Follow this thread for live updates from @Vidhi_India's online roundtable discussion titled 'From PDP Bill, 2019 to Data Protection Bill, 2021 and Beyond’ which will begin shortly. 👇🏽

#DataProtection #Privacy
The roundtable will feature @matthan, @VrindaBhandari, Matthias Goetz, Malvika Raghavan, Supratim Chakraborty, Professor Subhashis Banerjee, Vyom Upadhyay, and @TrisheeGoyal.

The discussion will be moderated by @Arghya_justify.

#DataPrivacy
Roundtable begins with introductions of the panel.
#DataPrivacy
The panel begins with opening remarks.

Vyom Upadhyay speaks on Businesses and data protection: one thing I can say is, in financial services concepts like "do not call" have been in place for quite sometime.
Of course, as we go along there will be lot of other areas which will get regulated: Upadhyay.
Upadhyay: We need to detail out what is personal data.. here I take an example of a bank statement- it has lot of personal data. But then, there will be some financial data.
Upadhyay: Free & fair consent is a must. Having said that, there are some things we need to gaurd against- kind of data being parted with is not explained.
Upadhyay emphasises on also classifying data.
Supratim Chakraborty: they key recommendations are the timeline for implementation- it is a welcome move.

A common framework for personal and non-personal data.

The third one is, data localisation.
Supratim Chakraborty: you also have new mechanisms for certification.

Next is, crystallization of norms for datat breaches.

Processing of children's data finds more refinement.

There are aspects of processing employee data.
Supratim Chakraborty: The question is, is this the right time to have non-personal data to be included in this legislation?

Three cardinal issues pointed out by the committee are- non-personal data can affect privacy, difficult to differentiate b/w personal and non-personal..
Supratim Chakraborty: There is no harm in having two different laws, but one regulator. The point is we can have a single regulator dealing with two different legislators.
@VrindaBhandari: Even oringinally the Data Protection Bill missed an opportunity for surveillance reform. It could have played a very imp role.

This is particularly imp in India for two reasons..

#DataPrivacy
@VrindaBhandari: India does not regulate it's intelligent agencies. Given that, it was imp to have done something on surveillance reform.

Even looking at what we have.. there are two sections- 35 because of its blanket exemption of govt. agencies.

#DataPrivacy
@VrindaBhandari: the most incidious is Section 36- it applies to even RWAs. It allows the exception of most of the act.

#DataPrivacy
Prof. Banerjee: I won't try to discuss solutions, but will raise concerns in the PDP Bill. First one is - consent.

The second problematic issue is anonymisation. The number of times it will succeed is close to zero.
Prof. Banerjee: the third most imp. concern is what is the level of due diligence that is adequate, who defines the standard?

If this is not clearly specified, there will be a wide gap in interpretation.
Prof. Banerjee: I also find that the exception clauses are too broad.

The due diligence that had gone into the DPA Bill is completely inadequate.
Malavika Raghavan: theres a good news and bad news.

The good news is there is a DPA, the bad news is it might be struggling for oxygen.
Malavika Raghavan: the fact that the DPA both has immense responsibilities but has immense constraints on resources.
@TrisheeGoyal on protection of minors' data: what the JPC does is it removes the entire concept of gaurdian data fiduciaries. While this sounds good in principle, it doesn't translate well in practice.

The design is not proportionate to the risk these minors face.
@TrisheeGoyal: It is a classic case of overregulation. It effectively "age gates" the entire internet.

Even in S. 16(4) there is a lack of clarity.

Just to tie up what Malavika has pointed out, there are concerns to age of 18 years. There are capacity constraint issues.
@matthan: first of all, as much as we're all bemoaning the problems of the current draft.

It's perhaps more dangerous not to have a data protection law. In my view, 80% of the law is excellent.

I agree that the remaining is flawed.
@matthan: What we need to do now- let's assume that the draft will get passed.

Really the very first step, even companies that are GDPR compliant will require a lot of work.
Matthias Goetz: From a European perspective, I think we have reached the end of the tunnel and there is some light. The GDPR journey started in 2016, and became enforceable in 2018.
Matthias Goetz: During the transition period, everything became slow and shortly before the end of the period, there was a huge rush.

The second phase was from the enforcement kick off date- companies were wondering what the fuss was about.
Matthias Goetz: Now, in the third phase, data protection authorities have handed out fines.

Then, companies started worrying again.
Matthias Goetz: There are a lot of challenges we're still facing. Like how to obtain valid consent, individuals who claim damages.

#DataPrivacy
Matthias Goetz: It's still a work in progress.
@Arghya_justify highlights three issues to be discussed: the question of enforcement, social media intermediaries and how do we operationalise consent.

#DataPrivacy
Prof. Banerjee speaks on consent: Consent sometimes presents a false choice. I think that you need a mechanism over and above it- an accountability based model.
Vyom Upadhyay on consent: There are two or three ways to look at consent: did I make my intention clear?

The intent should be disclosed to the customer and of course, it has a time frame associated with it.
Vyom Upadhyay on consent: More templatised it becomes, the more understandable it is. These are things that come up.
@VrindaBhandari: I really think, as a good practice, putting it in a short, easy to understand in a visual manner. Things like images and how you present different options.

Another good practice is, add the time of moment consent and ease with which you can change your settings
@matthan: Like what @VrindaBhandari says, we've got a number of tools and we've gotta optimise those tools.

Granular, in time consent is absolutely relevant but cannot be used for advertisments.. we have to use the correct tools in a correct way.

#DataPrivacy
On enforcement, Malavika Raghavan: I do believe there is a need to leverage technology. It means that the few people you have, need to change to polycentric governance.
Malavika Raghavan: To give an eg, Apple changed the way their app-tracking was happening. It's things like that, what are the technically enacted mechanisms..
Prof. Banerjee on the same thought: Any digitisation that you put in there is a certain risk of privacy.

What is the minimal privacy risk? Unless you discuss these terms you can never come to a proportionality test.
Supratim Chakraborty: the way I'm observing it, there is too much at the hands of this DPA. one thought process is, do we need them at the state-level?

Ultimately, we will need more manforce, resource and genuine effort.
Matthias Goetz, on working with different DPAs: Not only do we have DPAs across member-states and in Germany, we have a DPA in every federal state in Germany.

I personally think it's a much better system to ensure enforcement. There is a kind of pressure.
@matthan, on enforcement: it goes down to the tools, audit is a tool. If we can take off the burden from the DPA, in an efficient way- we should do it.

we've tried these type of approaches in numerous sectors- corporate, airline, health etc.
The devil is in the detail, of course. The regulator needs to completely be in control of the audit process, but at the same time audits are very effective tools: @matthan
Vyom Upadhyay: If you add personal plus non-personal data, it is the entire universe of data. We'll need clarity on what the "sandbox" means.

Clearly, non-personal data holds a lot of value to organisations.
@VrindaBhandari: Yes, we need to regulate non-personal data but I don't think the PDD is the right place to do it.

It is too fast. To expect six members to have the breadth of knowledge, I don't think is fair.

I think it would have been better to separate them.
Supratim Chakraborty, on inclusion of social media intermediaries: This law is supposed to be an umbrella legislation to data protection. The granular issues.. why are we going down the same route? This is definitely not the place.
Matthias Goetz: we have a framework for protection of personal data.. you can't cover everything under one law. It is simply not possible.
@matthan: In its design it is a principle based legislation, and the principles cascade down to sectors.

Another tension is, how this is gonna play with other strong regulators, for eg: the RBI, the CCI. So, the CCI belives it too can regulate.
@matthan: Our regulations, don't have a great track record of working together. In the end, it's us left to figure out what to comply with.
Prof. Banerjee: I don't think there can be anything called technology enacted accountability.
Malavika Raghavan: The entire idea is any regulation is socio-technical.

Beyond consent what you need is a structure that is more fair.
@Arghya_justify points out three succinct points from the roundtable.

1. We need a law.

2. focus on personal data protection.

3. We need start developing the codes of practice, standards which give meat to concepts such as consent.
Justice Sri Krishna: All law is directed towards human beings- how are you going to control their behaviour?

The issue will be there will be covered by Fundamental Rights, not covered and data which will be intertwined.
Justice Sri Krishna: We will come across a situation where you take an egg that you say half of it you will boil.
@Arghya_justify wraps up the webinar by thanking everyone on the panel and attendees.

-Webinar ends-

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Bar & Bench - Live Threads

Bar & Bench - Live Threads Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @lawbarandbench

Jan 19
#DelhiHighCourt to continue hearing a batch of petitions demanding criminalisation of #MaritalRape
barandbench.com/news/litigatio…
A bench of Justices Rajiv Shakdher and C Hari Shankar will hear the arguments of Sr Advocate Rebecca John.
Hearing is likely to start at 3 pm.
#DelhiHighCourt #MaritalRape
Read 66 tweets
Jan 19
The #SupremeCourt continues hearing the matter of reservation in Maharashtra local bodies election.
#Maharashtra govt had urged the SC to recall order renotifying 27% OBC seats as those of general category.
Sr Adv Vikas Singh: Your lordship's first judgment was 4/3/21. The point here was that the statute had provided for reservation so like the constitution bench judgment in K Krishnamurthy, you read down the statute saying it's only enabling
Singh: The question arose why provide reservation on backwardness when we are numerically large. Your lordship held that it is for service purpose.

SC: Your HC writ petition was for what relief?

Singh: Same thing.

SC: Was it withdrawn then?

Singh: Let me check.
Read 33 tweets
Jan 19
Sr Adv Mahesh Jethmalani presents a rejoinder in the case of suspension of Ashish Shelar and 11 other BJP MLAs from the Maharashtra Legislative Assembly.
#SupremeCourt
Sr Adv Mahesh Jethmalani: The power of the house to suspend is not under question. Mr Sundaram's argument is the period of suspension can be determined at the will and pleasure of the House. He seeks to buttress this proposition by Raja Rampal.
Jethmalani: The proposition of laws by the majority in para 431, only ground is ground of judicial review and nothing else and he gives no reason why the same should be ignored.
This was the sum of arguments of State of Maharashtra
Read 47 tweets
Jan 18
#DelhiHighCourt will start hearing a batch of petitions demanding criminalisation of #MaritalRape
On Monday, Centre had said that it will frame a 'considered and consultative view' on the issue very soon.
barandbench.com/news/marital-r…
A bench of Justices Rajiv Shakdher and C Hari Shankar will hear the matter.
Sr Advocate and Amicus Curiae Rajshekhar Rao will continue with his arguments today.
#DelhiHighCourt #MaritalRape
Read 73 tweets
Jan 18
The #SupremeCourt bench led by Justice Khanwilkar to hear pleas by #BJP MLAs led by Ashish Shelar challenging Maharashtra Legislative Assembly’s resolution of suspending them for a period of 1 year.
Sr Adv Aryama Sundaram: How far would the scope of judicial review apply for punishment?

SC: It will be a like a case of interpretative process. It's not about judicial review.

Sundaram: What your lordship feel is in 190(4) limits have to be applied.
Sundaram: The power of legislature to punish for privileges etc does not have any limitations either in scope of the power or period for which it can be exercised.
How far does this power go?

SC: If legislature makes rules or act, would there not be on the parliamentary act?
Read 95 tweets
Jan 17
#SupremeCourt to hear PIL seeking direction to priorities disabled person for vaccination who are at a higher risk of getting #COVID19 infection.
#Vaccination Image
ASG Aishwarya Bhati: if you could look at our affidavit dated 13.1.22. All the guidelines are met.

SC: Let us look at it.

Bhati: It might be filed on 15th, it's dated 13th.
SC: We will take this matter tomorrow. You've given the affidavits no?

ASG: Your lordship might take 21 (Evara) and 22(DCPCR) together tomorrow.

Adv Nilesh Ojha: Our suggestion is not taken.

SC: We'll take it tomorrow.
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(