of the Green Credit Rules are:
The Programme accordingly will further the LiFE movement by seeking to establish market-based mechanisms for providing Green Credits. Such a Programme would incentivise adoption of environmentally friendly practices by various entities like the private sector, industries, etc.
The Green Credits will be made available to individual and entities, engaged in selected activities and who undertake environmental interventions and the same will made available for trading on a domestic market platform. Additionally, in case an environmental activity generating Green Credits also reduces/removes carbon emissions, the same shall be eligible to claim carbon credits as well.
A phase wise approach for implementation of the Programme will be adopted. In the first phase, two to three activities from the sectors indicated below will be considered for designing and piloting the Programme:
Thresholds and benchmarks will be developed for each Green Credit activity for generating and issuance of Green Credits. In case of any obligation under any law, the thresholds and benchmarks will be aligned with that obligation. The environmental outcome, achievable by any Green Credit activity, will be based on equivalence of resource requirement, parity of scale, scope, size and other relevant parameters, and will be considered for allocation of one unit of Green Credit in respect of each activity.
A Steering Committee, comprising of representatives from the concerned Ministries/Departments, domain experts will be setup to oversee the implementation of the Programme. Specifically, the Steering Committee will have to carry out the following functions:
Indian Council of Forestry Research and Education shall be the Administrator of the Programme which shall discharge, inter alia, the following functions:
Accredited Green Credit Verifiers: Accredited Green Credit Verifiers shall conduct verification and submit reports to the Administrator for grant of Green Credits in accordance with provisions of the guidelines.
The Programme is a laudatory initiative by the MoEFCC as it seeks to use a market-based mechanism to incentivise multiple stakeholders to use environmentally friendly practices. Additionally, the Programme, in line with principles of good governance, seeks to converge existing schemes/activities like compensatory afforestation, extended producer responsibility, etc. and providing green credits for the same. Another aspect of the Programme that merits attention is the convergence with carbon credit and such an activity generating Green Credits may also get Carbon Credits from the same activity under carbon market. The MoEFCC has, in compliance with the pre-legislative consultative policy, sought comments from the public on the Programme before notifying the same. The same approach should be adopted whilst notifying various operational guidelines under the Programme such as issuance of digital green credits, trading of green credits, etc.
On 13th June 2023, TRAI issued a direction requiring all Access Providers to deploy Artificial Intelligence and Machine Learning (“AI/ML”) based Unsolicited Commercial Communication (“UCC”) Detect System to detect, identify and act against senders of Commercial Communication who are not registered in accordance with the provisions of Telecom Commercial Communication Customer Preference Regulations, 2018 (“TCCCPR”).
The introduction of AI/ML measures to combat UCC is a welcome step for the effective implementation of the TCCCPR. Over the past few years, the TRAI has been actively engaged in combating UCC, specifically through the strict implementation of registration requirements for telemarketers. The growing menace of bulk UCC, despite strict regulations for content and principal entity registration, is quickly escalating on a global scale. The Direction is extremely pertinent in light of the recent steps taken by the Singapore Infocomm Media Development Authority (“IMDA”). The IMDA requires entities sending SMS with alphanumeric Sender IDs to be registerd with the Singapore SMS Sender ID Registry (“SSIR”). Further, unregistered entities sending such SMS shall be labelled as “Likely-SCAM” in an attempt to preserve cyber health and protect consumers from online scams. Considering that previous attempts by TRAI utilising DLT/ blockchain have not been able to keep up with the rise in UCC, incorporating AI/ML solutions to detect such communications could be extremely beneficial for consumers at large.
On 31st May 2023, the Ministry of Health and Family Welfare (“MoHFW”) notified the Cigarettes and other Tobacco Products (Prohibition of Advertisement and Regulation of Trade and Commerce, Production, Supply and Distribution) Amendment Rules, 2023 (“COTPA 2023”). These rules amend the Cigarettes and Other Tobacco Products (Prohibition of Advertisement and Regulation of Trade and Commerce, Production, Supply and Distribution) Rules, 2004.
COTPA 2023 mandates publishers of online curated content to display antitobacco health spots, warning messages, and audio-visual disclaimers while displaying any tobacco products or their use.
COTPA 2023 came into force after expiration of 3 months from the date of notification, i.e. on 31st August 2023.
The amendments introduced under COTPA 2023 appear to have been introduced with the intent of discouraging tobacco consumption considering the growing popularity of over-the-top (“OTT”) platforms and their impact on viewers. Notably, the definition of the term “online curated content” has been harmonised with the definition provided in Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and cover original content as well as any third party content hosted/made available on OTT platforms. Interestingly, the MoHFW will be providing the language for the anti-tobacco health spots, warning message and the audio visual disclaimers, informing the stakeholders about the language that would be acceptable for such health spots, warning messages, and disclaimers.
Having said this, at this time, it is unclear whether these rules would be applicable to existing programmes or new content made available after 3 months, potentially leading to administrative issues for OTT platforms. Further, while COTPA 2023 provides for an action from an inter-ministerial committee in the event of non-compliance of these rules, the basis of forming such a committee and the scope of its powers have not been provided. COTPA 2023 also does not shed light on the consequences of non-compliance with the notice of the inter-ministerial committee.
Moreover, since the language for the health spots, warning messages, and disclaimers will be provided by the MoHFW, which has to be displayed in the manner specified in COTPA 2023, such manner of display could potentially affect the consumer experience of watching the programme on OTT platforms. Additionally, in the absence of any definitions, the difference between a health spot, warning message and a disclaimer is unclear at this time, which may become clear when the MoHFW provides the language for the same on its websites.
On 2nd June, 2023, TRAI issued a Direction under the Telecom Commercial Communication Customer Preference Regulations, 2018 (“TCCCPR”) to all the Access Providers (“APs”) to develop and deploy the Digital Consent Acquisition (“DCA”) facility. The DCA facility is a unified platform and process to register customers’ consent digitally across all service providers and Principal Entities (“PEs”) to curb spams through Unsolicited Commercial Communication (“UCC”) . A period of two months has been allocated for the development of the DCA facility and will be implementing the same in a phased manner.
The Direction is a much needed development in light of the significant rise in UCC spam over the past few years. TRAI has been continuously engaged in developing measures aimed at curbing UCC, including the development of a Do Not Disturb application, as well as, constant efforts aimed at ensuring compliance with header and content registration requirements. It is pertinent to note that the TCCCPR has preexisting obligations for APs to develop/cause to develop an ecosystem to regulate the delivery of the commercial communications, including the facility to record consents of the subscribers acquired by the senders for sending commercial communication, maintenance of complete and accurate records of the consents and revocation of consent by its subscribers, in furtherance of which the consent records will be updated. Further, it is also the obligation of APs to ensure that no commercial communication is made to any recipient, except as per the preferences or digitally registered consents registered in accordance with the TCCCPR. Accordingly, this Direction will be a step further in providing APs with the ability to verify such consents and will be extremely beneficial for subscribers at large.
The Direction will be implemented phasewise, with the first phase pertaining to only subscriber-initiated consent acquisition and subsequent steps will include PE initiated consent acquisition as well.
Ameet Datta is a Partner at Saikrishna & Associates. He is an IP litigator and TMT lawyer with over 22 years of experience and wide ranging expertise across IP Law, Technology law, privacy and data protection law, white collar crime cases around data breaches, and, media & entertainment law specifically in relation to licensing, content aggregation & acquisition, film & music production, distribution/ licensing, format rights, defamation and right of publicity. Ameet has extensive experience with the creative sector in terms of multiple litigations including licensing disputes before the Courts & the Copyright Board. Ameet is closely involved with Copyright laws, Technology regulations and policy matters. In 2010, Ameet appeared as an expert WITNESS before the Indian Parliamentary Standing Committee overseeing amendments to the Copyright Act, 1957. Ameet has been highly ranked as a recommended lawyer for IP Litigation, and, telecoms, media & entertainment by Chambers & Partners (Asia Pacific), WTR- 1000; as a recommended lawyer for IP litigation by Legal 500, and recommended as an IP Star by MIP
Suvarna Mandal is a Partner at Saikrishna & Associates. She has nearly a decade of experience in providing trade & regulatory compliance advice to domestic and international clients for understanding and complying with a wide range of national, state as well as sector-specific legislations and regulations in the spheres of telecommunications, technology law, consumer law, environmental law, product compliance and safety regulations (including packaging standards, labels and safety standards), data protection and privacy, media law, advertising regulations, etc. She provides end-to-end compliance counselling to clients across various industries and sectors such as software services, consumer electronics, technology, telecom, media, intermediaries, e-commerce, online value-added services sectors, consumer goods and medical devices. Suvarna also works closely with clients’ Government Affairs team to prepare strategic policy documents, representations and formal communications towards policy development and policy reform efforts with the Government.
www.grandmasters.in | 8 Years & Counting
www.rcls.in | 8 Years & Counting
www.itlegalsummit.com | 8 Years & Counting
www.bfls.in | 8 Years & Counting
www.maels.in | 8 Years & Counting
www.plcs.co.in | 8 Years & Counting
Copyright © 2020 Lex Witness - India's 1st Magazine on Legal & Corporate Affairs Rights of Admission Reserved
