Naavi.org

In many of my recent discussions with experts on the role of “Consent manager” under DPDPA 2023, I have encountered a view that the role of a consent manager under DPDPA is similar to what is envisaged under the Data Empowerment and Protection Architecture (DEPA) which has been adopted by RBI in the Account Aggregator scheme.

With the advent of DPDPA 2023, there is a need to understand the differences and distinguish two types of consent managers one under DEPA and another under DPDPA.

MeitY is presently framing the rules, and it is possible that they may simply import the DEPA architecture of Consent Manager into the DPDPA.

However, we need to debate if this is desirable.

If both DEPA Consent Manager and DPDPA Consent Manager are similar, in my view we may be losing an opportunity to create a new genre of Data Fiduciaries which would enrich the Data Protection eco system in India and elsewhere.

It has been difficult to convince professionals that DPDPA is different and perhaps better than GDPR. In the sameway, it is difficult to convince people that Consent Manager under DPDPA can be different and better than the Consent Manager under the DEPA framework.

I will try to put up my arguments in this regard in this article but agree that more debate is required to accept that there can be an innovative way of implementing the “Consent Manager” system under DPDPA.

If however MeitY wants to give it a miss, and decide to adopt the DEPA architecture in full, we can only say, it would be disappointing.

---

The Consent Manager under DPDPA can be of great help in the Indian scenario since the data principals may be unable to appreciate the nuances of Privacy as a Right and can be easily manipulated by smart data fiduciaries to extract information which is not required for a given purpose.

The difficulties of consent fatigue and language can also be overcome with the Consent Manager system if it is structured not in the mould of how it is used in the Account Aggregators but in the mould of the “Certifying Authorities” in the Electronic Signature under ITA 2000 where a combination of a Certifying authority and a registration authority can effectively maintain close customer contact along with management of technical challenges.

In the DPDPA scenario there are thousands of data fiduciaries including mobile app providers who will be seeking consent from the data principals. The purposes for which the personal information is sought are relatively innumerable as compared to the AA scenario. Each Consent artefact under DPDPA would have to be therefore customized to the purpose and linked to a process.

A Data Fiduciary may not be able to obtain one consolidated Consent for all the purposes for which the personal data of an individual can be used. Such an effort would defeat the “Data Minimisation” and “Data Retention” principles of Privacy.

We must appreciate that a Data Fiduciary may use multiple processes in which personal data is processed and the purpose of processing may vary from purpose to purpose. In process A, he may be a Data Fiduciary with all the responsibilities of compliance under DPDPA. In another Process B he may be Data Processor and not have the responsibilities of a Data Fiduciary. In yet another Process C, he may be a Joint Data Fiduciary sharing the responsibilities with another data fiduciary. In a certain process he may be a Significant Data Fiduciary while in several other processes he may not have the processing of high volume of sensitive data that makes him liable as a “Significant Data Fiduciary” with additional obligations.

In a traditional approach, if any one process of an organization qualifies as an activity of a “Significant Data Fiduciary”, then the entire activity of the organization becomes a Significant Data Fiduciary (SDF).

The question we need to raise is ..

Is it necessary to define the role of an organization based on the single SDF activity or segregate the activities by process so that there could be a more efficient compliance.

It is for this reason that the consent artefact for DPDPA cannot be standardised as easily as it is being attempted in the Account Aggregator (AA) eco system.

The following diagram provides a rough indication of this “Process Centric Consent” required under DPDPA with different artefacts for different consents.

We must note that DEPA was envisioned before DPDPA 2023 came into existence and its objective was to enable smooth flow of information from the data provider to data requester. . DEPA was not created for protection of Privacy as per the law.

The objective of Consent Manager under DPDPA 2023 is however different. DPDPA applies only for digital personal data and the objective of “Consent Manager” under DPDPA is to establish a legal basis for processing as per Section of DPDPA 2023.

Section 6 of DPDPA 2023 states :

The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.

Each Consent in DPDPA is a contract and it is customised to a specific purpose.

The definition of “Consent Manager” as it evolves from Section 6 of DPDPA 2023 suggests that the MeitY may provide a detailed guideline on the consent manager in its rules to be notified. Going by the Act,

 “The Consent Manager shall be accountable to the Data Principal and shall act on his/her behalf in such manner and subject to such obligations as may be prescribed and Every Consent Manager shall be registered with the Board in such manner and subject to such technical, operational, financial and other conditions as may be prescribed.”

The scheme under DEPA is a technology platform that empowers to seamlessly and securely access their data and share it with third party institutions. Design guidelines have been provided by RBI at sahamati.org.in calling “account Aggregators” as the “Future of Data Sharing”.

The above diagram released by Niti Ayog indicates that the information providers are institutions like the Banks, Insurance Providers or Taxation entities. It indicates that the information users request the information from the consent manager who gets a consent from the data principal the permission to request the information providing institutions and collect the required information from them and forward it to the information requesting entity.

This is the broad framework architecture provided. This framework has been designed to ensure that the “User” who is the data principal under DPDPA 2023 is able to provide consent whenever a request for data is submitted.

DEPA Objective is oriented towards the Data Users and not the Data Principals. While attempt can be made to fit DEPA framework to DPDPA, it would not be a perfect fit.

The RBI has come up with its own “Master Directions” for Account Aggregators which follows the DEPA.

I have tried to look at some of the terms of service and privacy policies posted by the 14 account aggregators mentioned in the sahamati.org in in website (Agya Technologies Private Limited, CAMS, Finvu, CDigio Internet, Finsec AA solutions, NADL, , Protean, Perfios, PhonePe, Tally, UnaCores, Yodlee) to understand how the registered account aggregators have implemented the guidelines from the DPDPA perspective.

Needless to say that the policies are yet to be updated, some additional points can be observed in the activities of these account aggregators.

The key aspect of the framework is what is the “Consent” artefact used by the consent manager to request permission from the user and where from the information is provided.

The consent artefact suggested by RBI includes the following information.

1. identity of the customer and optional contact information;
2. the nature of the financial information requested;
3. purpose of collecting such information;
4. the identity of the recipients of the information, if any;
5. URL or other address to which notification needs to be sent every time the consent artefact is used to access information
6. Consent creation date, expiry date, identity and signature/ digital signature of the Account Aggregator; and
7. any other attribute as may be prescribed by the Bank.

This artefact indicates that it is a “Purpose oriented” consent and “recipient specific consent”. It means that as and when the request is received from a data requester, based on the purpose the consent should be obtained along with from whom the said information has to be collected.

The advantage of this approach is that the data principal keeps the control over the provision of consent with himself for each consent request.

However this appears to serve the purpose of only enabling automatic filling up of a consent request form and nothing else. It does not add any other value to the process and does not relieve the data principal from the burden of deciding about the different permissions sought.

A similar process is used by the E-Sign Certifying Authorities to receive E-KYC confirmation based on Aadhaar. Just to avoid the use of Aadhaar based information verification system, DEPA seems to have decided that information request goes through the Consent Manager. Otherwise a similar system of E-Aadhar information verification with a few additional fields to which the data provider can respond could have sufficed.

If “Virtual Aadhaar” is considered as “Not Aadhaar”, Supreme Court could have been requested to modify its order and allow use of “Virtual Adhaar” for the data subject to request for authentication cum provision of data to the data requester without the need of a DEPA Consent Manager.

In the AA system, the content of the data passes through the Consent Manager though he is not expected to store the same. Though the Consent Manager is not expected to view the data, the system envisages that the data provider sends a digitally signed set of data which has to be passed on to the data requester. Data therefore lands on the systems of the consent manager and technically there is access to the information by the consent manager.

While studying each of the Terms and Privacy Policies of different Account Aggregators would be a separate exercise, it appears that AAs may be retaining visibility to the personal data of the users and are not acting only as pure technical intermediaries. The RBI’s master directions for AAs also may be interpreted as providing a permission to the sharing of the user’s financial information provided by the providers to the aggregators and by the aggregators to the data requesters and in the process provide access to data to the consent managers,

Now that DPDPA is present as a law, and AA would be a data fiduciary, it would be better if the AA model of consent management is suitably modified and merged with the DPDPA model.

On the other hand, the DPDPA 2023 also has the option of adopting the Account Aggregator framework into its recommended consent manager rules and make the consent manager under DEPA just an intermediary under ITA 2000.

At present it appears that MeitY may yield to RBI and adopt the DEPA model of Consent Manager also as the DPDPA model.

I would like MeitY to take a different approach.

There is now an opportunity to define the DPDPA model of Consent Manager to provide a greater role to the consent manager than the AA model.

The data principals’ of DPDPA 2023 need the expertise of a “Consent Manager” to evaluate the different permission requests of data fiduciaries and provide guidance to the data principal on which of the permission requests to accept and which to reject. They can also provide some kind of checks on the data fiduciaries to ensure that they act responsibly. They can also provide support for withdrawal of consent if required.

In this system the consent manager can provide value added services such as de-identification, pseudonymization and anonymisation and filter the disclosure requests by evaluating the purpose of the request and putting its foot down when excess permissions are sought.

This will relieve the data principal from evaluating the consent permissions and take a decision on what is legitimate and what is not.

In my view this will be a necessary value addition to the service of the Consent Manager who will act as a trusted repository of personal data of its clients, white-list and black-list data fiduciaries on the basis of his expert evaluation of the privacy practices of the data fiduciaries (He may use such criteria as Data Trust Score, audit certifications etc for evaluation), watch the environmental scenario to observe changing profile of risks and initiate withdrawal of consent when required etc.

In case this suggestion can be debated further, we will be able to create an innovative business proposition which enables evolved entities to create a Privacy Secure Consent Manager services and bring a difference to the Indian data protection ec0system compared to the international standards of privacy management.

INVITE COMMENTS

Naavi

Intellectual Property created out of the IPR laws and Personal Data as a property recognized out of a law like DPDPA has some interesting relationship.

IPR is associated with an author or an inventor and hence by default discloses the owner’s personal information. Personal Data as a property is a right of the data subject and the disclosure may be subject to the condition that it is held anonymous.

IPR transfer from one person to another is fairly well understood and a licensing mechanism works to ensure that the multiple sequential owners can exercise their rights and derive return on investment over their contribution to the value life cycle of the product.

On the other hand, the transfer of rights in Personal Data is as yet not mature. When X creates a profile document or a medical report or a financial report about P, while X can claim IPR on the creation of the intellectual property such as the profile or the report, the right of ownership may be claimed by the data subject. The creator of the Intellectual property may not have the right to disclose or distribute or use the creation unless the consent at the time of providing of the personal information permits such use.

In many cases the “Profile” or a “Report” represents a “discovery” of use and the consent mechanism except under a forward looking framework like DGPSI may not cover the new uses that the report generator can find.

Thus laws such as GDPR or DPDPA need to develop in such a manner that the IPR of the Data Fiduciary is properly recognized even for the purpose of “Monetization”.

This debate will be taken into the World Intellectual Property Forum annual convention which is happening at Bangalore.

At a time the MeitY is finalizing the rules to be notified under DPDPA 2023, we need to flag some of the erroneous practices of e-mail providers and domain name registrants that gives raise to Cyber Security concerns under the false pretext of “Privacy”.

It is well known that WhoIs data of domain name registrants are mostly blocked under the pretext of “Privacy” which prevents or at least delays any investigation about cyber crimes committed with the use of fraudulent domain names.

Similarly e-mail providers donot reveal the originating IP address and substitute it with a proxy IP address. As a result any investigation requires the service provider such as GMail to be contacted for knowing the originating IP address. The service provider in such circumstances refuses to provide the information and a long legal process making the service provider liable under Section 79 of ITA 2000, is involved to get the details.

The e-mail service providers also quote “Privacy” as a reason for withholding the information.

We need to point out that “WhoIs” information is about maintaining a domain name visible to the public and posting content of any type which includes legal and illegal activities. This is not involving “Personal” activity and has to be classified as a “Publishing” activity and a “Business”. As a result the concept of “Privacy” of an individual under the “Right to Privacy as a fundamental Right” does not apply to domain name registration service.

Hence MeitY has to declare that all Domain Name Registrars are “Intermediaries” under ITA 2000 and the practice of hiding the name and address of registrants is unacceptable. Further, registration of any domain name under a false name is an act of “Impersonation” which violates ITA 2000 as well as the DPDPA 2023 and hence makes the registrar liable for any crimes committed with the publication.

As a part of “Due Diligence” of Domain Name registrars, Government should introduce a notification declaring that the registrars are required to verify the e-mail address and mobile number of the Registrant, Admin and Technical contact of every registered domain name. In the event that any of the details provided are “False” and the fact is brought to the notice of the registrar, the domain name must be immediately notified for de-activation within 48 hours and if no response comes forth from the registrar or the registrant/admin contact of the domain, the domain activity must be suspended.

Similarly, service providers like Gmail need to accept that the “Recipient” of an e-mail particularly if he is also using the gmail ID, is a customer of Google and if a sender of an e-mail is a fraudulent person or a terrorist, Gmail has no business to assist such fraudster or terrorist to hide his originating IP address and use the services in a manner which is considered as an “Offence”.

Hence under the Section 79 due diligence, MeitY has to issue a notice to Google that for all gmail recipients, Gmail should either drop the substitution of the originating IP address or introduce a one click access to the originating IP address from the menu bar of the e-mail inbox.

The same procedure should be made mandatory to all e-mail service providers including the Proton mail and other service providers who are assisting Criminal syndicates around the world to commit Cyber Crimes with impunity. Service providers like Protonmail as well as Topmail which served terror threat emails to Bangalore schools recently must be declared as “Terror Abettors” and charged accordingly under terrorist acts. Such services need to be black listed and blocked under Section 69 of ITA 2000.

There is no “Free Speech” rights for either the criminals who use E-mail as a tool of threat and a tool of spreading fear in the community with bomb threats under a fake ID and this must be made known to all the service providers.

India being a country ruled by Supreme Court, any directions in this regard by Meity as an executive wing of Governance or even the Parliament as a legislative wing of Governance under the Constitution, will be challenged in the Supreme Court. Hence, in the end it would be the responsibility of the Supreme Court to determine what is more important…the rights of a criminal or the rights of a victim/potential victim of a cyber crime. Let the Supreme Court take the responsibility for prevention of Cyber Crimes on its decision.

It is unfortunate that the law enforcement often does not initiate action against e-mail service providers and it emboldens them to indulge in such activities and claim protection under “Privacy”.

After the recent CERT IN Guidelines, many of the VPN service providers who did not want to abide by the Indian laws have moved out of India. This is more a loss to them though it is also a small irritant to many genuine users of the service.

India today has services such as e-mail and chat services such as LegerMail or LedgerChat that are a replacement of G mail and WhatsApp providing both security and privacy and more such service providers will come in India to replace Proton mail and others who are “Law Compliant secure email providers”.

The suggestions made here on invoking ITA 2000/DPDPA 2023 also may raise some objections including from Google/Gmail who are perhaps drafting the DPDPA 2023 rules on behalf of the Meity in the backrooms, but in the interest of Cyber Security of India, Government must introduce the recommended measures.

I request the MeitY/CERT-IN and NiXi to take the necessary measures.

Naavi

CBI has successfully investigated a fraud in UCO Bank where two support engineers manipulated the system which resulted in credits to accounts without a corresponding transfer of money from the sending bank to the receiving bank.

See report in NewIndian Express

The fraud involved 8.53 lakh transactions resulting in credit to the accounts of customers. Some of them either knowingly or unknowingly withdrew the amount. Most of the amount has since been recovered.

However the incident which could be a sophisticated fraud or a technical glitch needs to be taken seriously by security experts and remedial measures are required to be taken.nt.

If the fraudsters had later withdrew the money and transferred it into the fraudster’s account as it happens in many phishing credits, the account holder would be accused of money laundering and his account would be frozen even if the balance is more than the disputed amount. In many such instances, innovent customers are left with frozen accounts for reasons they are not aware of.

One reason why even genuine customers may not be able to recognize the wrong credit is because today’s technology bankers donot provide full description of the transactions in the account. They only provide a transaction code which only they can decypher. It is important that as in the manual banking era, the description of credit has to indicate the source account number and name of the sender along with any purpose indicated by him all of which are captured at the sender’s end.

The least the Banks can do is to ensure that if the recipient clicks on the credit entry, the transaction ID should be deciphered and the details provided without the need to raise any help ticket.

RBI should work on this technology change to prevent blaming the genuine customers who without knowing the nature of the false credit may withdraw the money in due course.

I request REBIT to work on this updation of Banking software in consultation with the CBS software developers.

This incident falls within the “Jago Regulator Jago” campaign that we are highlighting since it has become a fashion to introduce technology with inadequate securities and then blame the public for the consequences.

It is an established principle of law that if the Bank customer has innocently altered his position with the knowledge of the balance in his passbook, the money can only be recovered without coercion. If the amount is in several lakhs it may be possible for the customer to realize that it was an erroneous credit. But if it is in few thousands, many customers may not think it is a wrong credit. They may think that it may be an arrears of pension or some thing similar. Hence it would be wrong to blame them for misappropriation if they have withdrawn the balance. In such cases thee “Negligence” of the Bank should be punished. If any account has been frozen in such cases, compensation should be paid to the customer for inconveniencing him.

If any cheques are dishonoured in the process, it has to be considered as “Wrongful Dishonour” and Bank should pay compensation.

Hope RBI makes necessary changes in this regard to the Account rules.

Naavi

DPDPA 2023 has introduced “Nomination” as a right of a data principal. We have in our two previous articles discussed certain aspects of nomination.

Why Privacy cannot survive the death of an individual?

Relationship between IPR and Privacy

It is now observed that “Digi Locker” has already introduced the system of “Nomination” for its application. While the Digi Locker mobile has a “privacy Policy” which does not seem to have been updated since March 14, 2017, but refers mostly to the Digit Locker portal, the privacy policy on the website is undated . There is no reference to the “Nomination” in the Privacy Policy or the Terms and Conditions. However,nomination has been introduced as a new link in the App some time back.

The nomination link leads to a form which collects the Name, e Mail address, Mobile number and the Aadhaar number of the nominee.

Digilocker being an entity of the MeitY, this method may be considered as a “Precedence” for other Data Fiduciaries to collect nomination.

This however raises two issues.

Firstly the issue is whether Digi Locker should have provided for collection of Virtual Aadhaar number instead of original Aadhaar number .

Secondly like in the True Caller case, it is a moot point whether the Digi Locker owner/registrant has the right to disclose the aadhar number of the nominee. Possibility of stretching the non applicability clause in DPDPA 2023 for “Personal Domestic use” to the declaration of the nominee’s information is also a matter to be explored.

It is noted that there is no notice to the nominee that he is being designated as the nominee and that his personal information has been provided to Digi Locker. There is not even a request for OTP from the nominee so that he remains informed.

Under DGPSI, if a similar system has to be introduced, it is recommended that only the e-mail and mobile number of the nominee may be collected and the request for Virtual Aadhaar has to be sent by Digilocker directly to the nominee. The disclosure of the e-mail address or mobile number is less sensitive and the notice may perhaps be considered as a reasonable compliance to the use of these identity parameters.

A better technical method would be for enabling a real time check for permission to be recorded as a nominee at the time of registering the nomination through an API which can be initiated by the registrant without revealing the email address or mobile number to the service provider. On receipt of permission, the service provider may initiate the identity verification process by directly contacting the nominee for the virtual aadhaar or any other means such as the OTP. In the meantime the nomination request may be kept pending.

A sample nomination form has been created for FDPPI which incorporates the definition of the role of a Nominee and his relationship with FDPPI. This is an important Jurisprudential observation and open for debate .

(Comments welcome)

Naavi

One of the requirements of DPDPA 2023 as a law of Digital Personal Data Compliance is that Personal Data shall be processed only for lawful purpose. Hence it is a compliance requirement that a Data Fiduciary shall adopt necessary measures to ensure that all their employees remember that “Making Profits” is only a goal secondary to “Being Lawful”.

In terms of compliance the Board should establish the norm through a resolution mandating DPDPA 2023 compliance that the organization shall take such measures as are required to be compliant with all laws of the land in their activities.

At the operational level, the compliance specification would require that all “Project Managers” who prepare new project proposals whether in Business, R&D, Finance etc., shall add an assurance that the “Project proposal is within legal boundaries of all applicable laws”.

For this purpose adherence to laws such as the ITA 2000 becomes mandatory for compliance of DPDPA 2023. If the new IPC (Bharatiya Nyaaya Sanhita 2023) or Telecom Act or the new Evidence Act (Bharatiya Nyaaya Adhiniyam) has any provisions applicable to Digital personal data, they shall also be complied with as part of DPDPA 2023 compliance.

Naavi