Naavi.org

One of the first things Companies look for in the Data Protection Bill is what is the cost of non compliance. It appears that the Government has been a little generous to the industry in this respect.

The first observation that we can make is that there is no “Criminal Punishment” specified in this Act. Earlier there was one section on “De-Anonymization” of anonymized information which had a criminal penalty. But any criminal penalty for contravention of DPDPA is well covered under ITA 2000 and hence there was no need to indicate the criminal punishment in this Act.

The purpose of this Act was to replace Section 43A and define “Reasonable Security Practices” more elaborately for the purpose of improving the compliance to nudge the industry to take pro-active measures to protect Personal Data. Even Protection of Non Personal Data under this Act was redundant as it stepped on the ITA 2000 provisions.

Hence it was a good move to restrict the penalties to the Civil liabilities and tag it only to contraventions of this Act  related to personal data.

The schedule of penalties are as given below:

It may be observed that the schedule avoids the “Percentage of Turnover” method which when applied would have been one additional ground for dispute.

Also penalty has been separately prescribed for not following the Reasonable Security Practice which causes a data breach from not notifying the data breach to the regulator and affected data principals or additional obligations of a Significant data fiduciary such as not appointing a DPO, Not Appointing a Data Auditor, Not conducting Data Protection Impact assessment.

The non compliance not leading to a data breach may be fined upto Rs 250 crores while a data breach may add another Rs 200 crores to the fine taking it to Rs 450 crores (maximum). In case of Significant Data Fiduciaries failing to implement additional measures, an additional Rs 150 crores may be imposed as penalty.

All Data Fiduciaries or Data Processors not fulfilling the additional obligations regarding minors may also face an additional Rs 200 crores as penalty.

Thus the maximum cumulative penalty per instance of an investigation of a data breach/non compliance  could have  added upto Rs 800 crores.  But section 25 puts a cap of Rs 500 crores.

The penalty for Data Fiduciary and Data Processor for non compliance are both similar and there is no concession to the Data Processor.

In comparison, if we look at the top 5 GDPR fines upto date they range from a maximum of Rs 6375 crores down to Rs 233 crores.  By capping the penalty at Rs 500 crores, the Government has been extremely fair and considerate and perhaps generous to the Tech industry.

The Data Protection Board will however have the discretion to apply other yardsticks to reduce the penalty. It is expected that initially the penalties may be lower and may be increased gradually as the compliance becomes more mature.

In extreme cases, the Data Protection Board may  apply the Maximum penalty limit of Rs 500 crores “per instance” by recognizing multiple instances of failure which may be in time or type of failures etc.

One way by which “Instances” can be segregated  and considered as “Multiple instances” could be when there was an opportunity for the organization to correct a breach incident and by lethargy or otherwise the organization procrastinated and a repetitive breach occurred. The immediate remedial action can assist the organization in containing the breach to a single instance.

It is time for CFOs to make provision of upto Rs 500 crores or cover it by Cyber Insurance so that at least the next breach risk is covered.

Naavi

Refer:

Views of the IT Minister

The drafting of  DPDA 2022 signifies an approach completely different from the drafting principles adopted earlier. It appears that an entirely different team worked on the Bill. It is not clear if the Ministry of Law would be comfortable with this draft since it appears to be “Over simplified” for the purpose of getting it through the Parliament. In the process a far too much has been set aside to be attended through the subordinated legislation of “Rules”.

All controversial aspects regarding the “Protection of the Right to Privacy by Law”, “Constitution of the Data Protection Board”, “Contours of Cross Border Data Transfer” or “Powers of the Government” have all been brushed under the carpet. But each on of them has to ultimately surface in the form of rules and I would not be surprised if each is contested repeatedly in the Supreme Court.

It is like a boxing match when a player ducks and sways to bide for his time and probably exhaust the opponent and strike back in later rounds. The approach appears to be, let us get the Bill passed for now and worry about the details later. But if the Boxing match has to go to 15 rounds, the ducking and swaying cannot be a winning strategy but only the punches that land on the opponent could be relevant.

In this draft of the Bill it appears that the Government thinks that it can get through  a proper legislation through the rules and it would be flexible. Partially this is true but it makes the task of DPB too onerous because it has to take the responsibility for subordinate legislation and push it through the Supreme Court.

There is a possibility that this could lead to a Judicial person being the head of DPB which  will seriously erode the functioning of the  Board. If a Judge is heading the Data Protection Board it may be judicially strong but operationally rigid.

Puritan Legal practitioners would definitely be unhappy with this over simplified version of the law. They would however be happy with the Judicial person heading the DPB. But this may be counter productive in the long run and lead to stagnation, procrastination, inefficiency and ultimately corruption.

The approach is consistent with the lack of conviction and inability to take the bull by its horn but is disappointing from the overall perspective.

We shall reserve our detailed comments for direct submission to the MeitY, but the red flags need to be raised to warn the Government that  this may not be a successful strategy but one that will haunt the Government in future with repeated legal challenges in the High Courts and Supreme Court.

Naavi

Previous Article:

DPDPB 2022-Simple,…Need to know basis…less scope for objections

The draft of DPDPB 2022 (Digital Personal Data Protection Bill 2022) has been very cleverly drafted by avoiding unnecessary details to give less scope for critics.

The Bill seems to adopt a principle that the Act needs to contain only the broad provisions and many of the details which were part of the earlier bill can be moved to the regulations after the Bill is passed.

Even the public comments to be received upto 17th December will be handled in confidence so that there will not be a disclosure of who suggested what. I would not be surprised if the Bill is passed in the December session of the Parliament itself without waiting upto the February session and the detailed regulations are presented during the February sessions. This is a good strategy to get the Bill moving.

One characteristic of the Bill that strikes the eye is its simplicity. There are only 30 sections instead of the earlier 99 sections. The IT community can feel happy that it is much easier to understand this law than the earlier versions or even the GDPR which had 98/99 sections/articles. The number of definitions have also been restricted to just 17 as against 40 in the previous Bill.

In the process of simplification, some vital aspects have been omitted and they need to be addressed through the subordinate regulations.

Some notable observations are that the definition of harm includes only “bodily harm” and omits “Psychological harm”. Perhaps “Body” should be interpreted as to include the “Mind” and the “Brain” and the definition can be extended to Psychological and Neurological harm as well.

The name as well as the provisions relate to “Digital Personal Data” and hence there may be a reason to feel that the protection of privacy as a fundamental right in oral and paper environment could be considered outside the law. Fortunately, the definition of electronic document used in ITA 2000 is wide and any paper document produced by the use of a computer (including a printer) can be considered as electronic document and brought under this law. Hence all documents processed through computers may be considered as part of this law.

The applicability clause has also been simplified without bringing in the confusion on Anonymised Personal Data.

In the data principal’s rights, the Right to Portability and Right to Forget have been omitted. This could cause some flutter but will be considered good for the industry. Along with the imposition of the duty on the data principal, frivolous complaints which are a bane in GDPR has been eliminated. This could be one of the biggest reliefs to the Data Fiduciaries.

The provision of “Deemed Consent” covers the legitimate interest of a Data Fiduciary and is similar to the previous provisions in PDPB 2019.

Significant Data Fiduciaries need to appoint an Independent Data Auditor but as of now there is no mention of Data Trust Score as a mandatory obligation. But the Auditor may perhaps use such a measurable parameter if he so decides.

The concept of “Privacy By Design” or “Privacy By Design Policy” is conspicuous by its absence though the obligation to be compliant remains.

The Significant Data Fiduciary would also be required to appoint a DPO based in India. Need for him being a Key Management Personnel has been removed but it has been indicated that he is responsible to the Board.

The provisions for transfer of data outside India have  been left to be handled by the “Adequacy” decision. Hence the controversy gets buried for the time being.

Similarly the exemptions claimed by the Government has been directly linked to the constitutional exemptions without going too much into the details so that another area of controversy is pushed to the background for the time being.

The Government retains the option to exempt some types of Data Fiduciaries and this can come in handy to provide exemptions to NGOs, Educational Institutions, Charities, Religious institutions etc if need be.

Another provision which was highly controversial earlier and has been skirted now in this draft is the constitution of the Data Protection Authority. The draft has announced that there will be a Data Protection Board which will handle the functions of the erstwhile Data Protection Authority. Again the details on its powers and functions are not included in the Bill. Even the “Code of Practice” mentioned in the erstwhile Section 50 is also absent. Hopefully many of these good things will be introduced through the regulations.

The maximum penalty is fixed at Rs 500 crores and there is no mention of any criminal punishments. The Schedule details 6 sub categories of penalties and penalties are designated as “Upto….” without percentage of turnover. In particular penalty in respect of data breach is upto Rs 200 cores while penalty for non compliance could be higher at Rs 250/-  crores. Probably in case of a data breach associated with security non compliance, the penalty could be applied for both. The maximum penalty may however be restricted to Rs 500 crores.

More analysis may follow. However it appears that the Government has ensured that there is very little scope for raising objections at this stage and we need to wait for the notifications to understand the complete implications.

(Comments welcome)

Naavi

Copy of the Act can be perused at www.dpdpa.in

The Government of India has released the draft Digital Personal Data Protection Bill 2022 for public comments.

The Ministry has invited feedback from the public on the draft Bill. The submissions will not be disclosed and held in fiduciary capacity, to enable persons submitting feedback to provide the same freely. No public disclosure of the submissions will be made.

The feedback on the draft bill in a chapter wise manner may be submitted here

The last date for submission is December 17, 2022

Copy of the Bill is available here

Copy of the explanatory Note is available here

Naavi

• (Continued from the previous article)

In the previous article,  we discussed the Oculus and how it is reportedly been designed to cause damage to the human brain. The device is fortunately not yet out in the market and Mr Palmer Luckey no longer works in Meta. But he has how own company and could very well develop this VR set on his own.

While Mr Palmer boasts that he is “Fascinated” by the possibility of bringing the Meta Verse person closer to the real person, if it is to cause damage to the physical person, then the idea is sinister.

To many this is very scary …so scary that they would like to keep themselves away from any VR. Who knows that there is no hidden explosive charge inside which can be triggered by an event in a Meta Verse event?

While people like us may like to push for the laws to control such devices, the public may be also worried that since VRs may be used by many children, the device can be used to cyber hypnotize the users to reveal financial details of their parents or other secrets with which another criminal attack can be launched on the person.

We cannot wish away that this is only a speculation. If people ccoudl create games like the Blue Whale to make children commit suicide, they will definitely use the VR to exploit the immersive experience to Cyber hypnotize the subject and steal information leading to further crimes.

I am also anticipating that terrorists would use it to brainwash members from the public and motivate them for lone wolf attacks.

If we watch the above video and read some of the comments, it is clear that there are many who seem to enjoy this kind of a device. They may be commenting in jest but the possibility that some of them could become agents of a kingpin is plausible.

In view of the above, I trust that Government of India will immediately place all VR sets under a system of “Licensing” based on a critical evaluation of the hardware at code level. The Meta Verse sites that could interact with the users of this kind of advanced VR sets should also be monitored on a continuous basis to ensure that there are no deep web sites that cause an “Immersive” experience to create criminals prowling in the society.

Time to act now…. Address a communication to the Indian Government to take note of this danger.

Naavi

Also Refer:

About Nervergear

I have been carrying on a crusade against Private Crypto Currencies such as Bitcoin for years and if anybody can say FTX crash was natural, I have the right to say so.

Money Control today carried an article titled “FTX Collapse: RBI has the last laugh on crypto. If you ignored Das’s warnings, the joke is on you”

I would like Money Control to also refer to the many articles in Naavi.org where I have called out even Money Control for promoting Bitcoins in the past.

See all the articles here

In my scathing attack , I have not spared any body including the media and Supreme Court.

Even today I consider Supreme Court as one of the biggest culprits for having blessed Bitcoins for reasons which only can be surmised.

One has to read this unique judgement to understand how a clever judgement can be written stating that one side wins but the other side takes the benefit. This “Bollywood Judgement” is a museum piece of a judgement which is written like a Bollywood script with heros , villains and climax etc.

In this case where a petitioner who was a Crypto Exchange challenged the decision of the Bank to freeze the account based on the RBI circular, the Court ordered that

“RBI is obliged to direct the Central Bank of India to defreeze the account and release the funds of the petitioner together with interest at the rate applicable.”

The consequences of this judgement was terrible. Technically the Supreme Court may justify its action. But morally it gave a clean chit to the operations of the Crypto Exchanges and painted RBI as in the wrong. Since then the transactions of Bitcoin increased and many more Indian investors were caught by the bug.

The Finance Ministry right from the days of Late Mr Arun Jaitely to the current day have been in favour of Bitcoin. The MCX went to the extent of publicly supporting Bitcoin to be included in the commodity trading and had I not called out their nefarious decision aloud, they would have colluded with the finance ministry and given a commodity status to Bitcoin by this time.

It was only the resistance of RBI and frequent warnings by Mr Shakti Kant Das which held back a decision in this regard. Even now there is an attempt to sneak in the Bitcoin (and other private crypto currencies) through the amended Data Protection Law or ITA 2000. But FTX incident should put a check on this attempt.

The CBDC introduced by RBI is for a different purpose and does not amount to validation of the Crypto Currencies like Bitcoins. It may make it even more difficult for the Bit Coin lovers to get a legal approval for the “Currency of the criminals and the corrupt”

I therefore consider that the FTX incident is a welcome development that prevents more damage to our economy through the crypto currencies. While I regret the loss suffered by the innocent investors, they should have seen it coming since the entire eco system of Bitcoins was created and run by criminally minded persons who were fugitives of taxation law in their respective countries.

I had participated in the first Bitcoin conference in India and was enamoured by the technology and even stated that legally it can be acceptable in India through the ITA 2000. Even some RBI officials were present during the conference as observers.  But when I tried to reason with the Bitcoin syndicate that they should align with a law compliant system, I found out that they had no intentions of working within the legal environment and it was thereafter that I started my crusade against Bitcoin.

Our war against Private Cryptos is not over until the Government comes up with a suitable legal provision to declare transactions related to Private Crypto Currencies as “Money Laundering” and start taking penal action. Now we will only be going with the presumption that Bitcoin is not legal but what we need is  to treat it as a punishable crime to deal with or promote private crypto currencies in any form. Work on this is pending.

Naavi