Naavi.org

The way Mumbai Police has handled the Republic TV case with

-the reopening of a closed case

-of what possibly was a murder and treating as a suicide

– bringing in the abetment link for a business contract dispute,

-deliberately misreporting the TRP report submitted by a market research agency to substitute one Channel to another

– arm twisting witnesses by visiting them in the night,

-bringing pressure on the research company to change its report,

-arresting the editor of a TV channel,

-moving him into a jail with criminals,

-assaulting, intimidating etc.,

is a Bollywood script which would have been a block buster movie and could have been titled ” Singham the new Don”.

This could perhaps qualify as a  human rights and freedom of press issue. However, since Human rights are normally available only for terrorists  and the freedom of press is only available to a privileged class of journalists only, this case is not perhaps eligible for the activists who are normally interested in taking up such issues and they remain in a self imposed silence.

We also presume that the hands of the Central Government are tied and the High Court and Supreme Courts which open their offices in the middle of the night to hear the Yakub Memoms, now want to enjoy their well earned week-end holidays and take their own sweet time to hear a case of this nature.

Since even Mr Subramanya Swamy or Mr Modi or Amit Shah have found themselves helpless in the matter, it is unnecessary for us to express any view on the matter.

We can only say ‘Jai Ho’ to our democracy which enables a party like Shivasena to win an election on the strength of their association with BJP and later associate with Congress, form the Government and do what it wants.

Our concern is only what does all this mean to the  Data Protection industry which we need to discuss.

Impact on Data Protection Industry

As we all know, there is a provision in laws such as GDPR that if the regulatory agency of a country finds that another country has acceptable data protection measures, then under the “Adequacy” clause, personal data can be transferred from the host country to the destination country without the restrictions otherwise imposed in this regard. As a result, in order to preserve the data processing business coming from the EU region, most countries strive towards meeting the requirements of GDPR to gain the adequacy status.

The reason why nearly 130 countries are passing personal data protection laws is that it is the first step towards gaining the attention of EU authorities to even make a claim to the “Adequacy” status.

But as we recently found out, the EU demands a heavy pound of flesh to provide the “Adequacy” status. Nothing less than an abject surrender and will satisfy the EU Courts as was indicated in the Schrems II judgement of the EU Court of Justice. In this case, the US privacy shield which was considered acceptable even by the EDPB was rejected by the Court. The reason was because it felt that the guaranteed assurances were unsatisfactory since the Ombudsman was appointed by the President of United States and the Intelligence agencies like FBI continue to have right of surveillance over the personal data transferred from EU for processing in US.

The EDPB suggested that Data Exporters in EU may get an assurance from the Data Importers through the Standard Contract clauses (SCC) in the agreement. But it must be recognized that a Data Importer of a country like India or US cannot sign a contract which is in conflict with the local laws made either by the Parliament of the country or enforced by the national security agencies.  Even if such terms are signed off in a contract, it will not prevent the local law enforcement authorities to invoke them ignoring the contractual obligations.

Hence there is no way any country can satisfy the EUCJ regulations on Data Importer’s obligations without picking up a fight with the law enforcement agencies in the local area, which has become an existential risk for the company.

It is here that the Mumbai Police has established a precedence that it is the supreme law making body in the country and not answerable to any body other than the party in power in the state. This will definitely be taken up as an argument against India in any international forum when required that in India, the local Police (not even the CBI) have the ultimate call on what data they want to ask from a company and for what reason.

Any outgoing employee of an organization or a contactor for whom the company refuses to settle dues because of any reason may commit  suicide and it is enough for that company to be in the radar of the Police for “Abetment to Suicide”.

It is time for all companies to scan their employee/contractor suicides and ensure that it does not point to any possible abetment charge.  This will be a new “Threat vector” that security professionals need to consider.

As a result of this Mumbai development, the “Adequacy” and “SCC” are unlikely to be of any use for Indian Companies to establish a case for transfer of personal data.

The only credible option is to ensure that there is an explicit consent from every data subject for transfer of personal data for processing into India for which the Data Controller has to take necessary measures.

Thus the developments have rattled the Indian position on data protection in the global environment and will set us back by a few notches in the “Ease of Doing Business”.

What JPC on PDPB can do

In order to safeguard the Indian data protection industry, one precaution that the Joint Parliamentary Committee on PDPB 2019 need to take is to prescribe in PDPA of India that

“any offence either under PDPA or under ITA 2000 or other laws against data processing organizations shall be investigated only by a central investigating authority like the CBI and NIA with the concurrence of the Data Protection Authority”

In other words,

“Data” should be declared as a new class of  “Asset” whose management and security does not fall under the jurisdiction of the state police.

The logic for this is that Data is an asset like “Spectrum” and is neither movable, immovable nor it is an intellectual property nor an actionable right.

Therefore, Data should be declared as a new and exclusive class of asset.

Just as there is a separate law for intellectual property, the Personal Data Protection Act should be regarded as the exclusive law for Data which which should be governed only under the directions of the Data Protection Authority.

This would mean that many provisions of ITA 2000 in respect of data related crimes should require permission of the DPA for the local police to investigate. This should be similar to the restriction that the local state Governments can impose on CBI investigation in the State which many of the states including Maharashtra, West Bengal etc have imposed.

Alternatively, ITA 2000 may be amended and Section 80 should be amended to make a “Central Cyber Crime Force” the sole police authority to investigate and prosecute Cyber Crimes.

Probably this will increase the efficiency of Cyber Crime management since all Cyber Crimes are inter state crimes if not international crimes.

This new definition of an asset class will be an innovative amendment that can be brought to PDPB 2019.

I hope JPC will take note.

What other State Governments like Karnataka can do

In the meantime, Naavi.org suggests that a progressive State Governments such as Karnataka, should undertake some special measures to provide assurance to the international data market that what happened or is happening in Maharashtra is an aberration and does not represent the way law is implemented elsewhere in the country.

We have to assure the international community that India is not a banana republic though Maharashtra has the right to be. We are a true federal democracy and tolerate states like Maharashtra as part of our democracy. We can assure that Karnataka is a “Data Angel” with special assurances for the data processing industry.

The least that can be done is for the state Government to give a press statement that what happened to the media companies like Republic and Hansa in Mumbai will never happen in Karnataka.

Along with such an assurance, the Government has to invite all those IT Companies like Infosys which were at one point of time unhappy with the Karnataka Government  and shifted their expansion operations to Pune to come back to Bangalore.

It is time to reassure the IT industry that Karnataka shall be a safe haven where data processing companies  that there will be no interference from the State in the day to day affairs of a commercial organization whether it is a media company or a data processing company.

This is therefore an opportunity for Karnataka Government and it should appropriately strategize to harness the opportunity.

Naavi

When Singapore amended its data protection laws increasing the penalties for data breach to 10% of the annual  turnover, a window of opportunity has opened up for India to attract investments of data processing companies to India.

India presently is operating under the data protection regime of Section 43A of ITA 2000 and is not considered good enough for global companies to have their personal data processed in India. But once the Personal Data Protection Act is passed, India can on paper sport a data protection law which is on par with global laws.

At the same time, if some companies were considering setting up their operations in Singapore because there was a better industry environment there and a better “Ease of Doing Business”, they have been jolted by the recent amendment to PDPA 2012 increasing the penalties for data breach. The data breach risk will increase the cost of operations along with the  cost of risk mitigation and Cyber insurance cost both going up not to talk of occasional data breach which may escape all security measures.

The recent relaxation of OSP guidelines from DOT is another major positive development which could also attract some fence sitters to consider India as their investment destination.

Hopefully, the PDPB 2019 will be passed without further delay so that Government can spread the word around about the better business environment in India and attract investments.

At the same time, developments in the State of Maharashtra have set the industry back by a significant margin since the data protection industry look for a law and order situation where law enforcement works in protecting the industry rather than wage a war on the industry at the whims and fancy of the local Government and the Police. The inability of the federal Government and the Courts to intervene when it was required has put a doubt in the minds of international observers that if tomorrow, a data processing company is in the bad books of the local political party or the Police, then the operations of the company as well as the personal data entrusted to them for processing is not safe from being vandalized by the State.

Mumbai being a commercial hub with Pune being an important data IT hub, the impact of the developments regarding the Republic TV would cast a shadow on the lawfulness of  operations in the country. The developments have turned part of the country into a banana republic and going by the Schrems II decision of the EUCJ, India will not be considered a country which EU can rely upon.

In order to reduce the adverse impact of the Mumbai Police excesses, it is necessary for other States such as Karnataka to take extra efforts to attract the IT industries and more particularly the data processing industry that what is happening in Mumbai is an aberration and does not reflect the general status of lawfulness of the industry operations elsewhere in the country.

Perhaps to take the advantages from the two positive developments namely the amendment of the Singapore data protection act adverse to the industry, and the amendment of the OSP guidelines in India favorable to the industry as also to cushion the impact of the  misadventures of Mumbai Police and Government, the neighboring Governments in Hyderabad and Bangalore may undertake special projects to attract IT investors to these states.

Perhaps special economic zones such as ” Data Processing Zones” may be created for businesses involving the processing of personal data with support of employees working from home. Since the PDPB 2019 also provides that the DPA can notify a local data processing entity processing personal data of foreign citizens as being exempted from PDPA of India, if the local state Governments provide the assurance to the industries that they are not like the Maharashtra Government and will not behave like what Maharashtra is behaving in the case of Republic TV, then we can not only move some projects from Singapore to these states , but also move many projects slated for Pune and other parts of Maharashtra to Bangalore and Hyderabad.

Let us hope Karnataka Government seizes this opportunity and undertakes some programs on this theme during the Bengaluru Tech Summit due in the end of November.

Naavi

Lupin Suffers Information Security Incident-Business Insider

The trend of Continuing cyber attacks on pharmaceutical companies, before the advent of the PDPA (Personal Data Protection Act of India) when companies are expected to have better security oversight seems to continue with the latest incident report from Lupin Laboratories Ltd.

According to the sketchy reports available in the media “Select IT Systems were affected”. Company has stated that the Core systems and operations were not affected and restoration of the impacted systems was underway.

Globally, it is known that data breach in Health Industry is expensive to a company (According to a study the average cost of data breach in a Pharma company is US$ 7.3 million). At the same time, the Health care industry is not so good in its IS practices as indicated by a study which states that it takes nearly one year to track down a Cyber Security issue in such a company. Hackers consider Health care industry to be a gold mine because the stolen health data may carry a price of around US $ 1000 per set in the darkweb. There is no surprise that most data breaches (nearly 50%) are due to malicious attacks.

While this situation is global, India is in the cusp of passing the PDPA and the current times may be the last opportunity for hackers to catch a negligent company.

First it was Breach candy hospital. Then it was Dr Lal Pathlabs and Dr Reddys. Now Lupin. May be others will also experience are have already experienced hacks yet to be identified and revealed.

Hopefully, Industry would wake up and fortify its defenses when the law is yet to impose the kind of fines that would be common place when the PDPA comes into operation.

We know that currently Indian law as in ITA 2000/8 has Section 43A which expects companies holding sensitive personal data maintain “Reasonable Security Practice”. Even those companies who are not handling sensitive personal data are liable under Section 43 along with other sections including Section 66 and 72A to ensure that “Prudent Security” is always available to protect data which has implications on the share holders or the public.

Fortunately, the implementation system currently is too weak to make the companies jump up and such incidents get buried from our memory soon.

We need to however take notice that so far we were considering that “Administrative fines” under GDPR and the proposed Indian PDPA at a maximum of 4% of global turnover as deterrent enough. But Singapore has come up with a shocker of an amendment in which the administrative fine in respect of a personal data breach can be as high as 10% of the turnover.

Considering the frequency with which data breaches are getting reported, if such fines are really imposed, many companies may need to file insolvency if confronted with a single data breach incident. In fact the “Risk of Doing Business in Singapore for a Company processing personal data” has now taken a quantum leap. This means Cyber Insurance costs in Singapore and salaries of DPOs  and CISOs will also jump through the roof.

We must however recognize that “Breach of Personal Data” is different from “Breach of Non Personal Data”. Many security incidents including ransomware attacks may stop at the level of denial of access or a compromise without exfiltration of personal data. Such “Information Security Incidents” may not qualify for the “Personal Data Breach” and hence may not come under the jurisdiction of the Data Protection Authority or the Supervisory Authority or the PDPC. It may just be a “Cyber Crime Incident” where the victim has to claim his personal loss as a damage and Police will have to pursue the crime incident.

It will therefore be necessary for us to classify the “Security Incidents” as involving or not involving personal data. Similarly the Cyber Insurance contracts need to distinguish the incidents as “Personal data Breach”, “Sensitive personal data breach” and “Non personal data breach” and fix premia and coverage separately.

Under IPC we have different offences such as “Murder”, “Culpable Homicide Not amounting to Murder” and “Causing death by Negligence not amounting to homicide” etc., with different punishments.

Similarly the Data Industry needs to recognize different types of Data Breaches and ensure that they donot report a “Data Breach which is of a Non personal data breach” is not reported wrongly as a data breach to a Personal data regulator and vice versa.

At the same time, the law is vague enough and Police like in Mumbai can have such innovative interpretations that most data breaches may fall under both Personal Data and Non Personal data breaches and hence companies need to prepare themselves for this new regime of Data breach Oversight from the Police and Personal data regulatory agencies.

Naavi

Singapore passed some key amendments to the Personal Data Protection Act 2012 establishing a new norm for administrative fines at 10% of turnover.

Now companies, with turnover exceeding Singapore dollar 10 million per year,  responsible for data breaches face financial penalties upto 10% of their turnover or Singapore dollars 1 million which ever is higher. For companies with turnover less than S$10 million the maximum pernalty remains at S$ 1 million.

Additionally 

a) New offences related to the mishandling of personal data has been introduced

b) Deemed consent provision has been expanded

c) New Exceptions have been introduced in consent requirement

d) New Data Portability obligation has been introduced

e) Spam Control act has been expanded to cover instant messaging platforms.

f) In addition to the increase in the fines related to data breach, notification has been made mandatory.

g) The applicability of the law has been extended by removing the exemption provided for  Organisations acting on behalf of public agencies from the Act

New Offences

The new offences introduced include

• any unauthorised disclosure of personal data that is carried out knowingly or recklessly;
• any unauthorised use of personal data that is carried out knowingly or recklessly and results in a wrongful gain or a wrongful loss to any person; and
• any unauthorised re-identification of anonymised data that is carried out knowingly or recklessly.

(This does not include public officers, who are subject to the Public Sector (Governance) Act 2018.)

It will also be an offence for a person to fail to:

• comply with an order to appear before the PDPC or an inspector of the PDPC;
• provide a statement in relation to any investigation; or
• produce any document specified in a written notice.

Deemed Consent

The definition of “Deemed consent” is  expanded to include:

• for contractual necessity, i.e. where data processing is reasonably necessary to perform a contract; and
• where individuals have been notified of the purpose of the data processing and given an opportunity to opt out.

Exceptions

New exceptions are being provided for Consent in the following instances.

Now consent will not be required where the legitimate interests of the organisation and the benefit to the public (or any section thereof) together outweigh any adverse effect on the individual.

This could include where data is processed for the purposes of detecting or preventing illegal activities (e.g. fraud or money laundering) or threats to physical safety and security, ensuring IT and network security, or preventing the misuse of services.

Organisations must however conduct a risk and impact assessment, and disclose any reliance on legitimate interests and  cannot use the provision to send direct marketing messages to individuals.

Tthere will be a business improvement exception to consent, where there is a need to:

• carry out operational efficiency and service improvements;
• develop or enhance products/services; or
• know more about the organisation’s customers.

The use of personal data must be what a reasonable person would consider appropriate in the circumstances, and the data must not be used to make a decision that is likely to have an adverse effect on any individual. This exception also applies to a group of companies, including subsidiaries within an organisation.

Also, the research exception to consent will be available, provided that, among other things:

• the use of personal data or results of the research must not have an adverse effect on individuals; and
• results must not be published in a form that identifies any individual.

There will also be exception  to institutes carrying out scientific research and development, or arts and social science research, or to market research aimed at understanding potential customer segments. However, disclosure for research purposes will continue to be subject to more stringent restrictions relating to impracticality and public interest.

Additionally the scope of the business asset transaction exception in the PDPA will be extended to the personal data of independent contractors, in addition to that of employees, customers, directors, officers and shareholders of the organisation.

Data Portability

Data portability right will now be available to individuals, giving them the right to request the transmission of their data to another service provider.

An organisation’s portability obligation will only apply to:

• user-provided data and data on user activity held in electronic form, including business contact information, this data may include third-party personal data, where the request is made in the requesting individual’s personal or domestic capacity;
• requesting individuals with an existing, direct relationship with the organisation; and
• receiving organisations with a presence in Singapore; however, data portability could subsequently be extended to like-minded jurisdictions offering comparable protections and reciprocal arrangements.

The PDPC will work with industry and sector regulators to establish and set out further requirements under regulations, including:

Exceptions to the data portability obligation will be provided, similar to those for the access obligation.

Personal data that is derived by an organisation in the course of business from other personal data will not be covered by the portability obligation.

Refusals of porting requests must be notified to individuals, together with the reasons for the refusal, and within a reasonable time. The PDPC will have the power to review these refusals and any fees for the porting of data.

Data retention

Organisations will be required to preserve personal data requested under an access or porting request for at least 30 calendar days after rejection of the request, or until the individual has exhausted their right to apply to the PDPC for reconsideration of the request or appeal to the Data Protection Appeal Committee, High Court or Court of Appeal, whichever is later.

Spam Control

The Spam Control Act 2007 will now cover the bulk sending of commercial text messages to instant messaging accounts. ‘Do not call’ (‘DNC’) provisions will prohibit the sending of specific messages to telephone numbers obtained through the use of dictionary attacks and address harvesting software.

Third-party checkers will be required to communicate accurate DNC register results to the organisations on behalf of which they are checking the DNC register, and the checkers will be liable for DNC infringements resulting from any erroneous information provided by them.

The DNC provisions will be enforced under the same administrative regime as the other data protection obligations in the PDPA, as opposed to being enforced as criminal offences.

Accountability

There will be a higher level of accountability for the Organisations who will be expected to demonstrate compliance.

Thus the law in Singapore has become more stringent and at the same time brought in more clarity.

Naavi

Details of the amendment are available here

FDPPI (Foundation of Data Protection Professionals in India) is the Champion organization in Personal Data protection in India. Started in September 2018 under the leadership of Naavi, FDPPI has made significant strides in establishing itself as the torch bearer of Data protection in India to the extent that its byline “Think Data, Think FDPPI” makes real sense.

In its bid to provide End to End data protection services, FDPPI today provides “Certification in Data protection laws of India and other major laws” through two programs titled Module-I and Module-G.

FDPPI also is working on the “Unified Personal Data Protection Framework” namely PDPSI (Personal Data Protection Standard of India” so that organizations may be compliant with Personal data protection Act of India as at present and as proposed with extensions for GDPR and other data protection laws to which an organization in India is exposed.

The third leg of serving the Data Protection community namely providing a “Grievance Redressal mechanism” for

a) Data Principals (Data Subjects) and the Data Fiduciaries (Data Controllers)

b) Data Principals and Consent Managers  or

c) Data Principal and another Data Principal

d) Data Fiduciary and Data Processor or a sub contractor

e) Data Processor and a sub contractor etc

Now FDPPI has started work on establishing a “Data Disputes Mediation and Arbitration Center” to address Alternate Dispute Resolution Mechanism required by the industry.

Initially the “Mediation” wing will start operations. Subsequently, a “With Recourse Arbitration” meaning Arbitration without prejudice to the Adjudication proceedings provided under the legacy system would be introduced.

The arbitration and mediation would meet the expectations of Indian Arbitration Act as amended and will also be in tune with the technical standards indicated by UNCITRAL.

The entire infrastructure for the same is available under odrglobal.in which will be made available for online arbitration. The professionals to conduct the arbitration would be drawn from the trained senior professionals who are experts in the field of Data Protection with more than 10 years of legal and technical expertise.

Hopefully, with this FDPPI will be able to provide the required support to the Data Protection industry even before the Personal Data Protection Bill becomes an Act.

Cyber Law College is also organizing the necessary mandatory training in Indian Arbitration Act to those who are participating in this activity.

More details will be made available through FDPPI.

Naavi