Karnataka Government declares Uber/Ola Autos illegal… A Wrong Decision

Karnataka Government has repeatedly taken wrong decisions related to the Uber/Ola service. In 2014, I had written about this in the following article.

Government Fails to understand Uber Business Model

Time has come again to point out once again that Karnataka Government is taking another bad decision in trying to declare Uber-Ola aggregation service illegal.

See report here

We the senior citizens of Bangalore are aware of how the Autos in Bangalore have operated from times immemorial with hard bargaining. No auto trip ever ended without a serious argument at  the end of the journey with the driver demanding more and we refusing to pay more than the meter.  Those were the days when Taxis were never in contention for the middle class.

The advent of Uber/Ola as app aggregators brought relief to this BP raising arguments with the auto drivers and many switched to travelling by taxis which were cheaper than the “Pay Double” demand of the auto drivers.

Karnataka Government then interfered and declared Uber/Ola as “Taxi Operators” and made the technology service more complicated and expensive. The JDS as a political party also contributed to this move besides the greed for more tax collection.

In the recent days, the “Surge Pricing” by Uber/Ola had made the  taxi service once again unaffordable. Our trips from South Bangalore to Airport which used to cost Rs 700/- now have reached Rs 1200/-. The discredit for this inflation has to go to the ill-advised move of the Government.

Now as people started to switch from Uber cars to Uber autos as an alternative to non availability and higher cost of cars, the Government has again poked its nose to ban Uber/Ola autos.

The ostensible reason is that there are complaints about a minimum charge of Rs 100/- as against Rs 30/- fixed by the Government. The solution to this is not banning the Uber/Ola autos but to understand and rectify the issue.

For Consumers if they want to travel a short distance, they need to stand by the road and run behind autos …and beg them to come to their  destination. Even if they agree no auto comes for a short distance on meter. Will the Karnataka Government control this?

On the other hand what happened in the aggregation was depending on the destination, the willing auto would respond and come to the door step. This avoided the need to wait at road ends, send an errand boy to fetch the auto to the door step and the endless argument on how much above the meter one has to pay.

Many times the lack of argument itself is a premium for the service.

The Uber/Ola is an add on service which is optional. A consumer still has the right to stand at the street corner, locate an auto for short distance at a minimum rate of R 30/-.

If he choses the Uber/Ola, he is exercising his choice for a higher grade of service and transparently making a payment.

What needs to be regulated is that Uber/Ola does not appropriate the premium entirely and ensure that the auto driver is equally benefitted.

If more consumers chose the app aggregator, more autos opt for registration, and many respectable persons who run autos can operate independently out of the control of the Autoriksha associations which have the potential to become political groups as we have seen in Chennai.

Think of a house which is 100 meters from the main road and old people or people with luggage to catch autos. Will they prefer bargaining for Rs 30/- or be prepared to pay Rs 100?

Technically also, we should reverse the Government decision to consider App aggregators as Taxi Service and consider them only a “Technology Service”.  Treat them fairly , let them make money out of their service, let them not exploit the drivers and leave the discretion to use or not use the service to the consumers.

I wish the Government order is either withdrawn or a stay is brought on its operation.

We can discuss the regulation where by the practice of the aggregator charging 30% or more of the trip money is reduced to a maximum of 15%. This will increase the revenue of the taxi and auto operators. In the initial days, the charges for Autos was actual meter charges plus Rs 10/- as service fee. If Rs 10/- is too low, it can be raised to Rs 20/-.

If surge pricing is allowed, 75% of the surge should be payable to the driver.

Over and above these regulations, it can be also mandated that charge beyond a limit should be credited as “Cash back coupons” that can be encashed like loyalty coupons within the next 3 months. Some of these may lapse but otherwise it may guarantee further business to the aggregator and hence the scheme should be acceptable.

At present therefore, I urge the Karnataka Government to withdraw the order on banning Uber/Ola auto, which is anti-consumer and will not  be liked by the citizens of Bangalore who have to vote for BJP in the upcoming BBMP election when there is no Modi factor influencing the voting decision.

For the medium and long term we can discuss what kind of monitoring can be brought in to reduce the exploitation of the drivers by the app aggregators

Government should encourage competing app like Myn or encourage Tata Neu to start a new vertical or use the ONDC platform  and recommend drivers to register with them. If these apps donot turn rogue like Uber/Ola and agree to follow the regulations such as

  1. Sharing 85% of fare with drivers for normal charge
  2. Sharing 75% of surge pricing with drivers
  3. Submitting to an audit by a regulatory agency and committing to a regime of penalties

then there will be a win-win situation for the citizens and the drivers.

I request honourable MP Mr Tejasvi Surya to consider these suggestions.

Naavi

 

 

Posted in Cyber Law | Leave a comment

As FDPPI looks out for a CEO, Maslow’s motivational theory provides a guide.

Abraham Harold Maslow is a great thinker of our generation who in 1942 gave a theory of motivation based on a hierarchy of needs.

His work has been of great assistance to  Corporate Managers to understand human behaviour and improve their managerial capabilities.

He continued to work in this field and updated this thoughts  (Refer here) and expanded the original 5 step hierarchy to eight steps. He also agreed that the different aspects of motivation may follow flexible hierarchy in some individuals and often worked as a mix.

Maslow’s theory suggested that humans are motivated by the fulfilment of their desires in five levels from physiological needs, to safety needs, to love and belonging needs, esteem needs and self-actualization needs.

Typically what this translates to is that employees are initially motivated by salary and remuneration but once satisfied, they cease to be motivators.  Security of job, Love and belonging follow as next level of needs that motivate them. Then they look for designations and rewards to satisfy their “Esteem”  until they reach a level of “Self-Actualization” where they get motivated by their own pursuit of excellence.

In our eternal search for motivation, Naavi propounded his own “Theory of Information  Security Motivation” (TISM) where it was suggested that the elements of motivation are better organized  in a close loop than a hierarchical pyramid.

In this model, Naavi suggested that for motivating the employees for adopting a security culture, a “Pentagon Model” with five needs namely Awareness, Acceptance, Availability, Mandate and Inspiration could be considered as a better fit but not as a pyramid of hierarchical levels but as a closed loop.

The principle of closed loop was that all the requirements formed a boundary and it should be closed so that their is no leakage.

Now Maslow has expanded the levels of motivation from 5 to eight  by adding  “Cognitive”  “Aesthetic”  and  “Transcendence” levels as indicated below. We shall not go into the detailed analysis of this theory, we can note an important grouping of “Deficiency Needs” and “Growth Needs”. The “Deficiency Needs” are those where after fulfilment, the motivation decreases. In “Growth Needs”, motivation increases  as the needs are met.

In a way this bridges the gap between Maslow’s theory and Herzberg’s theory of “Hygiene factors” and “Motivational factors” which also holds some value.

Service oriented organizations like FDPPI have been looking for a CEO of late and in this context taking a re-look at Maslow’s Theory to understand what kind of a person would suit to be a CEO of FDPPI appeared interesting. (These discussions may also help Start Up ventures to select a CEO)

Obviously, a Start-up like FDPPI cannot afford to pay a salary which an individual deserves to make by comparison. If the world consists of only persons who can be motivated by salary, and the person with the right credentials of experience and skill is still at this level, it would be difficult to find a motivated person for the position.  Fortunately the world also consists of many others who work for “Self Actualization” and are motivated by other aspects of performance.

According to experts, the characteristics of self-actualized people consist of the following:

1. They perceive reality efficiently and can tolerate uncertainty;

2. Accept themselves and others for what they are;

3. Spontaneous in thought and action;

4. Problem-centered (not self-centered);

5. Unusual sense of humor;

6. Able to look at life objectively;

7. Highly creative;

8. Resistant to enculturation, but not purposely unconventional;

9. Concerned for the welfare of humanity;

10. Capable of deep appreciation of basic life-experience;

11. Establish deep satisfying interpersonal relationships with a few people;

12. Peak experiences;

13. Need for privacy;

14. Democratic attitudes;

15. Strong moral/ethical standards.

The behaviour that leads to self-actualization is identified as follows:

(a) Experiencing life like a child, with full absorption and concentration;

(b) Trying new things instead of sticking to safe paths;

(c) Listening to your own feelings in evaluating experiences instead of the voice of tradition, authority or the majority;

(d) Avoiding pretense (‘game playing’) and being honest;

(e) Being prepared to be unpopular if your views do not coincide with those of the majority;

(f) Taking responsibility and working hard;

(g) Trying to identify your defenses and having the courage to give them up.

We may add here that self-actualization is considered a matter of degree, ‘There are no perfect human beings’. It is not necessary to display all 15 characteristics to become self-actualized, and not only self-actualized people will display them.

Maslow did not equate self-actualization with perfection. Self-actualization merely involves achieving one’s potential. Thus, someone can be silly, wasteful, vain and impolite, and still self-actualize. Less than two percent of the population achieve self-actualization.

FDPPI is looking for some body in this 2% who can take over the role of a “CEO of FDPPI” not necessarily as a philanthropic assignment but on a predominantly “Variable remuneration ” basis.

The first thought that may cross many minds is that this is a utopian thought and how can some body work full time without a fixed salary?. But a person with the confidence of building an organization generate revenue and share in the prosperity can consider the challenge at least as a one year contract.

Naavi looks forward  to proposals from interested persons with experience, skill and attitude to lead the next phase of development of FDPPI.

Naavi

Posted in Cyber Law | Leave a comment

Telecom Bill and WhatsApp: Will the Court uphold the rights of 130 crore Indians for Security?

WhatsApp has been in Supreme Court to test it’s Privacy Policy which it intends to impose on Indian users which is less protective of privacy compared to their EU policy and imposes the US jurisdiction on Indians. WhatsApp has also opposed the “Intermediary Guidelines” in the past about identification of originators of some offensive messages.

Recently however, WhatsApp is also reported to have deleted 23 lakh accounts in India in the month of August in compliance with the new IT rules 2021. A similar number of accounts were also reportedly deleted in the previous month. With the total number of nearly 500 million users, the monthly deletion comes to about 0.5%. Most of these deletions could also be due to the detection of robotic fake accounts and also because of specific complaints where by some groups might have been deleted with all the accounts of their members.

In this frequent series of skirmishes between WhatsApp and the Government, the new frontier now is the draft Telecom bill

Now looking at the Draft Telecom Bill available for public comments, one most debated clause is the inclusion of OTT and Messaging platforms in the definition of Telecommunication Services/Service Providers.

The draft Bill defines telecom services as follows:

“telecommunication services” means service of any description (including  broadcasting services, electronic mail, voice mail, voice, video and data communication services, audiotex services, videotex services, fixed and mobile services, internet and broadband services, satellite based communication services, internet based communication services, in-flight and maritime connectivity services, interpersonal communications services, machine to machine communication services, over-the-top (OTT) communication services which is made available to users by telecommunication, and includes any other service that the Central Government may notify to be telecommunication services;

An interesting provision that adds to the above is that

“Any entity which is granted a license under sub-clause (2) of Section 3, shall unequivocally identify the person to whom it provides services, through a verifiable mode of identification as may be prescribed.”

“The identity of a person sending a message using telecommunication services shall be available to the user receiving such message, in such form as may be prescribed, unless specified otherwise by the Central Government.”

We suppose the Government may exempt organizations  below a particular size in terms of turn over or  number of subscribers on the lines of the definition of ” Significant Social Media Intermediaries” used in ITA 2000,  from the provisions of licensing and some of the regulations.

But WhatsApp as well as G Mail will come under these provisions and will need  to hold the information on the  real identity of the subscriber and display it  to the  receiver (automatically or on request) like the “Caller  ID Display” in mobile  communication.

While these provisions are a  strong measure to  tackle “Spam” and “Phishing”  they may be  opposed by the  Big Tech Companies.

We expect that along with the debate on WhatsApp privacy Policy these aspects of jurisdiction of India on WhatsApp and the need for compliance by these organizations of  Indian Laws will be discussed in the Supreme Court .

Firing it’s salvo on these provisions, Wire.in  carries an article  tiltled  “How the draft Telecom Bill Institutionalises Big Brother’s Saffron Tick”.

Taking the  line of argument popular with criminals and terrorists, Wire.in  comments

“..the government has assumed powers that it never had under any law, and is trying to use legislation to force OTT messaging services, many of which are end-to-end encrypted, to make a backdoor.”

“A key test that courts have articulated for assessing the reasonableness of state action (including legislation) that seeks to engage or restrict fundamental rights is that the measure must be “necessary in a democratic society”. The powers under Clause 24 of the Bill of blocking, interception, decryption and disclosure of private communications and correspondence do away with this requirement of ‘necessity’ as they can also be exercised on the ground of ‘expediency’.”

While the concern expressed by  the criminal friendly media is understood and appreciated, it is to remembered that the protection under the laws such as the “Right to Privacy” should not be guaranteed for Criminals because it interferes with the “Right to Security” of another law abiding citizen.

Irrespective of how Supreme Court might have interpreted the law in the past, the security situation in the country is not the same today as it was in 1989 when Rangarajan V Jagjivan Ram (quoted by Wire.in) decision was given or even when the Puttaswamy Judgement was delivered in 2017.

Today the Supreme Court has to factor in the existential threat to the Indian Society posed by fundamentalists and “Privacy” is the tool with which they hide and hit back. If the intelligence agencies donot crack this “Weil of Privacy” the country may not exist in 2047 to uphold the “Right to Privacy”.

Hence the law and it’s interpretation has to be dynamic and move with the times. Supreme Court also has to forget the old cases as they did by over ruling M P Sharma Judgement by Puttawamy Judgement and hold that the provisions contemplated in laws such as the Telecom Bill or the CERT In Guidelines etc are reasonable and proportional to the risks which the Government of the day is duty bound to provide to its citizens.

The undersigned has factored this into his recommendations on the new Data Protection Act in the articles under the series of “Shape of Things to Come”.

The proposed approach is

a) To define Right to Privacy as a Right guaranteed by the Constitution  not available to criminals of certain description.

b) To specifically enable the Government to remove the weil of secrecy by mandating that “Anonymization” has to be regulated.

Accordingly, “Protected Right” was recommended to be defined as

Protected Right

The right to privacy of an Indian Citizen  shall pe protected through due process set by this Act as an intrinsic part of the right to life and personal liberty as envisaged under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution of India subject to reasonable exceptions under article 19(2) of the Constitution of India.

Also set obligations of the Government as follows:

Obligations of the Government

(a) All the Government bodies including the Government of India the Governments in States and Union Territories and every organization which is part of such Government or Union Territory shall have the duty to protect the Right to privacy of Indian Citizens in harmony with the Right to protect the life and liberty  as envisaged in the Constitution of India

(b) All such Government bodies shall institute reasonable and proportionate measures to meet the obligations of protecting such Rights.

(c) All such Government bodies shall designate a senior official to be responsible for compliance of the protection of the Right to Privacy and Right to life, property and liberty

(d) In the event of non compliance of the above, the designated person or in his absence the person responsible for the activities  in the subject Government body shall be liable for disciplinary action

(e) If the non compliance is associated with malicious intention, the person responsible may be liable for punishment under appropriate criminal law.

The definition of Privacy is suggested as follows:

Privacy:

1.“Privacy is a fundamental right under the Constitution of India as an independent right under the Right to life and liberty that guarantees an individual that shall not be infringed except under due process of law as defined in this Act and  includes the following.

(a) “Physical Privacy” means the choice of an individual to determine to what extent the individual may chose to share his physical space with others.

(b) “Mental Privacy” means the choice of an individual to determine to what extent the individual may chose to share his mind space with others

(c) “Neuro Privacy” means the choice of an individual to determine to what extent the individual may share his neuro space with others

(d) “Information Privacy” means the expression in electronic form of the choice of an individual to determine to what extent the individual may share data about the individual with others.

Explanation:

“Sharing” in the context above means “making the information available to another human being in such form that it can be experienced by the receiver through any of the senses of seeing, hearing, touching, smelling or tasting of a human in such a manner that the identity  of the individual to whom the data belongs may become recognizable to the receiver with ordinary efforts”.

2. The Right to Privacy referred to in this section is subject to the reasonable restrictions in the interest of sovereignty and integrity of India, the security of the State, friendly relations with foreign States or public order; and  for preventing incitement to the commission of any cognizable offence relating to sovereignty and integrity of India, the security of the State, friendly relations with foreign States or public order,

Under this approach, “Right to Protect the Life and Liberty” does not apply only to the subject individual whose “Right to Privacy” is under discussion. It also extends to the 130 crore other individuals whose rights of security is to be protected against the right to privacy of the one criminal.

The Supreme Court also  has to understand and appreciate that while they glorify the application of human rights to all criminals and terrorists, whenever the Court leans in favour of a criminal on any pretext, they are betraying the interests of the larger majority of honest citizens. If the Court goes for minority appeasement like the political leaders, the honest citizens will lose faith in the Judiciary.

I suppose that the manner in which the Supreme Court will dispose off the WhatsApp petition in January 2023 will determine whether the Court appreciates the larger public good or respects the duty of the Government to protect honest citizens.

Naavi

Posted in Cyber Law | Leave a comment

ONDC could be the next Digital Revolution in India

On September 30, 2022, beta testing of the Open Network for Digital Commerce (ONDC) started in 16 pin codes in Bangalore.

This is a great initiative to bring the small merchants who were hitherto loosing their business to the E Commerce giants and were getting wiped out from their traditional business. We were seeing vanishing of many of the known grocery stores from which we were purchasing for generations and regretting the dark side of digital development. Today there is a door open for salvation on this front and protecting the traditional small businesses through the ONDC.

Consumers can now shop from multiple (currently two) categories of products and services from any buyer application of their choice. They will now also be able to purchase from every seller listed on the network, including local sellers who were not present on a digital platform earlier and have been e-commerce enabled for the first time.

For sellers, this will result in added visibility for their products and services leading to additional revenue. Even their existing customers can see them online via any buyer app and order from them, helping them retain existing trusted relationships.

Bizom, Digiit, Enstore by Innobits, eSamudaay, eVitalrx, Go Frugal, GrowthFalcons, Mystore, nStore, Seller App, Uengage, and Ushop are the seller apps  are participating in the Beta Test from the seller’s side.

 Consumers can shop online from buyer apps like Mystore, PayTM, and Spicemoney.

Dunzo, Loadshare, and Shiprocket are providing logistics services and Protean eGov Technologies Ltd (Formerly NSDL e-Gov) is providing gateway services.

Blowhorn, Craftsvilla, CSC Grameen eStore, Ekart, Global Linker (Faiita IT Mall), Grab, HDFC Bank, IDFC First Bank, ITC Store, Kotak Bank, Magicpin, Microsoft, Peppo, Petpooja, PhonePe, Shopalyst, Snapdeal, and Zoho are in advanced stages of integration and expected to go live shortly.

Floats and Plotch are technology service providers, facilitating buyer and seller apps to join the ONDC network.

Some time back Myn App launched its services to compete with Uber and Ola which were going berserk with “Surge Charges”. The menace of “Surge Charges” were also corrupting the system of Zomato and other food apps and the consumers were feeling that we are now into “Exploitation Phase” in digitization of services as we had observed in the e-Banking scenario earlier.

The ONDC working along with UPI could make a significant impact on the E Commerce world today lead by Amazon and Flipkart.

Future of Digital India is blossoming.

Naavi

Posted in Cyber Law | Leave a comment

Countdown to Digital Society Day 2022 has begun

October 17th each year since 2000 has been a day to remember as the day when the Indian Digital Society was born.

Just as India existed from time immemorial but we celebrate August 15 as the day of our independence, Digital India was in existence before October 17 2000 in small parts but got legal recognition with the notification of Information Technology Act 2000. (ITA 2000).  A substantial amendment in December 2008 released a new version of ITA 2000 which became effective from the notification made with effect from 27th October 2009 and acquired more clarity on April 11 2011 with the notification of Reasonable Security Practices under Section 43A and the Intermediary Guidelines under Section 79.

Now Government of India is talking of a “Digital India Act” which is contemporaneous with the current digital world where Social Media Intermediaries, Artificial Intelligence, Meta Verse, E Commerce, Quantum Computing etc were not in existence when ITA 2000 was conceived.

Though the withdrawal of PDPB 2019 did cause a temporary set back in the industry expecting a new set of data protection laws, it re-iterated the importance of ITA 2000 as the current operating Data Protection Law in India since Section 43A and Reasonable Security rules (or  Sensitive Personal Data Protection Rules) continues to exist.

We today speak of 5G and  how it can transform India into a new era of “Digital India” and are proud that  we are leaders in the digital payments with 40% market share in the world for digital payments.  We recognize that the Launch of ONDC-Open Network for Digital Commerce could transform the small business sectors and onboard them on to Digital services. Today even the Supreme Court proceedings are streamed online closing the gap between the common man and the highest judiciary.

All these developments show that Digital India is truly booming.

We must however remember that prior to October 17, 2000, we did not even recognize an electronic document legally and could not authenticate an electronic document digitally. There was no concept of a judicially recognized digital contract though there were technological innovations like the ATM, Net Banking and Demat Shares in use.

But  October 17, 2000 transformed the situation in India with the notification of ITA 2000. The electronic document, Digital Signature and the Digital Contract got legal recognition and  the Digital Society of India was born.

The importance of this development can never be taken away and we need to recognize this and celebrate this even when we are looking forward to a new Digital India Act.

FDPPI therefore will celebrate October 17 2022 as the Digital Society Day by conducting a virtual mini conference on the theme “Digital India in the making” where we discuss the “Role of ITA 2000 in the emerging Cyber Legal system in India”, the “Recent CERT In Guidelines” along with the “Compliance Management Rating” related to CERT In guidelines and ITA 2008 compliance.

Register today for the event on October 17, 2022 between 4.00 pm to 8.00 pm. All those who register for IDPS 2022, a three day virtual event of FDPPI (Third annual event of Indian Data Protection Summit) will be sponsored on behalf of FDPPI.

Register for IDPS 2022 and get a free registration for the October 17 event here:

https://fdppi.in/wp/idps2022-registration/

Register today and participate in the discussions.

The program will consist of presentation from Naavi followed by a panel discussion.

Naavi

Posted in Cyber Law | Leave a comment

Whats App Privacy Policy Issue.. Will the new Data Protection Act apply retrospectively?

Most of the observers of Privacy and Data Protection in India are aware that when WhatsApp tried to introduce its new Privacy Policy in 2017 there was an exodus of users in opposition to the policy. Subsequently WhatsApp did not enforce the policy.

In the meantime the withdrawal of the PDPB 2019 despite the assurance of quick re-introduction of a modified version has again brought the  discussion on where the industry stands in terms of their obligation to protect the privacy to the fore front.

Recently, the Delhi High Court dismissed an appeal by WhatsApp to stall the  investigation by the Competition commission of India (CCI)order calling for an investigation into the messaging apps’ new privacy policy, noting the policy places its users in a “take-it-or-leave-it” situation.  The Court felt that the new  privacy policy of WhatsApp virtually forces its users into agreement by providing a mirage of choice, and then proceeding to share their sensitive data with Facebook companies envisaged in the policy, (ANI report).

The Court made a caustic remark as follows.

“the Court finds merit in the submission of the ASGs appeared for CCI that one of the key issues with the 2021 Policy is its propensity to share the data of its users with Facebook Inc., the parent company of WhatsApp. Solely for the reason that the policies itself do not emanate out of Facebook Inc., the Appellant cannot hide behind the fact that it is the direct and immediate beneficiary of the data sharing mechanism envisaged by the policies.”

Facebook and WhatsApp said that since the issue of WhatsApp’s privacy policy is being heard by the Supreme Court, and High Court, therefore, there was no requirement for CCI to order the probe.

Now WhatsApp has again raised the issue before  the Constitution bench of the Supreme Court, a brief report about which was made yesterday. During the proceedings, it was brought to the notice of the Court that in 2017 the matter had been briefly heard by the Supreme Court. It was also mentioned that the new Data Protection Act may provide a solution to the conflict.

However, the Court agreed to have a final hearing of the case and fixed January 17 as the date of hearing so that even before the Government could pass the Act, the Court could pass an order that binds the Government.

The urgency of the litigants is clear that they apprehend that the Act may bring some kind of restrictions on their operations and it is better if they arm themselves with the order of the Court so that they can claim immunity for their past data collection and usage actions and claim that the new Act will apply only prospectively.

Interestingly, one of the observations and recommendations made by the JPC on PDPB 2019 was that sensitive data transferred out of India in the last 2 years should be brought back to India. If the New version of the Bill incorporates this part of the recommendation, it would be a headache for most MNCs both in principle because they oppose the right of the Indian Government to the data collected in India but also for commercial reasons.

It must be observed that India presently has ITA 2000 which under the amendment of 2008 introduced Section 43A and the rules under Section 43A and 79 released in April 2011 specified most of the Privacy protection requirements now being considered under PDPB2022/23 (new version under draft). Hence the actual provisions of PDPB 2019 (withdrawn) was considered as “Due Diligence” under ITA 2000-Section 43A/79.

This situation will continue  till the new Act is passed and specifically repeals Section 43A of ITA 2000.

Hence in the intervening period most companies have to complete their data loot. One of the early successful executions of such data loot has already been discussed in these columns and it was TransUnion taking control of 500 million Indian users’s credit card usage profiles by buying into the shares of CIBIL.  Now VISA and others have been transferring sensitive personal data abroad for processing and the law enforcement agencies are experiencing problems in extracting data from such companies.

We are aware that Twitter had openly challenged the Indian Government that it will protect the Privacy of Indian Citizens through its own privacy policy and terms of use and defied the jurisdiction of the Indian Government. Given a choice the WhatsApp-FaceBook will also assert that they have a specific jurisdiction of their own which the Indian Government cannot intervene.

If we recall the views expressed in these columns (please refer to this article) we had said that while WhatsApp is free to request consent for use of personal data through an appropriate informed consent, the critical issue about their privacy policy was the jurisdiction clause as follows:

Forum And Venue. If you are a WhatsApp user located in the United States or Canada, the “Special Arbitration Provision For United States Or Canada Users” section below applies to you. Please also read that section carefully and completely.

If you are not subject to the “Special Arbitration Provision For United States Or Canada Users” section below, you agree that any claim or cause of action you have against WhatsApp relating to, arising out of, or in any way in connection with our Terms or our Services, and for any claim or cause of action that WhatsApp files against you, you and WhatsApp agree that any such claim or cause of action (each, a “Dispute,” and together, “Disputes”) will be resolved exclusively in the United States District Court for the Northern District of California or a state court located in San Mateo County in California, and you agree to submit to the personal jurisdiction of such courts for the purpose of litigating any such claim or cause of action, and the laws of the State of California will govern any such claim or cause of action without regard to conflict of law provisions. Without prejudice to the foregoing, you agree that, in our sole discretion, we may elect to resolve any Dispute we have with you that is not subject to arbitration in any competent court in the country in which you reside that has jurisdiction over the Dispute.

Governing Law. The laws of the State of California govern our Terms, as well as any Disputes, whether in court or arbitration, which might arise between WhatsApp and you, without regard to conflict of law provisions.

Time Limit To Bring A Claim Or Dispute. THESE TERMS ALSO LIMIT THE TIME YOU HAVE TO BRING A CLAIM OR DISPUTE, INCLUDING THE TIME TO START AN ARBITRATION OR, IF PERMISSIBLE, A COURT ACTION OR SMALL CLAIMS PROCEEDING TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW. We and you agree that for any Dispute (except for the Excluded Disputes defined below) we and you must bring Claims (including commencing an arbitration proceeding) within one year after the Dispute first arose; otherwise, such Dispute is permanently barred. This means that if we or you do not bring a Claim (including commencing an arbitration) within one year after the Dispute first arose, then the arbitration will be dismissed because it was started too late.

These conditions need to be taken into account both by the CCI and the Supreme Court to understand what would be the damaging impact of allowing a free hand to WhatsApp to set its own Privacy Policy outside the jurisdiction of the Indian law and create a Twitter like argument that Face Book can make laws for Indian Citizens which overrides the laws made by the Parliament.

I wish some of the lawyers bring forth these facts before the Court in their pleadings.

Additionally, the Government needs to think if they have to include “Retrospective” effect of the data protection laws and provide that since the date of the Puttaswamy judgement all personal data collections made in India by companies and transferred out of India should be copied back to the Indian servers so that at least a copy of the data collected will remain in India. The prospective rule on not transferring the data out of India except with an explicit consent or otherwise can be incorporated in the law.

We have separately discussed how this right of the Government may be protected in the new law through the series of articles on “The Shape of Things to Come” which have been published earlier.

It is to be noted that one of the media has recorded the following report:

“The new regime could be enacted during the winter session of the Parliament, a point the apex court took note of and said it will give the Centre time till the winter session to pass a law.
But if a law does not come into effect guaranteeing the protection of data security, then in January, the Supreme Court will resume hearing this case and will decide the issue. So all stakeholders are waiting with bated breath as far as government’s moves are concerned on a data protection regime.”
This could mean a pressure on the Government to pass the law by December -2022 session instead of the February -2023 session. 
Since it is uncertain whether the Government would be ready to pass the law in December 2022, or the opposition in the Parliament would allow even if the Government is keen, the risk of WhatsApp getting its way through the Court is high. 

Naavi

Also Refer:

Previous article (This was a quick response based on sketchy information then available)

Live updates from livelaw.com

Report in cnbc.com

Posted in Cyber Law | Leave a comment