Notes from the IAPP Asia Managing Director, 1 September 2017

Namaste from Bangalore!   

What an interesting month it has been in privacy. August has also been the wettest month I can remember, with parts of Nepal, Bangladesh and Northern India under water and Hong Kong and Macau being struck by a mega typhoon last week. Our thoughts are with those affected, as well as those in Houston, Texas. There was also monsoon rain in Bangalore, but it has now dried up. The same cannot be said of the enthusiasm of privacy professionals in India as they gathered together for the third annual India Privacy Summit in Bangalore.

Among the interesting presentations, ranging from APEC CBPRs to the internet of things, the buzz is, of course, about the landmark ruling last week by the Supreme Court that the right to privacy is a fundamental right. Over the coming months, India’s privacy pros will be considering the verdict, which is seen as a potential setback to the government but welcomed by those concerned about the protection of personal data. There are expected to be some "narrowly defined exceptions," and, no doubt, lawyers on all sides will be busy poring over the verdict in detail and considering the implications. Coming into sharper focus is the likelihood of an overarching privacy/data protection law in India and the subsequent implications of that on other laws and rulings related to Aadhaar, such as those related to the Income Tax for example.  

There has never been a better time to be privacy professional!

It has been an interesting few weeks in China, as well. In what is thought to be the first reported enforcements under the Cybersecurity Law, there were at least five known enforcement actions by local Public Security Bureaus in Guangdong, Shanxi, Jiangsu, and Sichuan provinces, and the Chongqing municipality, since the Cybersecurity Law came into force 1 June. As far as we know, the enforcements involved only warnings and orders to correct the issues, with no fines or criminal penalties being imposed. 

While those enforcements did not give much insight into how the law may be enforced going forward, it was separately announced that the Cyberspace Administration had started investigations into certain service providers, including Tencent WeChat, Sina Weibo and Baidu Tieba. The CSA would examine whether the service providers had been disseminating information in violation of the law, as it pertains to national security, public security and social order or whether they had failed to exercise their management duties over “prohibited information” disseminated by their users. “Prohibited information” is wide ranging and includes violent or horrific contents, fake rumors, pornographic materials and any other information that endangers national security, public security or social order. In the announcement, the CSA indicated that it would seriously implement the Cybersecurity Law, step up its monitoring of internet content, and prosecute violations of the law.

Until next time, stay dry!