The Indian Parliament moved one step closer to passing what would be the nation’s first comprehensive data protection law when, in December, a joint committee released a long-awaited report that
However, the committee widened the scope of the bill to cover both personal and non-personal data, a modification that is reflected in the proposed renaming of the bill to the Data Protection Act. According to the report, part of the committee’s rationale behind this is that segregating personal data from non-personal data is not always possible throughout the information life cycle. There is also a need to harmonize government regulation of data. Correspondingly, the committee expanded the scope of authority for the proposed data protection authority (which the bill creates) by giving it the power to regulate both types of data.
DPOs only for “significant data fiduciaries”
Only a subset of entities would be required to designate DPOs under the bill, but how the Indian government will distinguish such entities remains unclear. This is because the bill applies to data fiduciaries, which are defined as any person (including government entities), company, non-governmental organization or any individual or entity who processes personal information, including third parties. Only certain “significant” data fiduciaries must appoint DPOs, but such designation will occur only after the bill is passed and by regulatory fiat. In other words, the bill must be enacted for firms to know their data fiduciary designation and whether they need to comply with the DPO provisions.
Determining which entity is a “significant” data fiduciary is one of the many regulatory responsibilities given to the DPA. Importantly, the bill authorizes the DPA to designate entire classes of significant data fiduciaries such as any social media platform, which is defined by the bill as a platform that primarily or solely enables online interactions between users and allows them to create, upload, share, disseminate, modify, or access information using the platform’s services.
Such social media platforms are considered significant data fiduciaries if they meet two factors. First, if they have a certain threshold of users that will be determined by the DPA in the future. The bill authorizes the DPA to create separate classes of social media platforms. Second, platforms whose actions are likely to have a significant impact on the “sovereignty and integrity of India, electoral democracy,” national security, and public order.
Thus, while it remains unclear which entities will be designated as significant data fiduciaries, these factors provided by Parliament offer a glimpse at the legislation’s main target: Big Tech firms that have the potential to significantly affect public order in India. It is therefore not surprising that the bill stipulates requisite experience and managerial power for any DPO appointed by significant data fiduciaries, but DPOs’ independence from other facets of their organizations is not stipulated.
DPO requisite experience and rank
The committee’s conclusion that DPOs serve a key role in ensuring widespread compliance with the bill is evidenced by the fact that it recommends that DPOs must be senior-level officers or key managerial personnel with enough qualifications and experience for carrying out their duties.
DPOs’ specific responsibilities include:
- Providing information and advice to their organizations on all matters relating to compliance with the act.
- Monitoring the personal data processing activities of the organization to ensure compliance.
- Serving as the point-person for assisting or otherwise cooperating with the DPA on compliance matters. Relatedly, serving as the point of contact for the purpose of grievance redressal and other such contact methods, further details of which are provided in Clause 32.
- Advising their organization on the development of internal mechanisms and controls to ensure compliance with the compulsory privacy by design policy under Clause 22.
- Overseeing and reviewing the data protection impact assessments required under Clause 27.
It is important to note that the bill does not require DPOs to be personnel that are independent from other departments within their organization. Instead, DPOs may be IT professionals or other employees with requisite experience from other departments within their organization. One expert notes that the Indian government may institute DPO independence requirements once the bill is passed and its provisions begin to go into effect.
Finally, the bill requires DPOs maintain an “inventory of records” to demonstrate compliance with the act. Such records include data protection impact assessments and the key events of individuals’ data life cycle held by organizations such as collection, transfers and erasure. DPOs must also keep records on other organizational security safeguards described in Clause 24, and the categories of compulsive recordkeeping are subject to change as the legislation authorizes the DPA to promulgate further regulations.
DPOs of significant data fiduciaries must be located within India, and DPOs must represent the processing activities of their employers in India. Because the scope of the law applies to international firms conducting significant data processing operations within India, the requirement that DPOs be always present in India seems to apply to Indian subsidiaries whose parent companies reside in, for example, the United States, although it is not immediately clear whether the parent’s DPO would need to be in India or whether the DPO of the subsidiary would suffice. Clarification in the form of regulations is expected by the DPA in the future.
Enforceability and accountability
The bill enforces the DPO requirement by authorizing fines against significant data fiduciaries in the amount of five crore rupees (roughly US$672,000) or two percent of its global revenues, whichever is higher. The bill imposes liability on any person who violates the act, including DPOs. But unlike other sections of the bill that provide statutory penalties for violating the act, the section that creates liability for private-sector DPOs, Clause 85, stops short of providing what kinds of penalties DPOs could reasonably expect.
Conclusion
Some controversial aspects of the committee’s report, such as the widened scope to non-personal data, have reignited debate in Parliament, calling into question the fate of the legislation in the process. Despite the uncertainty, both Parliament and the joint committee appear determined to include at least some provisions mandating that certain large data processing entities designate DPOs because of their key compliance roles in instilling accountability in the realm of Indian Big Tech.
Photo by Srikanth D on Unsplash
