C&L October 2017_LR (5)

Feature
...Continued from Page 5
and historical research based on data
collected and processed. The European
Union Regulation of 201629 of
the European Parliament and of the
Council of 27 April 2016 on the protection
of natural persons with regard to
the processing of personal data and
on the free movement of such data
may provide useful guidance in this
regard. The State must ensure that,”
said Justice Kaul in his judgment.
With such unambiguous, unequivocal
and forceful recommendation by the
highest court of the country, the efforts
towards formulating a data protections
law are only expected to accelerate.
As such, the government had initiated
some first steps in that direction.
In July, the Ministry of Electronics and
Information Technology (MeitY) constituted
a committee of experts under
the chairmanship of Justice B N Srikrishna,
former Judge of the Supreme
Court, to identify key data protection
issues and recommend methods
for addressing them. Its brief also
includes creation of a draft data protection
bill. Members of the committee
include Dr Gulshan Rai, National
Cyber Security Coordinator; Prof
Rajat Moona, Director, lIT, Raipur and
a noted cyber security expert and Ajay
Bhushan, CEOof Unique Identification
Authority of India among others.
Interestingly, a private member
bill called Data (Privacy and Protection)
has been introduced by Biju
Janata Dal MP Baijayant Panda in
the Parliament. The draft bill is
based on the major issues addressed
by the European GDPR.
Implications for
enterprises
The EU GDPR defines a data 'controller'
as ‘the natural or legal person,
public authority, agency or other
body’ which, alone or jointly with
others, determines the purposes and
means of the processing of personal
data. Similarly it defines a processor
as an entity that processes data on
behalf of the controller.
The non-state actors referred to by
the judges are typically commercial
companies who use an individual’s
data for their business purpose. Most
commercial agencies, especially those
engaged in large scale B2C business,
would fall under the definition of data
controllers in the EU GDPR definition.
And certain category of businesses
would typically be classified
as data processors. While in the EU
definition, a processor is defined as
someone who does the processing of
personal data ‘on behalf of the controller’,
it may not be defined that way
necessarily. For example, the private
member bill introduced by BJD MP
Panda, defines a processor as someone
‘who processes data independently
or on behalf of a data controller’.
In short, most businesses would fall
under one or both the definitions and
will have to comply with the new set
of regulations. A limited exposure
to EU GDPR—such as by companies
who do business there or who provide
IT or BPO services to European companies—has
already resulted in many
companies scrambling to comply. A
full-fledged Indian data protection
regime will result in several compliance
requirements.
Once that happens, it is a no brainer
that the CISOs and CIOs will have
to drive this new set of compliance
requirements.
Here is a look at some of the obligations
that may come your company’s
way. While you may have some of
those in place already if your sectoral
regulations require that, most of them
would be new for most companies.
While all of them may not require
you to ‘show’ something (like
appointing a Data Protection Officer)
immediately, you nevertheless need
to ensure that the obligations are met.
An Indian draft data protection bill is
yet to be ready and is a specific brief
for the committee appointed by the
Government under the chairmanship
of Justice Srikrishna. So, most of the
possible requirements that are presented
here are taken from European
GDPR’s principles, if not its exact
regulatory requirements.
In the discussion, we will refer to
data controller/processors as businesses
or enterprises though it may
apply to other types of entities as well.
Possible Issues/
Requirements
Purpose of processing: The controller
or processor has to clearly mention
the purpose of collecting/processing
data. That is because using the data for
anything else other than the original
purpose for which it was collected has
to have explicit consent of the individual
concerned, also referred to as data
subject. The onus of ensuring that will
be on the enterprises.
Consent of the individual: One of
the requirements of the European
GDPR is that “where processing
is based on consent, the controller
shall be able to demonstrate that the
data subject has consented to processing
of his or her personal data.”
It further mandates that the request
for consent cannot be fine print as
is the case today. It should be very
clear and in plain language. Further,
the companies should be able
to make it easy for the individual to
withdraw consent any time. Whether
the consent us taken through
paper-based documents or electronic
means, business organizations
have to put the systems in place to
make it possible. “Making it easy for
the individual’ has to be defined and
that may go through change from
time to time.
Right of access by the data subject:
One of the possible requirements from
the companies dealing with individual
data would be to provide the data
subjects with access to their own data
as well as additional information like
the period for which the data would
be stored; who will be provided access
to that data, if it would be transferred
beyond the boundaries of the country…the
list may keep changing.
October 2017 | CIO&LEADER
7