The passage of DPDPA 2023 with a provision for “Nomination” of personal data as a right of the Data Principal has given raise to a debate on what is the nature of “Personal Data” in law.
“Nomination” obviously means that personal data is a “Property” that can be transferred on the death of a person. The instrument of transfer is the “Nomination form which has to identify the property being nominated and the identity of the person to whom it is nominated for further disposal to legal heirs.
It is the principle of “Nomination” that the “Nominee” is an agent for disposal of the property and not necessarily the undisputed owner of the property. The ownership of the property on death should get transferred as per the laws of transfer of property.
“Nomination” is considered as an instruction to the custodian of a third party property that in the event of the death of the owner, the property should be entrusted to the nominee for disposal to the rightful owners of the property. The rightful owners of the property would be determined by the “Will”or in the absence of the “Will”, by the provisions of the appropriate law.
A question arises if “Nomination” document itself can be considered as a Will. But this is not the accepted legal position. The purpose of “Nomination” is to help the custodian of the property to easily dispose of the property from his custody to another person chosen by the deceased during his life time. It is meant to discharge the custodian from any claims of wrongful disposal by persons other than the nominee who may have ownership rights on the property.
The nomination document should be more appropriately considered as a document that creates a “Trust” of the property of the deceased in the hands of the custodian for the rightful beneficiaries of the property. The trust gets created on the contingent event of death of the owner of the property.
In the Indian law, immovable properties are transferred as per the transfer of property act. Movable properties and actionable claims are transferred during life time through contractual instruments. Any document that transfers the title on the contingent event of the death of the owner is called the “Will”. Under ITA 2000, “Will” cannot be in electronic form and hence a nomination document taken as a part of the “Consent” for personal data collection is not valid in law.
On the other hand, “Intellectual Property” is a separate category of property recognized as an intangible property associated with “Creativity”. The derivative of “Intellectual Property Right” can be physical or virtual. The law related to intellectual property is fairly well developed from the point of view of valuation and transferability as well as sharing of value during the life cycle of the development of intellectual property.
The principles of valuation, used in intellectual property can be a good guide even for valuation of “Personal Data” as has been used in the Naavi’s theory of data, as hypothesis 3 titled “Additive Value Hypothesis”.
The uniqueness of “Personal Data” as property recognized by DPDPA 2023 is that it is a unique property which can neither be considered as physical or virtual, neither movable or immovable. Hence we can not confidently apply either the immovable property related laws or movable property related laws or intellectual property laws to personal data.
Jurisprudence on what kind of property is “Personal Data” needs to be developed over time.
If we consider the definition of “Personal Data” as any information that is about an individual that includes the name, address, the IDs such as biometric, Government IDs like PAN or Aadhaar numbers, or Employee numbers, Phone numbers, E-Mail addresses , Health information, Financial information, Educational information etc., we can say that it is created by a number of individuals other than the individual to whom it relates. Hence the ownership assignment is ambiguous.
For example A sees B and creates a mental profile of B. Is this the property of B to whom it relates or to A who creates it is a question which is not easy to answer. A Health report may be paid for by the individual so that the ownership can be considered as bought by the individual from the hospital that creates it. But an Employee ID/E-Mail etc , which is assigned by an employer to the employee is not created by the employee nor paid for by him. It is created and extinguished at the discretion of the employer. In such a situation, is it correct to conclude that the property belongs to the employer?. If so, unless the employer declares through a contractual document that the property right is transferred to the employee either as a limited period right until he/she is in employment or permanently, it remains the property of the employer.
The same dilemma confronts a mobile or an e-mail service provider who may exercise right over the mobile number or email ID and decide to re-allocate it to another person under certain circumstances. In such a situation, what happens to the PII nature of the information?
Similarly can a parent who has assigned the name to his child withdraw the name at some point of time in the life of an individual?
Can we consider some information like “Address” to be “Temporarily personal”?
What are the identifiers which can be considered wholly owned by the individual or assigned by the parents, assigned for temporary use by employers?
It appears that personal information that is wholly owned by an individual is close to being called an “Intellectual Property” of the individual or “Bought out property” from other creators.
…..Open for debate
Naavi
