India’s draft data rules draw caution and cheer from stakeholders

India released draft data privacy rules last week to mixed reactions from key stakeholders, including telecom firms and social media platforms to Big Tech.

The Digital Personal Data Protection (DPDP) Bill, 2023, which cleared Lok Sabha in August 2023, provides the legal framework for data fiduciaries or private entities that collect data from users to protect that data from misuse and has provisions to penalize firms that violate data protection norms.

While some provisions on the requirement of parental consent for minors to set up social media and online gaming accounts through “privacy-preserving techniques” are commendable, analysts said others such as the purported return of data localization requirements may put more pressure on data fiduciaries.

There is now “much-needed clarity” on age-gating “and how the obligations under the law can be met,” Rahul Matthan, a partner at legal firm Trilegal, wrote in Mint.

“If coupled with privacy-preserving techniques (such as zero-knowledge-proof), this will allow data fiduciaries to comply with the requirements…without having to process personal information,” Matthan said.

The draft rules also mandate online platforms to check the age and identity of the individual identifying as a parent when obtaining verifiable parental consent for processing the data of an under-18 user.  They must take “appropriate technical and organizational measures” to ensure that they obtain this consent before processing the data of a child.

On data localization, rule 12 (4) in the draft rules suggests significant data fiduciaries may have to localize some categories of personal data, in an indication that “the government is sneaking in” a provision that had been diluted earlier.

“Rather than requiring businesses to incur the considerable cost of building data centres, the government would be well advised to negotiate treaties with as many jurisdictions as it can to secure faster and more effective data access,” Matthan said in his column.

Some telecom analysts and legal experts have also pointed out that clauses on transferring data outside the country may have an impact on making international calls as well as sending text messages and WhatsApp messages to users abroad.

Telecom firms, as major personal data repositories, will be classified as ‘significant data fiduciaries’ under the draft rules and barred from transferring data traffic abroad, affecting international calls and roaming services.

The data localization norms may also pose hurdles to foreign businesses, with some analysts observing that the government must list the parameters for localization to the mandated.

The data rules, which were published on Friday, do not amount to back-door entry data localization requirement, The Economic Times reported information technology minister Ashwini Vaishnaw as saying.

The rules are exactly in line with the law, Vaishnaw added.

In addition to data localization, the clause to report each personal data breach to authorities, including the Indian Computer Emergency Response Team (CERT-In), the Data Protection Board and the department of telecom, will lead to added complications, some analysts said.

“If data fiduciaries have to notify a breach as soon as they become aware of it, most of them will over-report rather than risk being found non-compliant,” Matthan wrote, adding that “this sort of reporting could cause panic among data fiduciaries who will have been told their data was compromised, even though it was not.”

These hurdles, analysts said, will lead to an inflation in costs, which companies will look to recover by adding onto tariffs.

While the rules present a “bold move” toward establishing a robust digital privacy framework, “they also pose challenges, especially for small and medium-sized businesses in adapting to stringent compliance requirements,” Ram Rastogi, a digital payment strategist and chairman of the Fintech Association of Consumer Empowerment governance council, said in a LinkedIn post.

The government said the draft rules have been floated after considering a wide range of inputs from stakeholders and studying global best practices.

The ministry of electronics and information technology (MeitY) has invited feedback till 18 February on the government-citizen reach-out mobile application MyGov platform.