The long-awaited Personal Data Protection Bill, 2018 is likely to be tabled in the upcoming winter session of Parliament. However, due to growing discontent related to proposed provisions, the Ministry of Electronics and Information Technology sought comments in August from select stakeholders. The proposed bill introduces provisions related to privacy by design, conditions for cross-border data transfer and guardian data fiduciaries, making it vastly different from the existing data protection framework. After the proposed bill is enacted, the future Data Protection Authority and the Central Government will need to address 82 action items within a specified time period. These relate mainly to prescribed rules that provide details regarding implementation of certain key provisions of the bill, such as the appropriate action to be taken in response to a personal data breach, time period to address the rights of the data principals, specifying the reasonable purposes for which the personal data can be processed.

Despite the bare minimum data protection requirements required by the existing legal framework (IT Act SPDI Rules), the state of compliance of Indian organizations is rather worrisome. The extraterritorial enforcement of the EU General Data Protection Regulation may have made privacy compliance a necessity in some of the organizations that are data processors for the purposes of the regulation, but a large number of organizations still seem unaffected by it. Regardless of the lack of clarity in some of the key provisions, Indian organizations need to start incorporating the minimum requirements of implementing a data protection legislation by learning significantly from the effect of the GDPR on European organizations.

Hiring privacy teams

The GDPR preparedness survey for Indian organizations highlights a surge in the Indian market for privacy professionals. Hiring the right individuals with the necessary expertise to manage and implement the requirements of the GDPR was considered a priority. Similar hiring processes based on the size of the organization should be initiated to establish a privacy program in accordance with the provisions of the enacted framework.

Privacy as a boardroom issue

During the GDPR implementation phase, it was observed that for the privacy program of the organization to be successful, privacy compliance must be a part of the business policy and practices and must receive board level support. Similar board-level support is required in Indian organization to counteract the disruption caused as a result of an overwhelming difference between India’s existing framework and the proposed bill. The disruption can be counteracted by significant financial investment in the privacy program, which is easier to achieve if privacy is a board-level matter. Apart from the budget, the requirement to train employees for implementing the policies that are part of the privacy programs should stem from the board. Appropriate reporting lines between the head of the privacy program and the board must be set up to demonstrate the ongoing support of the board.

Creating a data inventory

The obligations imposed by the provisions of the bill require organizations to have a holistic understanding of the flow of personal data within their organization, i.e., organizations must understand what data is collected, details regarding further transmission of such data, and details regarding storage and retention of the data. Knowledge of this life cycle is essential for the organization to respond to data principal requests within the required time period and to meet the requirements related to storage and destruction of personal data. Until the rules related to the form of record keeping is released by the Data Protection Authority, a detailed data inventory can be compiled to demonstrate and map the personal data within the organization.

Data minimization

During the implementation phase of the GDPR, organizations acknowledged the importance of deleting outdated personal data and storing only such personal data that was essential for achieving their stated purposes in an effort to avoid unjustifiable data exposure. Data minimization is an essential part of data governance programs as it reduces overhead costs of data storage and maintenance. Based on the data inventory, Indian organizations must start determining the nexus between personal data collected and purpose of processing such data. Any such data that doesn’t meet the rational nexus test must be destroyed.

Vendor management program

In the aftermath of the enforcement of the GDPR, many data controllers have changed their vendors (data processors) due to their security and privacy posture. Despite the lack of GDPR-level clarity on appointing vendors in accordance with the bill, Indian organizations should start evaluating vendors based on their existing information security controls, mechanisms for secure transfer, and subsequent destruction of personal data and their incident response procedures.

Upgrade privacy policies

The obligation of ensuring transparency of processing activities through a privacy policy remains the same in the GDPR and Indian bill. The state of privacy policy compliance with the sensitive personal data or information rules remains worrisome. The transparency guidelines of the Article 29 Working Party should act as best practices and guide the Indian organizations in presenting information in a way that avoids information fatigue, i.e., in a clear, concise and layered fashion.

Public awareness by the Data Protection Authority of India

During the initial period of implementation of the law, it is essential for the future Data Protection Authority to fulfill its function of promoting public awareness regarding the obligations on the organizations and the importance of protection of personal data in general. To address such a wide mandate, the DPA can look toward actions taken by its counterparts as a response to the GDPR. Awareness campaigns targeting data subjects, data controllers and other relevant stakeholders across cities can be initiated. A helpline mechanism that is accessible to the data subjects, as well as the data controllers and processors, should be made available and the existence of these services must be publicized.

Owing to the current state of privacy in the country and the numerous differences between the existing data protection framework and the proposed bill, the probability of crisis during the implementation phase is high. Lessons learned from the challenges faced by European organizations and their data protection authorities should act as a guidance document for a smoother implementation period in the country.

Photo by Srikanth D on Unsplash