Naavi.org

Strategy war rooms of companies have been discussing the impact of AI on their business and how they need to leverage the new technologies. In the past they have also discussed how to leverage certification of ISO 27001/27701 in the context of Privacy. Now is the time to discuss DPDPA Compliance as the new challenge. It is in this context that DGPSI is emerging as the TINA option for the organizations. Yes, There is No Option or more appropriately “There is No Better Option”.

The options that are before companies is ISO 27001 (2022) which is incomplete and inadequate for Compliance of DPDPA. Even if ISO 27001 is modified or implemented with ISO 27701, the make shift combination will not be recognizable as specific to DPDPA compliance.

The next option is to adopt the DSCI Privacy Framework which is constructed to protect the Privacy of Personal Information from unauthorized use, disclosure, modification or misuse.

This is a three layer framework with Privacy Strategy and Processes at the foundation of the pyramid, Information usage, access, monitoring and Training as the body of the framework and Personal Information Security at the top of the pyramid. However this framework was developed at a time before DPDPA and does not focus on DPDPA compliance. It is more generic and needs to be adapted for DPDPA.

On the other hand the DGPSI framework was developed exclusively for compliance of DPDPA and DGPSI-Lite focusses only on 36 requirements required for DPDPA Compliance. It is a “Framework for Compliance by design” where as other privacy frameworks claim themselves to be frameworks for “Privacy by design”. “Compliance by design” is inclusive of “Privacy by Design” and “Security by design” and focussed on mitigating the risk of non compliance of DPDPA.

The Data Governance and Protection Management System (DGPMS) constructed under DGPSI framework is an inclusive framework that can be identified as PIMS for DPDPA, ISMS for PII (based on Cert In CSF framework which is also compatible to ISO 27001framework) and further adds the Personal Information management aspects enumerated in ITA 2000, Consumer Protection Act 2019 and BIS draft standard for Data Protection.

DGPSI is therefore more comprehensive and more goal specific. DGPSI-Full version with 50 implementation specifications capture the essence of the requirements of these multiple laws and multiple governance frameworks.

In this perspective DGPSI is not just the better option but is the only option for DPDPA Compliance. Hence DPDPA can claim the tag of “TINA option for DPDPA Compliance. “

Naavi

In 2016, we saw a case being filed on TCS in USA (Tata America International Corp) when EPIC Systems filed a suit to recover uS$940 million. The US Supreme Court upheld the claim of Epic to the extent of $140million. Finally, in 2023, TCS did make a provision for liability of around $125 million (Refer : 1. Even when my client is negligent, the liability can be on me : 2: Press Release from TCS )

In the TCS case it was alleged that an employee of TCS had downloaded some information from EPIC servers and it was used by TCS eventually for developing a commercial product resulting in a copyright violation.

Now another software giant of India is facing a case in US, this time for a dispute raised by another Indian company itself. This is the case filed against Infosys by Cognizant TriZetto in a US Federal Court.

(P.S: This is a developing information and information referred to here is based on other published reports. It may be corrected as required if new information comes in).

Cognizant offerings include TriZetto’s Facets and QNXT, which healthcare insurance firms use to automate tasks. Now it is the version of Cognizant that Infosys misused Trizetto’s software to create “Test Cases for Facets” and re-packaged its data into an Infosys product.

Rajesh Varrier	Rajesh Nambiar

It is unfortunate that two Indian Software Companies are fighting in US Courts while the dispute relates to activities which occurred perhaps in the Indian geography.

In such cases we expect NaSSCOM to intervene and mediate a solution. But the fact that the Case has been filed soon after a former Infosys executive Mr Rajesh Varrier as the global head of operations and India Chairman and Managing Director and the movement of Mr Rajesh Nambiar from Cognizant to NASSCOM as its president is to be noted. Under the current circumstances it appears that NASSCOM is not in a position to intervene.

Both Mr Rajesh Varrier and Rajesh Nambiar can be presumed to be aware of the dispute before their movement and are part of the decision for the case being filed.

We hope wiser counsels prevail and the two organizations come to a mediated settlement and withdraw the case. MeitY should intervene and try to settle the case without the litigation in the US Courts.

Essence of the Dispute

The allegation of Trizetto is that Infosys unlawfully extracted data from its databases and used it to build and market competing software. The Complaint filed by Cognizant Trizetto Software Group INC seeks damages and injuctive relief for misappropriation of trade secrets, breach of contract and unfair competition.

The two companies were under a Non Disclosure Agreement where Infosys had access to proprietary information of Cognizant and the dispute now is that this contractual terms have been violated. More than the Trade Secret issue, the dispute is one of violation of Contractual agreement.

The respondent is named in India and it is understood that the major development center of Trizetto is also in India. Hence the jurisdiction for settlement could have been India. The petition tries to establish that jurisdiction exists in US but does not mention the jurisdiction clause in the NDA. We need to check the NDA to understand if the jurisdiction clause was mentioned there as India or US. However it is clear that Cognizant did not want to fight the case in India and chose the US forum specifically.

It appears that Infosys in this case is an authorized user of Facet and had a contract with some clients of Trizetto for testing. These were known to Trizetto also. Trizetto has its own published Test Cases which Trizetto claims as its “Trade Secrets”.

I am also reminded of the Radiant Software issue (also refer here)several years back where the training company was accused by Oracle of misusing a user license for training. At that time, we had pointed out that whenever an instance of oracle was used by Radiant Software, it was to train people on Oracle software and the skill was meant to be used only with clients of oracle who had a licensed usable software. Hence use of Oracle installations by Radiant in its training center on multiple computers were actually promoting the use of Oracle by licensed buyers. That case was filed in Madras High Court but was not contested since it was withdrawn.

In the Trizetto case, Infosys has been involved in testing Trizetto software for Trizetto customers and was assisting both the customers and the Trizetto itself to resolve any implementation issues. Trizetto claims that in the process, Infosys developed a repository of its own test cases which was a violation of the agreement and misuse of the trade secret.

Trizetto claims that the repository created by Infosys includes some of the test cases created by Trizetto and are presented deceptively as Infosys test cases.

It is noted that the test cases are directly related to Trizetto software and any benefit that Infosys could gain is related to testing Trizetto software already sold by Trizetto to its customers for which Infosys has also created its own Test Cases. These Infosys developed test cases are used for the benefit of Trizetto Customers and hence Infosys is benefitting the customers of Trizetto though this is a commercial service for which Infosys has been charging its own fees.

It is not clear if Trizetto is feeling that its own commercial opportunity to charge for “Testing” has been eroded because Infosys is a competitor for the “Testing” business.

It is alleged that another software QNXT adapter was developed by Infosys which has used confidential and proprietary information of Trizetto to develop a competing product called Helix.

Presently the complaint will be evaluated by a Jury team and thereafter the outcome would be determined.

Considering that Infosys and Cognizant has relationship of over a decade and the manpower expertise of Infosys has also contributed to the growth of Cognizant, it is necessary that the business leaders of both companies sit together without their legal counsels and arrive at a business settlement. MeitY should urge both companies to settle the dispute under a mediation in India rather than going to US courts. I hope MeitY tries to appoint Mr Rajeev Chandrashekar to mediate in this issue.

Naavi

P.S: The dispute is a developing information and if there are any errors in the information provided from the public sources, kindly let me know so that it can be corrected.

One of the hallmarks of DGPSI (Digital Governance and Protection Standard of India) is that it recommends a “Process Based Approach” to compliance and an aggregation to arrive at the “Enterprise Level Compliance”.

In other words, the DGPMS (Digital Governance and Protection Management System) is an aggregation of Process1, Process 2 etc where process n refers to a technology process where applicable personal data is an input or a product of generation or is being stored, modified or disclosed.

One example of this approach, is the website compliance. In this approach, a “Corporate Website” is a process and Compliance as per DPDPA applies to personal data collected during the visit of a data principal to the website serving corporate information. The purpose of the website is serving of corporate information and the collection of personal data should be limited to the purpose, retained for the required purpose, secured during the purpose etc. DGPSI discourages use of “Omnibus Privacy Notices” and recommends process specific privacy notice and consent”.

Similarly, under this principle, AI enabled Data Analytics can be considered as a “PII Process” which requires to be compliant to DPDPA and can be assessed separately and certified for compliance.

DPDPA Compliance (DP.COM.) for AI Enabled Data Analytics can be a combination of “DP.COM for AI algorithm” used and “DP.COM for Data Analytics algorithm” used. AI itself can be defective due to BIAS and HALLUCINATION and along with Data Analytics, which may ignore notice and consent requirements and therefore, there could be doubling (Squaring) of the DPDPA risks.

During the last week’s ETCIO conference in Bengaluru, the presentations of many companies indicated an aggressive use of AI Enabled Data Analytics to draw different “Insights” into the behaviour of customers and for generating automated decisions that could persuade the customers of a service towards a desired objective of purchase on the e-commerce website.

While, as an ex-Marketing professional, I do agree that Business should have the ability to profile their customers and direct their marketing efforts to bring maximum customer satisfaction even on the “Post Purchase Experience”, as a Privacy an Data Protection professional, I am constrained to point out that a “Consent” is required from the customer before his personal data is collected deceptively and manipulated to conclude a sale.

It is not correct to only object “Data Subject Manipulation” when Cambridge Analytica uses personal data for creating ads for Election Campaign and ignore an e-Commerce entity make you buy things which you do not want.

When I pointed out that AI+Data Analytics has the negative intelligence probability, I was indicating that “Dark Patterns” and “Deceptive Marketing” is legally not allowed. This could become a non compliance issue and lead to DPDPA fines.

In this connection, I want to draw the attention of the audience on the Consumer Protection Act 2019 and the notification on Dark patterns issued on 30th November 2023 which states

“dark patterns” shall mean any practices or deceptive design pattern using user interface or user experience interactions on any platform that is designed to mislead or trick users to do something they originally did not intend or want to do, by subverting or impairing the consumer autonomy, decision making or choice, amounting to misleading advertisement or unfair trade practice or violation of consumer rights;

For details of the Consumer Protection Act and penalties refer here:

The rules also provide a list of practices that may be considered as “Dark Pattern Practices” which include “False Urgency”, “Basket sneaking”, “Confirm shaming”, “Forced action”, “Subscription trap”, “Interface interference”, “Bait and Switch”, “Drip Pricing”, “Disguised Advertisement”, “Nagging”, “Trick question”, “SaaS billing”, “Rogue Malware”, etc.

Under DPDPA 2023, the “Fiduciary” who is a trustee of the Data Principal is obligated to process the personal data only for a “lawful purpose”. The intention of the Consumer Act and the above rule is to indicate that it is not lawful to use “Dark Patterns” and it could lead to a penalty of upto Rs 250 crores under DPDPA.

I request all the Tech Experts to review the AI Enabled Data Analytics patterns used by them and check if they are not “impairing the consumer autonomy, decision making or choice and trick users to do something they originally did not intend doing.

DGPSI therefore recommends that there is a need to audit the use of AI enabled Data Analytics, and ensure that it is in compliance to DPDPA requirements. DGPSI also tecommends a specific policy for “Monetization” as well as “Discovery consent”.

I suggest that the interesting equation that ETCIO coined for their conference needs to be modified as

where i is the complex number representing the DPDPA impact.

(P.S: Sorry to use Complex Number theory in explaining the concept. Ignore if you want)

If you disagree, please let me know why? If you agree, please let me know how you are going to meet the compliance gap when DPDPA becomes effective whenever the Government notifies the date of effect for penalties.

Naavi

Today I came across an interesting observation related to Government Gazette Notifications issued in electronic form.

The notifications are signed by different officials of a department authorized to issue a direction. The PDF files issued as Gazette Notifications are however signed by an official such as “SURENDER MAHADASAM”.

The digital certificate is issued by (n)code Solutions CA 2014 valid at the time of signing and notes that Mr Surender Mahadasam is carrying an email surender.mahadasam@gov.in, Directorate of Printing, Government of India Press.

This practice of digitally signing the Gazette Notification by the publication department and not the original signatory of the electronic record raises an important legal issue of how the content of the electronic record may be considered authenticated.

It is my suggestion that the Publication department must add a certificate of assurance that

” I Certify that this is a faithful reproduction of a signed paper document with the authenticated signature of the relevant authorized person authorised to issue this notification and has been produced using the SOP…….. of the Department of Publications and may be considered as a True Copy”.

Though this certification may not exactly meet the Section 63 of BSA 2023, the SOP referred to which needs to be developed can contain narration that meets the requirements of Section 65B of IEA upto 30th June 2024 and Section 63 of BSA2023 there afterwards.

This procedure is directly related to Naavi63 certification suggested by the undersigned for validation of Consents under DPDPA 2023. (Refer Rule 2(1) (f) of the draft).

P.S: Naavi63 is a system where the online privacy notice confirmed by a data principal is authenticated by a repository owner (eg: CEAC Dropbox), though this is a private offering and not a Government function.

Comments invited from Cyber Law Specialists.

Naavi

DGPSI stands for Digital Governance and Protection Standard of India. It is designed as a framework for compliance for setting up DGPMS or Digital Governance and Protection Standard of India.

Just as we refer to ISMS in the context of ISO 27001, PIMS in the context of ISO 27701, DGPMS is the system that is built with DGPSI for the purpose of DPDPA Compliance by design.

DPDPA Compliance by design includes

a) Privacy by Design as required in India by DPDPA

b) Security by Design as required by ISO 27001 in respect of Personal Information to which DPDPA is applicable.

DGPSI is therefore a combination of PIMS for DPDPA and ISO27001 for PII under DPDPA.

DGPSI is built around 12 basic principles which form the foundation of the framework and comes in two flavours namely, DGPSI-Lite with 36 Model Implementation Specifications (MIS) for compliance of DPDPA 2023 and DGPSI-Full with 50 Model Implementation Specifications (MIS) which includes DPDPA 2023, ITA 2000 for PII and Draft BIS standard for Personal Data Governance.

MIS refers to the requirements that are suggested for implementation. DGPSI Lite is directly related to DPDPA provisions and hence is required to be implemented by all organizations that process Digital Personal Data for which DPDPA 2023 is applicable. We may refer to it as Applicable Personal Data or APD. All Data is not APD and all Personal Data is also not APD.

Flexibility in implementation of the MIS in respect of DGPSI Full is provided by the document “Deviation Justification Document” that is like the “Statement of acceptable Exclusions” and relates to the Statement of Applicability and Scoping in ISO 27001 framework. The Deviation Justification Document that is approved by the Management is considered as the “Implementation Charter” for the DPO for implementation of the DPDPA Compliance. The deviations are considered as “Accepted and Absorbed Risks” and to be also managed through appropriate Cyber Insurance covering first party and third party liabilities.

The Implementation Specifications that are part of the Implementation Charter is referred to as Adapted Implementation Specifications.(AIS)

At the time of third party audit, the auditor will evaluate the Deviation Justification Document and audit the implementation for a binary response of each of the implementation specifications.

For a maturity assessment of the implementation, implementation would be assessed over each of the 50 MIS assigning different acceptable scores which are weighted and aggregated for a consolidated score. For this purpose, the lowest acceptable score is assigned for the implementation specifications that are considered part of the approved deviation justification.

For the purpose of assigning the “Score” for each implementation specification, a scale will be adopted with different limits for “Policies and Procedures being established, “Technology Controls having been established” and “Organizational Culture and sustainability having been established”.

The consolidated score of an organization’s implementation is termed the “Data Trust Score” or DTS. The DTS will be assigned for every audit and reported to the management and the FDPPI as the audit certification agency. The Company is free to publish the DTS score at its discretion.

DGPSI therefore provides the three functionalities namely

1. Implementation Assistance
2. Third party certifiable audit
3. Assessment of maturity of implementation

The objective of this series of articles is to increase the awareness of DGPSI in the community and FDPPI would like to create a set of professionals who would be DGPSI Ambassadors who appreciate the nuances of DGPSI with reference to any other framework.

FDPPI is willing to fine tune the framework as required. The detailed implementation guidelines will be part of the responsibility of the auditors and the framework will only define the broad level of requirement for meeting the implementation. This preserves the scope for auditors to add their own value to the final implementation and certification and the customization required. For example a Privacy Notice under DPDPA developed for a Bank will be different from a Privacy Notice developed under DPDPA for a Hospital. This sort of customization cannot be built into the standards document and is left to the discretion of the auditor or implementation consultant.

At present Implementation Consultancy, as well as audit is considered as part of the common skills and until necessary, C.DPO.DA. will continue to be the Certification both for Implementation Expertise and Audit expertise. This may change in future and the two may be segregated into separate certifications like “Lead Implementor” and “Lead Assessor”.

Questions if any are welcome as we now go into the clarificatory mode for a few days.

Once this introduction is absorbed by the community, we shall go into specifics of the DGPSI Principles and MIS in subsequent articles.

Naavi

We recognize that India is in the cusp of a new era of DPDPA. Whether we like it or dislike it, whether we think Government is serious or not, the reality is that soon we will have a notification of the rules of DPDPA.

The CFO of an organization should be the first to raise his voice that a new Financial risk has appeared before the Company that needs to be “Mitigated” and “Covered”. He may not know how and request his CISO or CCO to suggest. The CEO has to therefore start a new discussion in the business war rooms on how DPDPA is likely to impact business and what actions are required to be initiated.

There will always be one voice in the Corporate War room which says, “The rules are yet to be notified… We shall wait…”.

This will be music to the ears of some who revel in “Procrastination” and are happy to work on short term goals for the next quarter. But those who have the long term vision, DPDPA 2023 is already the “Due Diligence” requirement under ITA 2000 and hence the compliance by date has already arrived.

The Government may eventually release the rules first fas a draft for public comments. It may first notify the requirements of setting up of DPB (Data Protection Board) so that it can be constituted before further operational rules that affect the industry directly in terms of compliance can be rolled out. Even after the operational rules are rolled out, there could be different timelines under which different rules may become effective.

The wiser companies have already had the first discussions at their Board level to start working on “DPDPA Gap Assessment” so that they will understand where they stand and how should they strategize their next moves.

The second stage is for companies to look out for guidance on how to proceed with the compliance of DPDPA and adopting an appropriate framework for compliance.

In this context DGPSI emerges as the beacon of light as the only framework exclusively stitched together for compliance of DPDPA 2023.

As the realization of what DGPSI is and how it helps a company to find the shore of compliance, dawns, strategy war rooms in companies will reverberate with the words “DGPSI” and DGPSI would become the “Corporate Mantra” for the emerging DPDPA Era.

P.S: We will explore DGPSI point by point through this series of articles.

Naavi