On Dec. 16, 2021, the Joint Parliamentary Committee submitted its report on the Personal Data Protection Bill, 2019 to Parliament. Interestingly, the report reinstates the concept of “consent managers” and recommends its insertion into the definition clause of the upcoming Data Protection Act. Now, Clause 3 (11) of the Bill defines consent managers as a “Data Fiduciary which enables a Data Principal to give, withdraw, review and manage his consent through an accessible, transparent and interoperable platform.” But the Bill is silent on the details of the why’s and how’s of this novel entity. It is worth exploring what consent managers would do and what we can expect and prepare for.

In September 2021, the Reserve Bank of India launched account aggregators to facilitate the consented transfer of financial data between regulated financial entities (banks, insurance companies, pension funds, etc.). AAs are RBI-approved independent entities tasked to obtain, submit, and manage customers’ consent through a technical legal framework that incorporates legal principles for consented sharing. In essence, AAs are consent managers in the financial sector and are referred to in the PDPB as consent managers.

The genesis and importance of the consent manager framework

India’s decision to adopt a fiduciary approach to privacy protection was influenced by recommendations of the Justice Sri Krishna Committee in August 2018. This is evident in the objectives and provisions of the Bill. In an effort to establish the concept of trust, the bill provides data subjects (known as data principals in the PDPB) with rights and imposes obligations on corporates to uphold and protect these rights. “Consent” is the foundation for privacy protection and individual autonomy in the data privacy framework. India is an incredibly diverse nation, and thereby operationalizing effective consent would need more than legal and regulatory controls. Under the bill, consent managers are third-party entities that digitally enable consent through an interoperable technology framework India will be the only country to statutorily recognize and adopt a tripartite model for data sharing.

What are consent managers?

Under the Bill, consent managers are independent entities entrusted to manage data subjects’ consent for sharing data through an interoperable, secure and transparent platform. They will be regulated by the data protection authority and operate within the paradigms of the electronic consent framework established by the Ministry of Electronics and Information Technology. The MeitY has already released a set of technology standards for electronic consent.

How would they work?

There are three participating entities within the consent manager framework: Information providers are the original custodians of data. These entities collect and store the individual’s data. Information users are entities requiring data from the data subject for providing certain services. And, finally, consent managers are entities licensed by the Authority to facilitate consent for sharing data.

All three will operate over a common network. Based on specifications provided by the Authority and MeitY, application programming interfaces will be developed to connect to the network. The government will impanel independent certifying agencies to confirm compliance with the required standards for all the participants. Once the consent manager system is operational, the following steps must be taken to ensure compliance: The data subject will need to register with a consent manager and select from a list of information providers linked to their account. They will then select an information user and the services they wish to use. Once chosen, the information user will send an electronic data transfer request to the consent manager to fulfill the service request. The individual will then review and give consent for the information to be shared with the information user. Once the request has been approved, the consent manager will notify the information provider of the transfer request. Finally, the information provider will transfer the data to the information user in an encrypted form.

Data transferred through the consent manager will be encrypted and flow from the data fiduciary to the data user. Consent managers will not be able to view the data.

Use cases in the banking sector

Currently, seven AAs have received in-principal approval of the RBI. They operate using the standardized consent artifact released by the MeitY and detailed in the September 2016 RBI Master Circular. Significant privacy features of the consent artifact include establishing the identity of the participants; logging of consent flows; consent verification; revocation; security standards; purpose limitation; storage and use limitation. As AAs operate within the consent artifact's strict paradigm, they cannot access, view or store the data flows between the information provider and user. Consent managers will operate similarly regulated by the data protection authority and MeitY. Banks as HDFC, Kotak, ICICI, State Bank of India are a few names using AA for consensual data sharing.

Consent manager framework will play a critical role

The Bill sets out principles for data protection and does not prescribe guidelines for consent. The role of a consent manager is critical in standardizing consent. Companies that can leverage this framework could have a significant advantage in complying with the requirements of the data principles rights and increasing consumer trust. The Bill imposes consent obligations on companies which include:

• Consent for sharing.
• Informed and categorical consent.
• Consent linked to a purpose.
• Consent withdrawal.
• Consent for collection.
• Consent for repurposing and sharing data.
• Consent must be demonstrable by the data fiduciary.

Companies will adopt their own frameworks and practices to comply with these requirements. Codes of conduct developed by the Authority may not help in achieving consent uniformity. A techno-legal automated approach like a consent manager offers a predictable solution. We can expect the following from the consent manager framework:

• Standardization. Since consent managers will incorporate the technical and legal standards specified by the Authority, companies that link their systems to this will, by default, operate in compliance with the law.
• Accuracy and quality. Personal information will flow directly from the information provider to the information user after the data p subject consents to share. The information will flow from the original source to the one in need. This will do away with practices of data scrapping, unauthorized collection from public sources, aggregation websites, etc.
• Consumer trust. User-centricity and customer trust will play a critical role. Consent managers will be approved by the Authority and will operate on standard principles of transparency, trust, control and data minimization.
• Privacy embedded into the design. Like the AAs, consent managers will incorporate privacy into its design by adopting standards specified by regulators.

How can companies prepare themselves to participate with consent managers?

• Organize information for consent preference management. Companies should be ready to effectively process and manage data p subject’s requests as the law gets enacted. Compliance with the data subject’s rights, i.e., consent, sharing of data, access, retention and deletion will be crucial. 
  Context. Corporate entities will need to determine their roles as data users or data providers (data fiduciaries) in the context of their services. Categorizing services and personal data processed against each service could be a good starting point to help link their systems to the network.
• Develop teams. Entities would need to dedicate teams to understanding and communicating the security standards, queries to the Authority and managing audit reporting and technical requirements. 
• Form KPIs and audit trails. Participants in this framework should develop KPIs and audit logs to communicate to their customers and the Authority. This data can be produced annually to their customers which will enable transparency.
• Grievance mechanism. Companies should set up internal grievance units for redressal and guidance.

Conclusion

This article provides an overview of the indicative path of the consent manager framework. However, for this framework to function optimally, long-term industry and government engagement will be required. The industry response to the implementation and use of the AA framework has been positive. We hope the same for the consent managers.

Photo by JK on Unsplash