DPCSI and the Intelligence theory

Today, I received a WhatsApp regarding four types of intelligence, namely,

1) Intelligence Quotient (IQ)
2) Emotional Quotient (EQ)
3) Social Quotient (SQ)
4) Adversity Quotient (AQ)

The forward defined the different types of intelligence as follows:

1. Intelligence Quotient (IQ): this is the measure of your level of comprehension. You need IQ to solve maths, memorize things, and recall lessons.

2. Emotional Quotient (EQ): this is the measure of your ability to maintain peace with others, keep to time, be responsible, be honest, respect boundaries, be humble, genuine and considerate.

3. Social Quotient (SQ): this is the measure of your ability to build a network of friends and maintain it over a long period of time.

This triggered a thought about the DPCSI  which is being suggested for Data Protection Compliance in India. and how the DPCSI incorporates all the four types of intelligence represented above  in its Standards and Implementation Specifications.

The 12 standards of the DPCSI framework are given below:

In the above standards,

Standards Law Based scoping, Data Classification, Privacy By design at entity level, represent the intelligence quotient and measure of the level of comprehension of the compliance requirements.

Emotional quotient is captured by the inclusion of Communication, Governance Committee, workforce control.

Social Quotient is captured by Distributed responsibility.

Adversity quotient is represented by the Risk appetite based charter.

The implementation specifications that go with this standard also reflect the four types of requirement of the framework which need to address the legal issues of compliance, technical architecture for compliance, the workforce and top management support and the need for external and internal communication with stake holders.

We can therefore feel confident that DPCSI is “Intelligent” and meets the expectations of Data Protection Professionals just as the above types of intelligence recognized by psychologists.

Naavi

Posted in Cyber Law | Leave a comment

Let’s create a Data Protection Law Compliance Culture in India

To

All those interested in Data Protection law compliance in India

Dear Friends

I invite you all for the webinar on “Data Trust Score under DPCSI” scheduled for 11.00 am on Sunday, July 10, 2022. The webinar will be on Zoom. The meeting ID is 882 8084 0436. The pass code is : dts_07

The approximate duration would be one hour followed by discussions. During the session, I will try to explain how Data Protection compliance maturity of an organization can be expressed in terms of a “Data Trust Score” just as how the credit ratings express the investment worthiness of a financial instrument.

The framework based on which the model of DTS would be explained is the Data Protection Compliance Management System which is uniquely built as a “Unified system for compliance of Personal Data Protection under ITA 2000/PDPB2019 or DPA 2021/GDPR etc.

During the session, the use of an online tool that can be used for a self estimation of the data protection status of an organization would also be described.

Don’t miss this opportunity to be part of a revolutionary change in the way companies can handle their data protection compliance requirements. MSMEs in particular should be more interested since the tool would help them to start their journey to be compliant with the law as it emerges.

The objective of this interaction is to make compliance easier and more affordable so that we can together create a “Compliance Culture” in India.

Whether the Government passes the Personal Data Protection bill (PDPB 2019/DPA 2021) during monsoon or not, responsible companies need to start their journey towards compliance.

Even when changes are brought, the foundation principles of compliance will not change. Let vested interests continue their fight to avoid compliance responsibility.

We the responsible corporates shall show the way to respect and be compliant with the legislative intention already reflected under the concept of “Due Diligence” and . “Reasonable Security Practice” in ITA 2000/8.

Naavi

Posted in Cyber Law | Leave a comment

It is time to build a “Compliance Culture”

The IT community has gone through the phase of discussing the need for building an “Information Security” culture in the organization. There after we also went through the phase of building a “Privacy Culture”.

In both these phases, we focussed on the people in the organization and tried to educate them on security issues and privacy issues.

While the efforts for building an information security culture and privacy culture continue, they are now being subsumed by the new requirement of building a “Compliance Culture” in organizations.

This requirement is  typical of the Indian market where we always stretch the compliance requirement till we are forced to comply.

The time has therefore come now to build a “Compliance Culture” in an organization. In this context, an “Organization” is the aggregation of the senior executives who have gone through the implementation of measures in their respective work places to ensure that their subordinates are impregnated with the importance of information security and privacy and why they all need to change their attitudes to work and attitudinally re-orient themselves to practice better security and privacy ethics and technology in their day to day work.

FDPPI is now embarking on leading Indian organizations into this phase through its program.. “Data Trust Score, the future of Privacy Protection”.

“Data Trust Score” or DTS, is the suggested measure of “Maturity of Data Protection Law Compliance” in India. It is a suggested deliverable of a data auditor who audits the data protection practices of a company in India. It works like the “Credit Rating” assigned for financial instruments by Credit rating agencies such as CRISIL or ICRA.

FDPPI which has created an eco-system for certified Data protection audits based on the indigenously developed framework of DPCSI (Data Protection Compliance Standard of India) is adopting the DTS-DPCSI, as  model for calculation of DTS on the DPCSI framework.

DTS-DPCSI is the first of its kind concept and would be the forerunner of similar assessment yardsticks that will emerge in future for other frameworks also.

The life of a Data Protection Professional will not be complete without understanding the concept of DTS and how it can be applied in their work environment.

Let us start our journey in understanding the concept of DTS through a virtual presentation to be made by Naavi on 10th July 2022 at 11.00 am.

For registration, contact Naavi through email at : dts@ujvala.com

Naavi

Posted in Cyber Law | Leave a comment

DTS On Line

Data Trust Score (DTS) is a measure of the effectiveness of compliance of an organization to data protection law as assessed by an auditor. This brings visibility to the common man of how reliable are the data protection measures in an organization. It also brings accountability to the data audit system by requiring the auditor to convert the subjective assessments to a common objective number.

In the Corporate and Investment world, “Credit Rating” is a common measure of the safety of investment in an instrument and has been widely used.  DTS now brings this concept to the world of “Personal Data” which is like a currency which public invest and Data Fiduciaries collect and use for generating business revenue.

Naavi has been working on developing a DTS system based on the PDPB 2018 which later became PDPB 2019 and now referred to as DPA2021 (or DPB 2021). In this process, Naavi developed a framework referred to as “Data Protection Compliance Standard of India” (DPCSI) which incorporates the best of the various frameworks for implementation of ISMS or PIMS and extends it with some other unique concepts.

Now, Naavi has tried to simplify the process of DPCSI audit by enabling DTS evaluation online. This online DTS computation has been enabled by Ujvala Consultants Private Limited. The process is enabled as a “Self Evaluation” based on certain assessment questions, submitted for review to Ujvala Consultants for validation. Validation can be further strengthened by review of policy documents into a summary assessment of DTS. Finally the system merges with a Certifiable audit by a FDPPI certified auditor.

The online Link to self assessment will be available on the payment of a prescribed fee.

The assessment goes through different steps as explained below and covers five responsibility centers in the organization namely,

1.Management (MIS 1-15)

2.DPO (MIS 16-24)

3.Legal (MIS 25-26)

4.HR (MIS 27-30)

5.IT (MIS 31-50)

General Instructions for use of the “My DTS” system

The assessment has been divided into five sections corresponding to the five different responsibility centers, so that different representatives of the company can complete the assessment in each of the sections. Each section covers the Implementation Specifications related to  the specific responsibility center. The user is expected to complete the questionnaire with reference to the current practices in the organization. 

The questionnaire consists of one or more questions related to each of the Model Implementation Specifications followed by a self assessment of an evaluation score for the specific implementation specification on a scale of 1-10. For each assessment, a list of documents referred may be indicated.

When these individual scores for each implementation specification is totalled, one arrives at the total score for the section.

It is envisaged that each section would be completed by a designated person.

The completion  of the questionnaire can be stopped and continued as per the convenience of the responder.  It can be reviewed internally before it is finally committed for submission.

The summation of the assessment scores for each of the five sections provides the first raw estimation of DTS of the organization based on self declaration.

When this assessment is submitted to Ujvala, Ujvala will apply a weightage system and compute an “Adjusted DTS” and communicate it to the organization along with some critical recommendations if any for further action.  A Certificate would be issued in support of this “Self Assessment”. A general feedback on the next action required will also be provided by Ujvala along with the self assessment certificate.

Summary Assessment
Additionally, the organization may chose to elevate the self assessment into a “Summary Assessment” by Ujvala based on submission of evidentiary documents such as policy documents etc for review.
This would be separately Certified as  “Provisional DTS” for the organization.
FDPPI Certification 
If the Company opts to go for a full fledged audit of their compliance under the DPCSI framework which should meet the standards of Section 29 Data Audit,  the audit will be conducted by an FDPPI accredited Certification body and may be certified by FDPPI under its norms for Certification. 
Pricing
The self assessment audit with the general feedback from Ujvala about the DTS without detailed scrutiny of the documents is available at Rs 2950/- (includes basic price of Rs 2500/- and  GST of 18% of 450/-)
This will include the general feedback from Ujvala issued along with the Self Assessment Certificate.
The cost of Summary assessment by Ujvala with a review of the documents submitted would be based on the documents to be reviewed and an estimate would be provided after the basic DTS is provided.
The cost of  final Certification audit  would depend on the estimate of the work involved and as per FDPPI guidelines if any.
For using the online DTS evaluation, kindly make the payment of Rs 2950/- using the following link and await for the link.
Naavi
Confidentiality of Information Submitted:
Kindly Note that the information submitted for assessment will be available for the team of consultants of Ujvala which consists of Naavi and his associates who provide their assurance for confidentiality of data through Ujvala. 
Since the evaluation questionnaire is hosted on an external website and the security of data entered there in is subject to the security provided by the said website, an option is made available to the respondent organization to seek an Pseudonymous ID while making the payment which can be used on the website where the responses are completed. The responses donot contain any corporate data once the name of the organization is pseudonymized.
For any further clarification,  kindly contact Naavi.

 

Posted in Cyber Law | 1 Comment

Chief Justice of India should restore the dignity of the Supreme Court

The Supreme Court of India will start functioning again after vacation from July 11th. Unfortunately during the Vacation  the reputation of the Court has been damaged almost irreversibly.

The responsibility to put it back on the rails is with the Chief Justice of India.

The judges who erred by pronouncing a judgement escaping the responsibility to record their views in a speaking judgement, are now under an intense public scrutiny.

The erring judges, have promptly started  justifying their action calling India as an immature democracy. They are now hitting out at the Social Media as the culprit and suggesting gagging of the social media. They may also invoke the powers of Contempt of Court to curb the freedom of expression selectively .

Such measures may silence criticism for the time being and push the disrespect of Supreme Court underground. But it will ensure that the reputation of the Supreme Court would be permanently damaged and the public will no longer trust the Courts at any level.

It is now in the hands of the Chief Justice of India prevent such a catastrophe and restore the honour of the honourable court by initiating appropriate action as the Chief Justice of India may deem fit.

If the Chief Justice of India decides to condone the mistakes of his brother judges, We the people of India will get a message that we should be ready for the  Shariatization of the supreme Court.

It must be acknowledged that the action of the vacation bench of the  Supreme Court has resulted in the spreading of a fear psychosis  in the country since we as Citizens of India can no more trust the  highest Court of the land for protection of our life.  If there is no protection from the Supreme Court, it means there will be no support from other Courts or the Police. The future of India as a law abiding democracy is in threat because of the actions of the vacation bench of the Supreme Court.

I therefore personally request the Chief Justice of India  to act now to protect the Country. As an elderly citizen born before the current Chief Justice of India was born, I remind him that it is his constitutional duty to protect the country and this duty towers above everything else including protecting brother judges.

Naavi

(P.S: Followers of this blog may excuse me for this off-topic expression since there is an existential crisis for the people of India because we the people of India have lost the judicial protection enshrined in the constitution. If no remedial action is taken by the CJI, the writing on the wall is clear that it is the end of road for all our professional activities. Since it is no longer safe to express an opinion in India and to move around, the professional activities of Naavi may need to be suspended. Naavi)

Also Read:

Legal Rights Protection Forum urges President of India to call a meeting with CJI ..opindia.com

The court can be discretionary but not whimsical: Dangerous waters, comments by Judges and legality of oral observations …opindia.com

Posted in Cyber Law | 1 Comment

“Obiter Dictum”.. a Concept that needs debate

The “Obiter Dictum” maxim in law refers to the expression of an opinion by a Court during the proceedings which is not necessary for the decision of the case. Legally such statements lack the force of precedent.

In a written judgement the reasons for a decision is elaborated and this is referred to as “Ratio Decidendi” or “Reason for the Decision”.

In the written judgement, the Judge may make some additional comments by way of illustration which is referred to as “Obiter Dicta”.

However, during the trial, the judges some time need some clarifications and throw some questions at the counsels. When experts are deposing before the Court, the Judges may need to seek clarifications of theoretical nature which may be extraneous to the judgement per se but required for understanding the context.  These should be  fact seeking questions and not expression of opinions and hence are not forming part of obiter dicta.

It has however become a practice amongst some Judges to speak out their opinion during the trial to intimidate the counsels or with the intention that the remarks are picked out by the media present in the Court room.

This tendency should be considered as “Judicial Misconduct”. Such dialogue between the Chair and the counsels should not become a forum for the Judges to vent out their personal opinion since this cannot be part of obiter dicta.

It is very important  for the Judiciary to maintain a high level of ethical standard and behaviour when they are visible in the public and raise their questions in such a manner (includes the tone)  that they are not interpreted as opinions.

I refer to an article in unodc.org titled Judicial Misconduct and Public Confidence in the rule of law by David J Sachar, which rightfully observes …”More than any other branch of government, the judiciary is built on a foundation of public faith-judges” and regulation of judicial misconduct is necessary to ensure that this public confidence is not eroded.

It is not easy to define the “Ethical behaviour” of a judge during the proceedings and off the Court. But mature Judges know and always err on the safer side when the crunch comes.

For example, if the case before the judge is likely to have a conflict of interest or is likely to be perceived as a “Conflict of Interest” then it is expected that an ethical judge would offer to recuse from the case even when the parties to the dispute are unaware of the issue of conflict.

While “Obiter Dictum” refers to the addition of comments in a written judgement, there does not appear to be any legal sanction for oral judgemental opinion expressed by the Judge in the open court knowing fully well that the media is likely to pick it up and present it to the larger public as the “Opinion of the Court”.

The “Conflict” as well as “Expression of Oral opinion not part of the final judgement” were both seen in the recent Supreme Court vacation bench handling of the petition for clubbing of FIRs by a politically exposed person.

The Court came down on the counsel with a hammer and ensured that the petition was withdrawn. The media picked up the comments and spread it like wild fire as if it is a judicial precedent. Many of the lower Courts will also consider these remarks as the “Obiter dicta” which it is not.

In the above case which was recorded as withdrawn,  it is possible that the petitioner would not on her own withdrawn the petition.

But the order records “Petitioner seeks to withdraw and is permitted to withdraw the petition”. This could be unfair on the petitioner and her right to seek judicial protection.

This situation arises since the trial is a discussion between the Counsels and the Judges who are from the same fraternity. Since in many courts, the Judges are past members of the Bar, they hold close personal relationship with senior counsels and this often vitiates their judgement. It is for this reason that many of the counsels only put up their arguments before friendly judges. Some senior counsels may be so senior that the judge might have even worked as his/her junior several years when he was practicing.

It is not an argument that the Judge cannot disagree with one of the counsels strongly and give a scathing judgement. What is however important is that the Judge should be confident of owning up his/her opinion and express it with reasoning in the judgement. In that case there will be an opportunity for the aggrieved parties to appeal to a higher forum for justice.

Making oral observations, intimidating the counsels to withdraw the petition and not being accountable for the decision in the end is not a desirable conduct of a good Judge.

As regards the Conflict situation, if a case is politically sensitive and the father of one of the Judges is a political worker, then it calls for sensitivity of the judge to recuse himself.

Similarly, if the case is involving a party who is in a position to provide a favour  to a close  relative of the Judge in another dispute,  mentioning the dispute could be considered as an indirect hint to the party to provide that favour.

There should be no reason for the public to point out these kinds of conflicts and the Judges should realise it themselves and recuse themselves from such cases.

There are many judges who are extremely sensitive to such conflict situations and avoid them with a barge poll. Unfortunately there are also some judges who may be ignorant of the required ethical standards or some who are aware but chose to ignore.  They bring bad  name to the entire fraternity.

It is the duty of the managers of the Judicial system to take appropriate disciplinary action against such judicial misconduct. Where the Judicial system has no remedy for such a situation, the Legislature has to use its powers of impeachment to ensure that such conduct is nipped in the bud and better discipline is instilled in the Judiciary.

When the legislature intervenes in the disciplining of the Judiciary, there will be an inevitable charge that the Executive is trying to influence the Judiciary. However, “Executive” and “Legislature” are different and disciplinary action by the legislature is not to be treated as creating an influence on the Judiciary.

However, such action requires “Conviction” and “Commitment to maintain public confidence on the Judiciary” on the part of the legislature. If the legislature is either too soft to take the bull by the horn or enters into a compromise, then democracy is at stake.

Hope India is still having a living vibrant democracy. However, it needs to be proved..

Naavi

Posted in Cyber Law | Leave a comment