As the Indian Data Privacy eco system prepares itself for the upcoming DPDPA implementation, there is a genuine concern that data principals are unlikely to raise complaints with DPB the entire system will continue as it is now.
In order to stimulate a quick adoption of Privacy culture it is essential that both the data principals as well as the data fiduciaries need to be encouraged to point out deficiencies and correct deficiencies as they observe.
Naavi.org and FDPPI have recently launched the “Privacy Mitra” project where a cadre of Privacy Champions across the country are being set up to spread the Privacy awareness both to the ordinary people and the companies.
As a further extension of this, it is necessary to create a “Privacy Watch” to flag Companies where immediate privacy protected related action is required.
The Privacy Watch List will enable Privacy Consultants to assist the companies to mitigate the observed risks and improve their compliance. The Consultancy may be provided by any Consultant not necessarily FDPPI or Naavi.
As one of the first entries into this list is “TransUnion CIBIL” along with other Credit Information Companies such as “Experian”, “Equifax” and CRIF High Mark. This class of industries need to be declared as “Significant Data Fiduciaries” under DPDPA 2023 and “Protected Systems” under Section 70 of ITA 2000.
We urge Privacy Mitra team to verify the Data Privacy status of these companies and help them to correct themselves if they are interested. In case the privacy violations continue, there could be complaints raised with DPB as a due process.
In this connection, the ongoing Supreme Court case on a PIL filed by one Sri Surya Prakash becomes very important.
Let us consider this Court case as Privacy Watchlist event no 1. and the CIC as a class of data fiduciaries as Privacy Watch List category and the four CICs as Privacy Watch list companies.
Naavi
P.S:
Privacy watch 2: On 17th February 2025: A Personal Data Breach has been reported at AWS related to Adarsh Builders, Bengaluru for which an FIR has been reportedly filed against AWS India and Redington Group.
