Mumbai:  Last month, the ministry of electronics and information technology, after deliberating on various aspects of digital personal data and its protection, formulated a draft bill, titled ‘The Digital Personal Data Protection Bill 2022.’ Experts opine that in the short term, digital ad revenue will take a hit if the bill comes out unmodified. This bill will benefit citizens, provided they understand their rights and use them.

The purpose of the draft bill is to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process personal data for lawful purposes, and for matters connected therewith or incidental thereto.

The Digital Personal Data Protection Bill frames out the rights and duties of the citizen (Digital Nagrik) on the one hand and the obligations to use collected data lawfully of the data fiduciary on the other. The bill is based on the following principles around the data economy:

The bill aims to establish a comprehensive legal framework governing digital personal data protection in India. The bill provides for the processing of digital personal data in a manner that recognises the rights of individuals to protect their personal data, societal rights, and the need to process personal data for lawful purposes.

Speaking to Indiantelevision.com on the bill, DeFiVerse CEO and co-founder Akshay Bajaj said that while there is an urgent need for some data protection laws, some of the clauses of the bill are quite vaguely phrased, and others maybe even be negative in terms of impact. But it is definitely a step in the right direction. He feels that digital ad revenue will take a hit.

He noted that if people manually upload data, it doesn’t count under the act. This, he cautioned, may become a major loophole. "The good news is that corporations cannot store your data after you stop using their services. You can request full disclosure from corporations about what data they own, who has access to it, and what they do with it. Government controls Indian data goes out to every country and every corporation. Any corporation can be asked to provide all information by the government. The Data Protection Board of India has as much power as a civil court. There are penalties up to Rs 500 crore per instance of breach."

When asked about how he sees the bill benefiting citizens, he said that corporations are required to delete data, meaning that leaving an app or bank means that one’s data has to be deleted. "Furthermore, citizens will be able to check up on organisations legally by asking what data is being used and how. Citizens can now legally challenge big corporations with RTIs, and this should bring about a more transparent approach by these companies."

On the impact that the bill will have on digital marketers and social networks, he elaborated that he thinks that the consent concept may be misused by social networks to take in a lot more data. "At the same time, they will have to be more responsible for the data, as they are answerable to the general public. It will lead to a lot of new styles of marketing that will take advantage of the nuances of this bill."

The challenge, he further noted, is that if the bill is passed in its current form, then data may not be available to advertisers, who cannot serve personal advertisements based on user data. Specifically, minors cannot be targeted in advertisements. "There will definitely be some drop in advertising revenue as a whole."

He believes the financial penalties will definitely cause tech giants to be more responsible with data management. "Reclaiming much of the control over data storage from tech companies and returning it to the user will represent a significant change in how these companies operate."

At the same time, he pointed out that asking for a consumer's consent is a very double-edged decision. That is because, on the one hand, people can refuse to provide data very easily, and companies are still legally required to serve them. "But a common theme is that we tend to give consent without paying attention to what we are consenting to. People will have to carefully read through the alerts before giving consent. Only time will tell if this decision is good or bad."

Wing Communications' CEO and founder Shiva Bhavani agrees that this bill was long overdue since a regulatory framework was needed around the online collection of personal data that could easily be misused. But in the short term, there will be some confusion around what is acceptable and what is not, and it will take some time for the dust to settle. "Over a period of time, brands that value data privacy and take reasonable steps to protect customer data will be valued by their customers and earn loyalty," he said.

He added that if the bill is passed in its current form, it is possible that digital ad spending will initially take a hit. That is because a lot of data is collected from individuals and used to determine personal preferences, which help tailor personal ads. He stated, "With so many restrictions around the collection of personal data, brands may not take the risk of increasing ad spending till they are clear about how the bill works."

He noted that we live in a highly digital world where a lot of personal information is shared knowingly and inadvertently via personal data, photographs, phone numbers, email ids, and more. "It is the responsibility of data collectors to maintain data security and avoid data breaches. Selling data to other agencies is a breach of trust and deserves to be penalised. In the long run, this will promote more responsible behaviour and be good for the industry as a whole."

The new draft bill allows multinational companies to store user data abroad. This is a big relief to technology companies like Google, Meta, etc. The last draft in 2019, he noted, was very worrisome for technology companies as it would have increased their compliance costs tremendously. The new bill is favourable to industry and investment. "This bill will allow multinational companies to operate with their current setup without the need to set up new storage and processing facilities in India."

He mentioned that there are over 760 million active internet users in India, and this number could easily hit 1.20 billion in the near future. "This gives you an idea about the number of people whose right to privacy needs to be protected. A proper bill will put things in clear perspective. Both consumers and the industry will benefit in the long run if the rules are framed and complied with."

"We live in a digital world and often share personal information on sites when we complete a transaction, participate in a survey, or provide personal details like name, age, gender, email address, income range, etc. Nobody should have the freedom to use this information other than for the purpose intended. Most countries have introduced similar bills long ago, and it is high time India followed suit as it is the largest democracy in the world," he added.

Rupinder Malik, a partner at the national law firm JSA, noted that the bill has been drafted in a simpler manner. "The 2022 DPDP Bill has simplified the proposed data protection regime and done away with some contentious clauses that caused industry pushback in earlier versions. Particularly, data mirroring, data localisation requirements, and overall compliance levels appear to be limited compared to the previous bill. The legislative intent appears to be tech- and business-friendly, focused on facilitating cross-border data flows. Some aspects that have been watered down could potentially reduce the overall protection accorded to individual privacy rights. The positive bit is that the bill has been drafted in a simpler manner, with fewer ambiguities."

Bhavani noted that the Digital Personal Data Protection Bill is legislation that lays out the regulatory framework within which personal data can be collected by other parties. It defines the rights and duties of the parties involved.

Among other things, he noted that it stipulates that the data so collected should be used in a legal and fair manner and that the dealings with the individual to collect the information should be transparent. The information collected should be used only for the purpose for which it was collected. Unnecessary pieces of information should not be collected if they are not specifically relevant to the purpose. The data provided by the individual should be current and up-to-date. The information should not be stored for posterity but only for the duration for which it is required."

This bill, he added, will benefit citizens provided they understand their rights and use them. "They should ask for the consent form before they part with any information. They should have the right to withdraw consent at any time in the future. This would ensure that their personal data is not sold by the collecting party to other agencies. It would help if there were a provision for monetary compensation for the aggrieved parties in the case of misuse of personal information. In the draft bill, we see mention of penalties on companies but no mention of compensation."

He said that asking for the consumer’s consent before collecting their personal data is a positive move that has the best interest of consumers in mind. In the absence of consent, obtaining and using the personal information of consumers is unfair and deceitful. In the long run, this will be extremely beneficial to consumers, as their rights will be protected and they will release personal information only as per their choice. Collecting personal information without permission is unjust and illegal, and it should not be encouraged as it is an unfair trade practice, he concluded.

Also Read: Government announces draft bill on personal data protection; proposes penalty of up to Rs 500 cr