Best printers for Home

Best Mixer Grinder

Best wired Earphones

Best 43 Inch TV in India

Best Wi Fi Routers

Best Home Theatre in India

Smart Watch under 5000

Best Laptops for Education

Best Laptop for Students

<ul><li>India’s <keyword id="2617070" type="PERSON" weightage="20" keywordseo="Personal-Data-Protection-Bill">Personal Data Protection Bill</keyword>, 2019 is likely to be placed in front of Parliament sometime this month.</li><li>The underlying goal of the proposed laws is to assign rights to users over the collecting, storage and usage of their information.</li><li>However, vague language and open-ended clauses leave room for government overreach and resulting misuse.</li></ul>When it comes to data privacy it looks like users have every option available to them except for the one they want — control over their data. This includes knowing who’s collecting data, where it’s being stored, how it’s being used and what can be done if it's misused instead. There have been one too many instances where personal information, anonymised or not, has been used with bad intentions. One prominent example from recent history was <a href="https://www.businessinsider.in/tech/news/the-cambridge-analytica-whistleblower-explains-how-the-firm-used-facebook-data-to-sway-elections/articleshow/71461113.cms">Cambridge Analytica</a>’s use of data from Facebook to profile voters during the 2016 US Presidential election. With the recent increase in cyber crimes, the government of India is coming up with its own data protection laws, which officials claim is based on the European Union’s General Data Protection Regulations (GDPR). Any data that can identify an individual — either directly or indirectly — is covered under the <keyword id="4839724" type="PERSON" weightage="20" keywordseo="data-protection-bill">Data Protection Bill</keyword>, 2019. This includes names, addresses, financial information, IP addresses, cookies, device IDs and other data. Hobson’s choice that Indian internet users face The bill outlines that an organisation needs to tell an individual from before collecting or using their data. The exceptions to this are if the data is processed under law or court order, for purposes related to employment or for a ‘reasonable’ purpose specified by the Data Protection Authority (DPA) — the nodal organisation that will be looking after the entire framework. Reasonable purposes include the operation of search engines, fraud prevention, mergers and acquisitions, and credit scoring but is not limited to any prescribed scope of activity. Moreover, clause 91 of the bill allows the central government to access anonymised or non-personal data to frame policies in the internet of the ‘digital economy’. “Such provisions show that the proposed law is far more interested in treating data as a resource,” noted the Internet Freedom Foundation (<a href="https://internetfreedom.in/essential-features-of-a-rights-respecting-data-protection-law/">IFF</a>). This indicates that there is still considerable scope for a user’s data to get collected without their consent. The only difference is that instead of a private company exploiting your personal details, it will be the government with little in its way to stop overreach. Even ‘critical’ and ‘sensitive’ data — such as religion, age, gender and other personality identifiers — may be available to the government in the interest of ‘national security’. The vaguely worded clause leaves room for misuse, according to <a href="https://indianexpress.com/article/opinion/columns/personal-data-protection-bill-2019-privacy-laws-7135832/">critics</a>. User rights under the Personal Data Protection Bill: <ul><li>The right to obtain confirmation from the fiduciary on whether their personal data has been processed.*</li><li>The right to seek correction of inaccurate, incomplete, or out-of-date personal data.</li><li>The right to have personal data transferred to any other data fiduciary in certain circumstances</li><li>The right to restrict continuing disclosure of their personal data by a fiduciary, if it is no longer necessary or consent is withdrawn.</li></ul>*A data fiduciary is an entity or individual who decides the means and purpose of processing personal data. Penalties under the Data Protection Bill, 2019: <table style="border-width: initial; border-style: none; table-layout: fixed; width: 468pt;"></colgroup><tbody><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Offence </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Penalty </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Processing or transferring personal data in violation of the Bill </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Fine of ₹15 crore of 4% of annual turnover, whichever is higher </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Failure to conduct a data audit </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Fine of ₹5 crore or 2% of annual turnover, whichever is higher </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Re-identification and processing of de-identified data without consent </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Imprisonment of up to three years, or fine, or both </td></tr></tbody></table> Authority without independence In the case of data misuse, users had to file a complaint under the Information Technology Act, the Indian Penal Code, Consumer Protection Act, Indian Contract Act or look to sectoral regulators until now. With its new set of laws, India hopes to cover all issues under the ambit of the DPA. If there is ever any breach of personal data, the organisation in-charge will have to inform the DPA. After that, however, the apex body will be in charge of deciding whether the data breach should be communicated to the affected users or direct the company to mitigate the threat. The decision making is still not in favour of the users themselves. Moverover, the independence of the DPA has also been <a href="https://thewire.in/tech/india-data-protection-authority-needs-constitutional-entrenchment">called into question</a>. The members that comprise the DPA includes a chairperson and six committee members, which will be appointed by the central government on the recommendation of a selection committee. The committee itself is formed by senior civil servants, including the Cabinet Secretary. Critics claim that the government has too much power to appoint and remove members at its discretion. This also implies a level of ability to influence the members of the DPA and the underlying committee. The Hobson’s choice in front of internet users in India is whether they’re okay with information being used by private companies to make a profit or to hand data over to the government with whom many are <a href="https://www.businessinsider.in/tech/news/what-is-facial-recognition-technology-and-how-india-is-using-it-to-track-down-protestors-and-individuals/articleshow/80782606.cms">facing a trust deficit</a>. SEE ALSO: <a href="https://www.businessinsider.in/india/news/india-is-using-the-quad-alliance-to-get-help-from-the-us-japan-and-australia-to-match-chinas-covid-19-vaccine-push/articleshow/81408044.cms">India is asking the QUAD for money to boost vaccine production and counter China’s moves on the global stage</a> <a href="https://www.businessinsider.in/stock-market/news/gold-prices-are-falling-and-the-worlds-biggest-market-for-the-yellow-metal-is-hoping-for-more-shoppers/articleshow/81406658.cms">Gold prices are falling and the world’s biggest market for the yellow metal is hoping for more shoppers</a> <a href="https://www.businessinsider.in/tech/news/india-blockchain-tech-to-make-sms-more-secure-is-leaving-users-locked-out-of-their-account/articleshow/81409145.cms">India’s blockchain tech to make SMS more secure is leaving users locked out of their accounts — and potentially more at risk</a>

India’s new data protection bill makes a good show of user rights — but can it deliver on its promises?

<ul><li>A group of associations, including the United States Chamber of Commerce, wrote to <keyword id="3658" type="COUNTRY" weightage="20" keywordseo="India">India</keyword>’s minister of Electronics and IT against the implementation of the <keyword id="2617070" type="PERSON" weightage="20" keywordseo="Personal-Data-Protection-Bill">Personal Data Protection Bill</keyword>.</li><li>They expressed that the policy may not necessarily be effective in protecting user data, but it will definitely raise the cost of conducting business in India. </li><li>Major technology players like <keyword id="6354427" type="ORGANIZATION" weightage="20" keywordseo="apple">Apple</keyword>, <keyword id="6355629" type="COMPANY" weightage="20" keywordseo="google">Google</keyword> and Uber are members of these associations.</li></ul>Adding to the pressure on India’s Personal <keyword id="187124" type="ORGANIZATION" weightage="20" keywordseo="Data-Protection">Data Protection</keyword> Bill draft, a group of associations consisting of some of the world’s largest technology companies have <a href="https://economictimes.indiatimes.com/tech/ites/industry-bodies-write-to-it-minister-ravi-shankar-prasad-against-data-bill/articleshow/66062141.cms">written a letter</a> to the country’s minister of Electronic and Information Technology. Members of the group include Apple, <keyword id="10387" type="COMPANY" weightage="20" keywordseo="Microsoft">Microsoft</keyword>, Google, Canon, and Uber, who have jointly raised concerns that while the policy may definitely raise costs by 30-60%, it may not necessarily improve <keyword id="145060" type="ORGANIZATION" weightage="20" keywordseo="data-security">data security</keyword> to such an extent. Rather than propagating no regulation, the businesses have suggested setting up legal conditions for cross-border transfers to enable the free flow of data securely without the need for <keyword id="6441632" type="UNKNOWN" weightage="20" keywordseo="Data-localisation">data localisation</keyword>. Earlier the CEO of Google, Sundar Pichai, had also written a letter to the minister emphasising the importance of the free flow of data for economic growth and digital economy. Even India’s own state, Telangana, which is home to a host of tech firms and companies in the startup space, has expressed its concern that implementation of the bill would hurt their digital ecosystem. The letter was signed by industry associations that include the United States Chamber of Commerce, the United States-India Business Council (USIBC), Japan Electronics and Information Technology Industries Association (JEITA) and DIGITAL EUROPE. Cost of business In the proposed draft bill, the government proposed setting up a legal framework to monitor and supervise the processing of personal data. In that, one of the regulations aims at obtaining specific and explicit consent from individuals. The issue come in with the clause where the stakeholders are obligated to prove specific notices indicating where and how user’s personal data is going to be processed and ensuring that this data is being handled in a way that’s error-free. Not only does this require organisations to pitch in extra resources for implementation, but it means that before implementing any new improvements within the organisation, there would be more compliances to adhere to, increasing the time required. India-based payments companies like Paytm and PhonePe take the opposite stance citing that there’s no reason to oppose the bill. (Image source: IANS)

Groups of foreign companies are lobbying against India's Personal Data Protection Bill

<ul><li>The <keyword id="6355729" type="ORGANIZATION" weightage="20" keywordseo="data">data</keyword> protection bill is one of the major bills to be a part of the winter session of the Parliament.</li><li>As per the draft bill released in 2018, global companies have to store their data locally.</li><li>It also asked businesses to seek user consent before taking their data – by explicitly citing the reasons for use. </li></ul>One of the major bills to be introduced in the winter session of the Indian Parliament is the Data protection bill. From the Cambridge Analytica <a href="https://www.businessinsider.in/tech/apps/news/facebook-data-breach-continues-more-than-a-year-after-cambridge-analytica/articleshow/71941273.cms">scandal</a> to the most recent <a href="https://www.businessinsider.in/tech/apps/news/investigating-the-whatsapp-hack-should-it-be-the-judiciary-or-the-parliament/articleshow/71933271.cms">WhatsApp data breach</a> where an Israeli company spied over the data Indians – left many worried about using platforms they otherwise use every day. In a digital first world where cyber attacks and breaches are common, this bill is a first step in answering the question -- who has access to my data? The draft bill was released in 2018 requires global companies to store their data locally. It also asked businesses to seek user consent before taking their data by explicitly citing the reasons for use. However, it also said that “the State is not required to seek the individual’s consent while providing benefits or services”. The bill has been a point of contention since it was released as corporates would have to restructure the way they work. In spite of the many pain points, experts believe that the bill is the need of the hour.. “Our research showed that 63% of Indian businesses are concerned about being exposed to cyber threats due to employee error. The bill comes at a time when data breaches have cost Indian firms dearly and IT managers having to deal with cyberattacks coming from all directions, that too with a limited budget, outdated technology and a dearth of security expertise,” said Sunil Sharma, managing director sales, Sophos India &amp; SAARC. The bill dictates that personal data that is collected must be processed only for purposes that are clear, specific and lawful - and that makes it a powerful law. “As per the new Data Security Council of India (DSCI) report, India has been the second most cyber-attacks affected country from 2016 to 2018. With this law, we hope to see that corporates will use the personal data of citizens in a responsible, fair and reasonable manner that respects the privacy of the data principal,” said Neelesh Kripalani, Sr. VP and Head – Center of Excellence (CoE), Clover Infotech. The bill also plans to levy heavy penalties for those who violate the norms. Entities which violate sensitive data are liable for a penalty of up to ₹15 crore or 4% of the total worldwide turnover, whichever is more. If non-sensitive personal data safeguard terms are violated, then the penalty will be up to ₹5 crore or 2% of the annual turnover, whichever is more. The bill also puts the user first. “Till now we needed to accept the company’s terms and conditions, where the company used to only state about the usage of the data. But with this bill now it will be mandatory for companies to explain, how the data will be processed or used by them which will make the data handling a transparent process. With this protection bill we will have full self-control of the data,” said Prathamesh Sonsurkar - Cyber security expert &amp; Ethical Hacker. Sonsurkar adds that the bill will bring transparency to the end users, and it will become difficult for the corporates to carry on with malpractices. See Also: <a href="https://www.businessinsider.in/tech/apps/news/investigating-the-whatsapp-hack-should-it-be-the-judiciary-or-the-parliament/articleshow/71933271.cms">Investigating the WhatsApp hack — Parliament probe might trump the judiciary</a> <a href="https://www.businessinsider.in/tech/apps/news/facebook-data-breach-continues-more-than-a-year-after-cambridge-analytica/articleshow/71941273.cms">Facebook data breach continues more than a year after Cambridge Analytica</a>

Personal data protection bill puts user first and has heavy penalties – cyber experts are happy about it

The draft <keyword id="2617070" type="PERSON" weightage="20" keywordseo="Personal-Data-Protection-Bill">personal data protection bill</keyword> that seeks to empower the Centre to exempt any government agency from the provisions of the proposed legislation has the industry worried, as they warn that such exemptions represent "new, significant threats" to the privacy of Indians. The proposed bill also provides for voluntary verification of social media users and transfer of non-personal data. The outcry from industry watchers, analysts and civil society comes amid the draft bill suggesting that the Centre will be empowered to exempt any government agency from the application of the Act and verify social media users.
 One of the provisions of the draft bill states that the Centre can - in the interest of sovereignty, the security of the state, and public order - "direct that all or any of the provisions of this Act shall not apply to any agency of the Government in respect of processing of such personal data..."
 The bill, which was cleared by the Cabinet last week, is likely to be introduced in the Lok Sabha in the next couple of days.
 Mozilla's Policy Advisor Udbhav Tiwari said that if Indians are to be truly protected, it is urgent that Parliament reviews and addresses "these dangerous provisions before they become law".
 "Indians have been waiting for a strong data protection law for years now, and this latest bill delivers real privacy in regards to processing by companies and is a dramatic step backwards in terms of processing and surveillance by the government. Exceptions for government use of data, the verification of social media users, and the forced transfer of non-personal data all represent new, significant threats to Indians' privacy," said Tiwari.
 Mozilla is the not for profit entity behind the web browser Firefox.
 While the bill seeks to protect personal and sensitive data of individuals, it proposes to allow processing of private data without explicit consent in case of security, credit scores, debt recovery, operation of search engines and whistle blowing.
 The draft bill also states that the central government can frame policy for the digital economy with respect to non-personal data. In particular, it can direct any data processor to "provide any personal data anonymised or other non-personal data to enable better targeting of delivery of services or formulation of evidence-based policies by the Central Government".
 Further, social media entities with user base above a certain threshold and whose "actions have, or are likely to have a significant impact on electoral democracy, security of the State, public order or the sovereignty and integrity of India," will be notified as 'significant data fiduciary'.
 Every social media intermediary classified as a 'significant data fiduciary' will enable the users in India to voluntarily verify their accounts. Any user undergoing such voluntarily verification will have to be provided with a mark of verification that is visible to all users of the service. Such entities will also have to get their policies and conduct (of data processing) audited by an independent data auditor.
 Jaspreet Singh, Cyber Security Leader, EY India said termed the Bill a "double-sided sword".
 Singh said that while it protects the personal data of Indians by empowering them with data principal rights, "it bestows the central government with exemptions which are against principles of processing".
 "The State can process even sensitive personal data when required, without an explicit consent from the data principals. However, the government will need to show that any processing of personal data is necessary and processing of sensitive personal data is strictly necessary for the exercise of any function of the State authorised by law for the provision of service or benefit," Singh said.
 These broadly-worded carve-outs "can be misused and hence need to be carefully examined", he cautioned.
 Arun Prabhu, Partner at Cyril Amarchand Mangaldas noted that portions of the bill have been pared down, and some changes such as the lack of a clear implementation timeline, requirement to share non personal data, obligations for social media verification "may be a potential source of concern."
 He, however, said that certain changes made to the Draft Bill are business friendly, providing for increased certainty, a regulatory sandbox for Artificial Intelligence/Machine Learning and other innovative technology, limiting localisation to non-sensitive data and a potential carve out for non-Indian data processed under contract.
 Gartner said that the primary concern will be the execution of the bill across which will include advisory from regulatory bodies such as RBI, IRDAI, SEBI.
 "There must to very clear guidelines which the enterprises can easily follow without relying completely on consulting service providers. Very clear deadlines must be mentioned and clarity on the fines in case of violation must be clearly mentioned and should be available on public website," Rajpreet Kaur, Principal Analyst of Gartner said. SR MBI MR

India's proposed data laws won't apply to the government — businesses cry foul

<ul><li><keyword id="164502" type="PERSON" weightage="20" keywordseo="Sundar-Pichai">Sundar Pichai</keyword>, the CEO of <keyword id="6355629" type="COMPANY" weightage="20" keywordseo="google">Google</keyword>, wrote a letter to the government of India to highlight the importance of data sharing. </li><li>In his opinion, the free flow of data would help the Indian digital economy grow as well as assist the startups. </li><li>It’s a tall order at a time when most nations are implementing protectionist data policies</li></ul>What seems to be a response to the draft bill on the Data Protection Law, the CEO of Google wrote a letter to the Indian government emphasizing the importance of the free flow of data across borders. Sundar Pichai added that the free flow of data is a win-win situation for all stakeholders since it will help global tech companies assist the domestic digital economy as well as Indian startups grow. His letter indicated that the <keyword id="45395" type="CITY" weightage="20" keywordseo="Google-India">Google India</keyword> team would follow up with the government to discuss some of these issues in order to reach a consensus. At a time when most countries around the world are employing protectionist policies across the board, digitally and economically, this is a big ask of Pichai. It’s important to look at the pros and cons of being liberal with user data. <keyword id="6867307" type="UNKNOWN" weightage="20" keywordseo="data-protectionism">Data protectionism</keyword> One of the main concerns of data protectionism is that excessivr regulation can create <a href="https://hbr.org/2018/08/the-dangers-of-digital-protectionism">data islands.</a> Basically, the digital economy would get divided into pockets and there would be an uneven distribution of benefits such as global supply chains or access to information. In fact, experts speculate that there actually three data realms that are being created. Namely the US, the EU and China. With India, the concern is specifically that the <keyword id="2617070" type="PERSON" weightage="20" keywordseo="Personal-Data-Protection-Bill">Personal Data Protection Bill</keyword> will hamper the growth of the digital payments sector that’s currently booming at 30% per year. As per the Global Commission of <keyword id="1062334" type="PERSON" weightage="20" keywordseo="internet-governance">Internet Governance</keyword>, the restrictions on data in the EU <a href="https://www.cigionline.org/publications/tracing-economic-impact-regulations-free-flow-data-and-data-localization">costs</a> them 0.5% of their GDP. Even China, home to startups like Alibaba and Tencent, may face a loss of 1.8-3.4% in its GDP if it localises its data any further <a href="https://www.uschamber.com/sites/default/files/documents/files/preventing_deglobalization_1.pdf">according</a> to the US Chamber of Commerce. In addition to the loss of productivity to the economy, there is also a cost. As the amount of data that can potentially be shared increases, as it inevitably will, the cost of blocking or protecting it will increase alongside. The cost will not only be borne by the government, in terms of surveillance, but also by the companies who will continually have to add new data centers in each country. Data localisation measures also lead to a decrease in efficiency as data chains will be divided into smaller fragments. Sachin Bansal, the co-founder of Flipkart, <a href="https://tech.economictimes.indiatimes.com/news/internet/indias-data-policy-should-factor-in-local-problems-not-mimic-west-sachin-bansal/65443337">stated</a> that the <keyword id="1127619" type="PERSON" weightage="20" keywordseo="data-protection-laws">data protection laws</keyword> in India need to be in line with the requirements of the local economy instead of mimicking what the west has implemented. That being said, the Indian Finance Ministry has proposed to adopt a ‘mirroring’ approach. Essentially multinational companies would still be allowed to aggregate global data provided that a copy data that specifically pertains to Indian citizens, is stored locally as well. Experts argue that, ideally, that the developed economies should lead the conversation on a global scale rather than leave the field open to China, but the stark absence of leadership didn’t leave much of a choice. Putting the free flow of data in the context of laissez faire, the digital economy would definitely benefit from the complete absence of government intervention. But, it would come at a cost. As it is with the concept of free trade in economics, business could engage in risky behaviours that could lead to bigger problems down the road.

Here’s what Sundar Pichai had to say to the Indian government

<ul><li>Being compliant with the European Union’s General Data Protection Regulations (<keyword id="2556126" type="PERSON" weightage="20" keywordseo="GDPR">GDPR</keyword>) won’t necessarily mean that companies are compliant with India’s upcoming <keyword id="431014" type="ORGANIZATION" weightage="20" keywordseo="Personal-Data-Protection">Personal Data Protection</keyword> Bill (PDP).</li><li>The scope of the PDP is broader and will require companies to make changes to their data management policies in order to operate in India.</li><li>Once PDP comes into effect, GDPR compliant companies may only have to make a few changes but new laws will be a sea-change for companies who were only compliant to the existing Indian data protection laws.</li></ul>India is ready to take a stab at formulating its first laws to govern data and it is using the European Union’s General Data Protection Regulations (GDPR) as the template. And, for companies operating in India, this could end up being a stick in the mud. While GDPR and India’s <keyword id="458689" type="PERSON" weightage="20" keywordseo="personal-data">Personal Data</keyword> Protection Bill (PDP) are similar in many ways, the differences between them mean that a company which is compliant in Europe may not necessarily be compliant under the PDP. “The PDP scope of application is broader than that of the GDPR as an entity will fall within scope merely by processing personal data in India when compared to that of GDPR,” Neeraj Dubey, a partner of corporate law at Singh &amp; Associates told Business Insider. <div type="Article" hostid="261" msid="81422687" title="India’s new data protection bill makes a good show of user rights — but can it deliver on its promises?" mstype="2" mssubtype="0"></div> A broader definition of <keyword id="8418566" type="UNKNOWN" weightage="20" keywordseo="sensitive-personal-data">sensitive personal data</keyword> Unlike the GDPR, the PDP has divided data into three categories — personal data, sensitive personal data, and <keyword id="10928418" type="UNKNOWN" weightage="20" keywordseo="critical-personal-data">critical personal data</keyword>. The latter is particularly important since there is no parallel for it in Europe’s laws and it comes with its own unique set of terms and conditions, like being obligated to data localisation. Moreover, India has thrown a wider net over what constitutes sensitive personal data as compared to the GDPR. A company may have to comply even if it merely processes personal data in India, and doesn’t collect the data locally, according to law firm <a href="https://www.privacysecurityacademy.com/wp-content/uploads/2020/05/Comparison-Chart-GDPR-vs.-India-PDPB-2019-Jan.-16-2020.pdf">Covington and Burling.</a> For instance, financial data has been categorised under sensitive personal data. “This is an area of concern as processing of sensitive personal data involves greater compliance requirements. Consequently, the large innovations in fintech space, which is currently being observed in India, may get affected,” points out Supratim Chakraborty, a partner specialising in data privacy and protection at Khaitan &amp; Co. This means even if companies are GDPR compliant, they will have more sorting and more rules to abide by. Government stronghold on critical personal data Not only is critical personal data a new category altogether, companies have to make sure that it is exclusively stored and processed in India. In order to transfer any data that falls into that category outside of India, firms will need additional approval from the Data Protection Authority (DPA) and the Supervisory Authority. “Therefore, compliance with the GDPR may not result in compliance with the PDP, since transfer outside India will depend on approvals and permissions, either by the DPA or the central government,” noted <a href="https://www.mondaq.com/india/privacy/903076/comparative-analysis-general-data-protection-regulation-2016-and-the-personal-data-protection-bill-2019">Ikigai Law</a>. Government intervention doesn’t stop there. The GDPR doesn’t lay out any terms and conditions to monitor anonymised data. The PDP, however, allows the central government to access non-personal data as long as it’s to frame policies in the interest of the ‘digital economy’. For users, <a href="https://www.businessinsider.in/tech/news/indias-new-data-protection-bill-makes-a-good-show-of-user-rights-but-can-it-deliver-on-its-promises/articleshow/81422687.cms">this a bigger question of privacy</a>. Meanwhile, for companies, it implies that anonymisation standards may differ between the two frameworks. “Given the current ambiguity in several key provisions of the PDP, the overreaching powers given to the executive, and the exemptions granted to it under the PDP, adequate safeguards and checks and balance are required to be built into the legislation to prevent any misuse of its provisions” said Namita Viswanath, a partner at IndusLaw. The question of consent While one can understand the requirement of having terms and conditions available to users in multiple languages, especially in a country as diverse as India — it means a lot more work for companies collecting data. While firms only need to cough up consent in English under the GDPR, they will have to arrange for multiple languages under the PDP. India’s data protection framework also proposes setting up ‘consent managers’ — a new type of entity of channelling consent. “Data principal [user] may give or withdraw consent through a “consent manager” whereas no such provision exists under GDPR,” explained Dubey. Penalties under the Data Protection Bill, 2019: <table style="border-width: initial; border-style: none; table-layout: fixed; width: 468pt;"></colgroup><tbody><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Offence </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Penalty </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Processing or transferring personal data in violation of the Bill </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Fine of ₹15 crore of 4% of annual turnover, whichever is higher </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Failure to conduct a data audit </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Fine of ₹5 crore or 2% of annual turnover, whichever is higher </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Re-identification and processing of de-identified data without consent </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Imprisonment of up to three years, or fine, or both </td></tr></tbody></table> ‘Legitimate interests’ versus ‘reasonable purposes’ The GDPR states that data can be retained for a longer time in cases of archiving, research and statistical analysis. The PDP, on the other hand, proposes that data can be retained for longer stretches of time if the user consents or if required in compliance with any obligation under the law. India’s bill also allows companies to process data for ‘reasonable purposes’. However, unlike the GDPR’s ‘legitimate interests’ — which are clearly outlayed — a purpose will be deemed ‘reasonable’ only by the overarching authority, the DPA. This leaves companies with a lot of grey area, in which to operate. “The term ‘reasonable purpose’ is extremely broad and has been left to the subsequent prescription by the DPA, while under the GDPR, the scope of ‘legitimate interest’ can be determined by data controllers on a case-to-case basis,” said Viswanath. To tell or not to tell — who has the power? Under the GDPR, all breaches are to be reported to supervisory authority and to the users as well. India, however, won’t require users to be informed by law. In the case of a data breach, a data company will only have to inform the end users if the DPA deems it so. “Many provisions under the PDP have been left open-ended and for the Central Government or the Data Protection Authority to notify subsequently, leaving a huge scope for potential misuse and room for ongoing regulatory uncertainty,” said Viswanath. SEE ALSO: <a href="https://www.businessinsider.in/policy/society/news/indian-prime-minister-narendra-modi-wants-data-democracy-it-must-avoid-the-flaws-of-the-political-system/articleshow/81060582.cms">Datacracy: Indian Prime Minister's 'data democracy' must avoid the flaws of the country’s political system</a> <a href="https://www.businessinsider.in/tech/news/indias-new-data-protection-bill-makes-a-good-show-of-user-rights-but-can-it-deliver-on-its-promises/articleshow/81422687.cms">India’s new data protection bill makes a good show of user rights — but can it deliver on its promises?</a> <a href="https://www.businessinsider.in/tech/apps/news/whatsapp-signal-and-telegram-face-a-catch-22-situation-as-indias-new-social-media-rules-threaten-encryption/articleshow/81221070.cms">Whatsapp, Signal and Telegram face a catch-22 situation as India’s new social media rules threaten encryption</a>

Being GDPR compliant doesn't necessarily make companies ready for India's upcoming data protection laws

<ul><li>The Indian government has been a strong propagator of <keyword id="6441632" type="UNKNOWN" weightage="20" keywordseo="Data-localisation">data localisation</keyword> stating that it will improve the security and privacy of data. </li><li>A report by ICRIER and IAMAI finds that data localisation is inconsequential to privacy and will weaken fraud detection. </li><li>It also states that the growth and competitiveness of local firms, especially start-ups and small businesses, will be hampered by data localisation. </li></ul>The Internet is getting faster, more people are coming online, data consumption is higher than ever — but so are the amount of <a href="https://www.businessinsider.in/tech/news/oneplus-data-breach-and-how-to-protect-yourself-against-phishing-emails/articleshow/72242175.cms">data breaches</a>. Financial data in India is <a href="https://www.businessinsider.in/whatsapp-gives-in-to-indias-data-localisation-policy/articleshow/66135946.cms">already localised</a> but the government is looking to bring all data under the new regime with the <a href="https://www.businessinsider.in/apple-microsoft-aws-adobe-akamai-and-ibm-want-discussion-on-personal-data-protection-bill-before-parliament/articleshow/69768390.cms">Personal Data Protection Bill 2019</a>. Their argument is that is will make data more secure if it's stored in Indian servers. India's most vocal propagator of data localisation, Mukesh Ambani — the richest man in the country — also believes Indian data should stay in India since '<a href="https://www.businessinsider.in/data-is-the-new-oil-and-indians-shouldnt-have-scarcity-of-it-says-mukesh-ambani/articleshow/57167743.cms">data is the new oil</a>'. Vijay Shekhar Sharma, founder of the payments service PayTM, proposes that data should be 'stringently domiciled'. However, this may not necessarily be the solution to privacy woes, according to a report by ICRIER and IAMAI on the economic implications of cross-border data flows. Not only will data localisation weaken fraud detection but it could also end up costing India $43 billion in trade. It will also be more costly — not just for global firms but local firms as well. As data localisation turns into an entry barrier, it could result in global retaliation and reduced competitiveness. One place, one target, one hit Just because data is stored all in one place, doesn't make it more secure. In fact, like most bank heist movies will tell you, it makes the target easier to hit. This is not only because all of it will be in one place but because most mature financial services companies use integrate global architectures to manage their data — the localisation of data would impair their functionality. According to the ICRIER-IAMAI report, the weakening of fraud detection systems would likely lead to a ten-fold increase in fraud losses in India. "The costs of maintaining and upgrading these systems, unique to each company, will be recurrent and significant," noted the report. It also added, "The location of data is inconsequential to improving privacy outcomes." Data localisation isn't so good for the locals either The digital services market is highly competitive. In order to stay in the running, companies — Indian and otherwise — have to keep their costs as low as possible. With globalisation and the nature of cloud services, companies can store their data wherever they get the best price — even if that's offshore. But this will no longer be the case if data localisation is made mandatory. Not only will this make things more expensive for digital firms, but customers may also have to bear the brunt of higher prices, according to the ICRIER-IAMAI report. In the short run, it is costing small and medium enterprises (SMEs) to migrate to local servers. Indian data centers might not always have the latest features and updates either. That is another long-term pain point. SMEs have also reported that forcing the development of data centers locally won't only increase the direct cost for businesses but also increase indirect costs — like paying for the power supply. Localisation isn't that good for the customers either Data localisation will mean that it will be harder for foreign countries to enter the Indian market — a barrier to entry. With fewer companies populating the market, competitiveness will take a hit. That means two things — one, the quality of products and the level of innovation will reduce and two, prices are likely to increase. According to the report, companies also fear global retaliation if India is too stringent with its localisation measures — such as higher customs and export restrictions. This will, again, increase the cost of products in the country. It's not that India shouldn't implement data location but 'data' shouldn't be used as a blanket term. Softening the localisation measures to critical or sensitive datasets would minimise the opportunity costs. If India keeps its data borders open, it will increase its total volume of goods trade by an estimated $43 billion annually as cross border data flows increase. Over the past year, India's total Internet bandwidth increased by 35% resulting in $24 billion in trade. See also: <a href="https://www.businessinsider.in/india-personal-data-protection-bill-global-ceo-concerns/articleshow/68389336.cms">Here’s what global tech CEOs have to say about India's data protection laws</a> <a href="https://www.businessinsider.in/policy/news/an-indian-lobby-with-the-likes-of-facebook-flipkart-and-microsoft-as-members-is-still-arguing-against-storing-data-in-india/articleshow/71472585.cms">An Indian lobby with the likes of Facebook, Flipkart, and Microsoft as members is still arguing against storing data in India</a> <a href="https://www.businessinsider.in/data-protection-for-indian-businesses-inadequate/articleshow/68613117.cms">Indian companies know how to sell data but not how to protect it</a>

Data localisation won't help 'local' firms or improve privacy — but it could cost India $43 billion

In step to protect data and <keyword id="1491669" type="PERSON" weightage="20" keywordseo="User-privacy">user privacy</keyword>, the government-appointed panel presented their <a href="http://meity.gov.in/writereaddata/files/Personal_Data_Protection_Bill%2C2018_0.pdf">Personal Data Protection Bill</a> to the Indian government on Friday. The bill was accompanied by a report titled, ‘Á Free and Fair Digital Economy: Protecting Privacy, Empowering Indians’. There’s been much ado about its impact on the digital Indian economy. And the fact of the matter is, that the Srikrishna committee’s proposal is essentially a diluted version of the General Data Protection Regulation (<keyword id="2556126" type="PERSON" weightage="20" keywordseo="GDPR">GDPR</keyword>). That may not be the best news for users in terms of privacy and its implementation, but if firms have already started to become GDPR compliant then then Data Protection Bill shouldn’t require many changes for to adhere to, at least for Indian firms. Even international companies, which deal with the data of European users, have already separated how they deal with data coming in from the EU. The guidelines for the restrictions on the volume of data collected, how it is stored, the purpose of data collection, limitation on the use of personal data and notifications for data breaches are all subsets of what has already been put forth by the GDPR. 
 
 <div type="image" title="GDPR and India's Data Protection Bill Overlap" msid="65198889" hostid="261"></div>





 The cost of compliance is the major hurdle that firms, especially startups, will have to overcome. But, experts <a href="https://economictimes.indiatimes.com/small-biz/startups/newsbuzz/big-bill-for-data-privacy-may-cost-startups-dear/articleshow/65191607.cms">point out</a> that provided a Privacy Impact Assessment (PIA) is carried out to analyse how data moves in and out of the organisation, future compliance costs can be avoided. However, the PIA in itself is an added cost. Currently, privacy policies are generic, shorter in length and not available in local languages. The bill has put forward penalties ranging from ₹5-15 crores depending on the severity of non-compliance.

GDPR compliant firms should find it easy to adhere to draft Personal Data Protection Bill in India

<ul><li>The messaging platform, <keyword id="790242" type="COMPANY" weightage="20" keywordseo="WhatsApp">WhatsApp</keyword>, has just announced that it will be building a system that will store the <keyword id="6418677" type="UNKNOWN" weightage="20" keywordseo="payments-data">payments data</keyword> of Indian users locally.</li><li>This announcement comes at a time when most foreign companies are asking for an extension and relaxation of the regulations. </li><li>While the deadline for payments data is 15 October, the <keyword id="2617070" type="PERSON" weightage="20" keywordseo="Personal-Data-Protection-Bill">Personal Data Protection Bill</keyword> draft expands the scope to include all data from Indian users once implemented.</li></ul>After continuous pressure from the <keyword id="3658" type="LOCATION" weightage="20" keywordseo="India">India</keyword>n government as well as India’s nodal banking agency, the <keyword id="6354335" type="ORGANIZATION" weightage="20" keywordseo="reserve-bank-of-india">Reserve Bank of India</keyword> (RBI), Whatsapp has announced that it’s building a system that will <a href="https://economictimes.indiatimes.com/tech/internet/whatsapp-says-it-will-store-payments-data-locally-is-in-compliance-with-rbi/articleshow/66131312.cms" data-type="tilCustomLink" target="_blank" style="">store all payments related data locally.</a> While the messaging giant rolled out its payments feature earlier this year, a full-fledged out option hasn’t been possible because of pending approvals from the National Payments Corporation of India (NPCI) and the RBI. Currently, there are around 1 million people testing the feature according to the company’s spokesperson. The deadline given to all foreign companies with payments apps in India to ensure <keyword id="6441632" type="UNKNOWN" weightage="20" keywordseo="Data-localisation">data localisation</keyword> is 15 October, as per the RBI. The central bank’s directive states that it’s important to have, “unfettered supervisory access to data stored with these system providers”. The bank also specified that the data collected must include all the details of any monetary transaction including the information that was processed as part of the payment instruction. Another one bites the dust Last month, <keyword id="6355629" type="COMPANY" weightage="20" keywordseo="google">Google</keyword> gave in to the demands of the Indian government by agreeing to store Indian users payments-related data within the country. WhatsApp’s announcement of complying with India’s data localisation requests comes when most foreign companies are bidding for more time to put their systems in place as well relaxations on the stringent regulation put forward by the RBI. The draft of the Personal Data Protection Bill also propagates that any data relating to Indian users should be stored locally. This has brought on a number of petitions to the government from foreign firms and associations relaying their concerns about the cost of implementing something like this. According to them, not only will this affect their bottom line, but restricting the free flow of data would take away their ability to bolster India’s digital economy. WhatsApp Payments is only one obstacle that WhatsApp has to overcome. The lingering issue of misinformation being spammed on the messaging service, determining accountability for the string of lynchings that followed and the appointment of a local grievance officer are still issues it has to deal with.

WhatsApp gives in to India’s data localisation policy

<ul><li>Global tech giants like Apple, Microsoft, and Abode feel that there should be another round of discussions before India’s <keyword id="2617070" type="PERSON" weightage="20" keywordseo="Personal-Data-Protection-Bill">Personal Data Protection Bill</keyword> is brought to Parliament. </li><li>Ravi Shankar Prasad, India’s IT minister, on the other hand, wants the Personal Data Protection to be tabled in Parliament as soon as possible.</li><li>Global tech companies with the BSA, the software alliance, say another round of consultations will help account for the bill’s many changes and learn from the GDPR as it completes its first year.</li></ul> The Indian government is pushing for a Personal Data Protection Bill in the parliament as soon as possible but <a href="https://www.businessinsider.in/india-personal-data-protection-bill-global-ceo-concerns/articleshow/68389336.cms">global tech giants</a> want another round of consultation before the bill’s implementation. “Given how the privacy discourse and policy discourse has happened in the last year and also technology has rapidly change. We urge the government to undertake further consultation before they introduce it into the parliament,” Venkatesh Krishnamoorthy, the Country Manager for <keyword id="1681687" type="ORGANIZATION" weightage="20" keywordseo="BSA-India">BSA India</keyword> told Business Insider India. BSA, the software alliance that includes companies like Microsoft, Amazon Web Services (AWS), Intel, Adobe, Akamai, Oracle, IBM and Apple, feel that since the policy that will now be tabled is considerably different from what was originally presented for discussion — another round of inputs would help the companies as well as the Indian government. Rushing to parliament Ravi Shankar Prasad, India’s IT and telecom minister, told the press that taking the Personal Data Protection Bill to parliament will be one of his top priorities during the first 100 days of Prime Minister Narendra Modi’s second term. “In IT, we will try to quickly get the data protection bill to the Parliament and also, notifying the intermediary guidelines,” he said. Before India started out on its journey to address data privacy concerns, the debate had already been ongoing in the US for nearly 20 years and in the EU for over 10 years. The original draft of the Personal Data Protection Bill that was shared in 2018 draws its inspiration from the European Union’s General Data Protection Regulation (GDPR) as well as other legislations around the world. And, given that GDPR has just completed its first year of implementation, Krishnamoorthy feels that there’s a lot that India can learn from the EU’s experience, “It would be beneficial for the government given that GDPR has gone through its anniversary and there were learnings from that. And generally, also there’s been a lot of activity as well, like the G20 Summit in Japan. ” It’s not just that India needs to look at the experience of other countries. The new draft that will be tabled at parliament is considerably different from what was originally presented. “The next version be more robust than what it is currently,” Krishnamoorthy explains. He adds, “It’s a step in the right direction because the time of privacy legislation has come. It’s been a pretty thorough effort trying to come with a comprehensive data protection legislation on the government’s part.” There were <a href="https://www.businessinsider.in/groups-of-foreign-companies-are-lobbying-against-indias-personal-data-protection-bill/articleshow/66070718.cms">many concerns</a> in the first bill with respect to the definitions of data and the mandate of data localisation. BSA is hoping that the final version will have rules that are horizontally applicable. See also: <a href="https://www.businessinsider.in/india-personal-data-protection-bill-global-ceo-concerns/articleshow/68389336.cms">Here’s what global tech CEOs have to say about India's data protection laws</a> <a href="https://www.businessinsider.in/groups-of-foreign-companies-are-lobbying-against-indias-personal-data-protection-bill/articleshow/66070718.cms">Groups of foreign companies are lobbying against India's Personal Data Protection Bill</a> <a href="https://www.businessinsider.in/data-protection-for-indian-businesses-inadequate/articleshow/68613117.cms">Indian companies know how to sell data but not how to protect it</a>

Apple, Amazon, and Microsoft want one more shot at convincing India before data protection bill reaches Parliament

<ul><li>Global tech CEOs have been voicing their concerns against India’s proposed <keyword id="2617070" type="PERSON" weightage="20" keywordseo="Personal-Data-Protection-Bill">Personal Data Protection Bill</keyword> to looks to localise the data of Indian users. </li><li><keyword id="300740" type="PERSON" weightage="20" keywordseo="Ginni-Rometty">Ginni Rometty</keyword>, the CEO of IBM, and data firms like Cognizant and <keyword id="25698" type="CITY" weightage="20" keywordseo="Genpact">Genpact</keyword> are only the most recent companies to flag the potential issues with the bill. </li><li>CEOs of other global companies like Google, Mastercard, Twitter and Qualcomm also have concerns with how the bill will be implemented. </li></ul>The Indian government has been <a href="https://www.businessinsider.in/gdr-compliant-firms-should-find-it-easy-to-adhere-to-proposed-data-protection-bill-in-india/articleshow/65198854.cms">pushing for data localisation</a> in India but companies around the world have their doubts about its efficiency and clarity. The Draft Personal Data Protection Bill suggests that the personal data of Indian users should be held by digital and global firms within and processed only in India. But, global CEOs have been<a href="https://www.businessinsider.in/groups-of-foreign-companies-are-lobbying-against-indias-personal-data-protection-bill/articleshow/66070718.cms"> making a case</a> for how hindering the free flow of data across borders might have “unintended consequences”. One concern is that the regulations that govern the privacy of data should be able to differentiate between user data and data from businesses. Ginni Rometty, the CEO of IBM, said, “We believe strongly in consumer privacy and you have to be careful to not conflate consumer data issues with business-to-business data issues,” in an <a href="https://economictimes.indiatimes.com/tech/ites/differentiate-between-consumer-biz-data-ginni-rometty-ibm-ceo/articleshow/68384341.cms">interview</a> with the Economic Times on Tuesday. Cognizant and Genpact share a similar view flagging the risks to business-to-business data issues in their <a href="https://economictimes.indiatimes.com/tech/ites/as-government-tightens-data-rules-it-firms-flag-risks/articleshow/68384442.cms">annual filing</a> with the US Securities and Exchange Commission (SEC) this week. Cognizant remarked, “Complying with changing regulatory requirements requires us to incur substantial costs, exposes us to potential regulatory action or litigation, and may require changes to our business practices in certain jurisdictions, any of which could materially adversely affect our business operations and operating results.” Genpact also told the SEC, “Evolving laws and regulations in India protecting the use of personal information could also impact our engagements with clients, vendors and employees in India.” Google’s CEO, Sunder Pichai, <a href="https://www.businessinsider.in/heres-what-sundar-pichai-had-to-say-to-the-indian-government/articleshow/65756506.cms">addressed</a> the issue more directly warning the government of the effect that it may have on the ‘Digital India’ program in the country. 
 <div type="ExtQuote" text="&quot;Free flow of data across borders — with a focus on user privacy and security — will encourage startups to innovate and expand globally and encourage global companies to contribute to India's digital economy.&quot;" auname="Sundar Pichai, Google CEO, in a letter to the Indian IT Minister, Ravi Shankar Prasad, thanking him for his visit to the Google’s Mountain View campus in August 2018"></div>

 <keyword id="44475" type="PERSON" weightage="20" keywordseo="Ajay-Banga">Ajay Banga</keyword>, the president and CEO at Mastercard, <a href="https://economictimes.indiatimes.com/tech/internet/localisation-may-not-ensure-data-security-mastercard-chief-ajay-banga/articleshow/66456945.cms">clarifies</a> that global companies aren’t against data localisation because its makes conducting business more expensive — but because it makes it harder to keep data safe. 
 <div type="ExtQuote" text="&quot;When we talk about our lack of support for data localisation, it is not caused so much by expenses. It is caused by the inefficiency of what that does to the ability to provide safety, security and analytics to India’s banks and merchants.&quot;" auname="Ajay Banga, Mastercard’s president and CEO, said at an investor call in October 2018"></div>

 But, some companies believe that the conversation shouldn’t be about localisation in the first place, but about ownership. <keyword id="265395" type="PERSON" weightage="20" keywordseo="Jack-Dorsey">Jack Dorsey</keyword>, the CEO of Twitter, feels that regardless of whether the data sits in India or outside India, individuals should be the ones with absolute control over their information. 
 <div type="ExtQuote" text="&quot;That's the conversation that I think we need to have rather than where exactly the data sits. It's more about the ownership by the individual.&quot;" auname="Jack Dorsey, Twitter CEO, told IANS"></div>

 Facebook’s deputy chief privacy officer, Rob Sherman, did make an <a href="https://www.thehindubusinessline.com/info-tech/social-media/centralised-platform-needed-for-data-privacy-laws-facebook/article24884483.ece">suggest</a> an alternative approach to the problem of data localisation in India at the panel discussion on ‘Digital lows in the Digital Age’. Rather than localise data, the Indian could put a certification process in place instead where digital companies should fulfill the required standards to ensure protection and privacy rather than set up local servers in India to store Indian users data. But there’s also an <a href="https://telecom.economictimes.indiatimes.com/news/qualcomm-opposes-blanket-rule-on-data-localisation/67414442">argument</a> to be made about how changing technology which, in turn, would make any new regulations obsolete when new technology comes into play. Qualcomm’s president, Christiano Amon, notes, “Certain things can be centralised, certain things can be localised, but you can't really have a rule that mandates this.” Sharing Banga’s concerns about the safety of data Amon said, “A regulation like that instead of helping, prevents a company from becoming competitive and make use of the technology…One possible approach is to make sure that the systems they're using, the data are secure.” 
 <div type="ExtQuote" text="&quot;You have to look at it case by case. Because technology moves faster than regulation, I think it is important to take a very pragmatic view.&quot;" auname="Christiano Amon, Qualcomm President"></div>

 Nasscom and the Broadband Indian Forum have also criticized the Draft Personal Data Protection Bill 2018. Global companies are <a href="https://www.dailypioneer.com/2019/columnists/towards-building-a-digital-future.html">calling</a> for the Bill to be consistent with international best practices outlined in the APEC CBPR rules and the OECD privacy framework. See also: <a href="https://www.businessinsider.in/groups-of-foreign-companies-are-lobbying-against-indias-personal-data-protection-bill/articleshow/66070718.cms">Groups of foreign companies are lobbying against India's Personal Data Protection Bill</a> <a href="https://www.businessinsider.in/gdr-compliant-firms-should-find-it-easy-to-adhere-to-proposed-data-protection-bill-in-india/articleshow/65198854.cms">GDPR compliant firms should find it easy to adhere to draft Personal Data Protection Bill in India</a> <a href="https://www.businessinsider.in/india-plans-on-handing-over-the-reins-of-data-privacy-to-the-telecom-industry-watchdog/articleshow/66416519.cms">India plans on handing over the reins of data privacy to the telecom industry watchdog</a>

Here’s what global tech CEOs have to say about India's data protection laws

<ul><li>Global technology companies <keyword id="6355629" type="DEFINITION" weightage="20" keywordseo="google">Google</keyword>, <keyword id="18635" type="CITY" weightage="20" keywordseo="Amazon">Amazon</keyword>, <keyword id="6354616" type="UNKNOWN" weightage="20" keywordseo="Twitter">Twitter</keyword>, and <keyword id="6354576" type="UNKNOWN" weightage="20" keywordseo="facebook">Facebook</keyword>, remain apprehensive about India’s new data laws after being questioned by India’s <keyword id="74228" type="ORGANIZATION" weightage="20" keywordseo="Joint-Parliamentary-Committee">Joint Parliamentary Committee</keyword> (JPC) on the Personal Data Protection Bill this week.</li><li>The only indigenous company to be called for deposition for far, Paytm, told the committee that it’s open to regulation.</li><li>All these companies have been given one week to prepare formal responses and submit affidavits. </li></ul>India’s Joint Parliamentary Committee (JPC) has been questioning Facebook, Amazon, Twitter, Google, and even Paytm over concerns regarding data protection and data privacy. The JPC may also <a href="https://www.livemint.com/news/india/parliamentary-panel-to-meet-airtel-on-data-protection-bill-11603966666145.html">reportedly</a> summon India’s top two telecom giants, <keyword id="6354504" type="DEFINITION" weightage="20" keywordseo="reliance-jio">Reliance Jio</keyword> and <keyword id="15491" type="COMPANY" weightage="20" keywordseo="Airtel">Airtel</keyword>, and cab-hailing services, Uber and Ola, next week. While Paytm has welcomed India’s new Personal Data Protection Bill, Google, Twitter, and Amazon have shown some restraint. Google’s response may have been more positive than the others, but it does not imply its undivided support. The consultation process is meant to increase the country’s understanding of how these companies use, store and mobilise data, according to the JPC’s chairperson Bharatiya Janata Party (BJP) Member of Parliament (MP) Meenakshi Lekhi. <div type="image" title="googleplus_edited" msid="78949846" hostid="261" caption="&amp;lt;p&amp;gt;Google&amp;lt;/p&amp;gt;"></div>Google Google’s representatives asserted that the Personal Data Protection Bill, once enacted, would strengthen the framework around data privacy and security in India. However, the global tech giant maintained that the move to localise data isn’t in the best interests of data protection and data privacy, according to the <a href="https://www.hindustantimes.com/india-news/jpc-questions-google-paytm-over-china-links/story-fJcEdDh2hyWSwvzyLVr0CJ.html">Hindustan Times. </a>Google highlighted that localization of data would be at odds with open trade and modern-day data protection standards. It submitted a 25-page report arguing its stance. However, it held no sway with the committee. The JPC questioned Google over its relationship with China — and the Chinese Navy in particular. It was also asked about its market control when it comes to the smartphone market since more than 90% of smartphones manufactured worldwide use Google’s Android platform as their operating system. Considering the mountain-high revenues the company generates in India, Google was asked if it thought the effective tax rate it paid was ‘absurdly low.’ Google evaded some questions and was unable to answer others. The head of the committee, Meenakshi Lekhi, has instructed the international giant to submit a detailed affidavit in one week. “They themselves are the platforms, sellers, and news agencies. And Google itself has the control button to which information will come first, which will come later or which news will flash and which will be suppressed. So how it can be a neutral platform?” Lekhi told PTI after the meeting. <div type="image" title="facebook" msid="78949862" hostid="261" caption="&amp;lt;p&amp;gt;Facebook&amp;lt;/p&amp;gt;"></div>Facebook Facebook saw the exit of its public policy head in India, Ankhi Das, just a few days after her deposition. Das was grilled for two hours by the JPC on Monday and asked some tough and searching questions by the panel members from across the political spectrum, sources told PTI. According to the social media giant, India’s new data protection laws can propel the country’s digital economy and global digital trade. “We believe that India’s data protection law has the potential to propel the country’s digital economy and global digital trade, and we wholeheartedly support this effort,” said the company’s spokesperson. <div type="image" title="amazon" msid="78949879" hostid="261" caption="&amp;lt;p&amp;gt;Amazon offices in India&amp;lt;/p&amp;gt;"></div>Amazon Amazon had earlier come under fire for declining the JPC’s invitation to appear because the company claimed it did not have anyone with the relevant expertise to address the committee’s concerns. However, yesterday, both Amazon India and Amazon Web Services showed up, according to <a href="https://www.cnbctv18.com/technology/amazon-appears-before-joint-parliamentary-committee-following-misunderstanding-7327321.htm">CNBC TV-18.</a> The company claimed that the entire episode was a ‘misunderstanding’ due to international travel restrictions given the coronavirus pandemic. Amazon was questioned over its revenue model and how much tax it pays in India. And, since India is a considerable part of its revenue generation, the committee also questioned the company over how it reinvests back in the country. The JPC has asked Amazon to submit its answers in writing in one week. <div type="image" title="twitter 2 unsplash" msid="78949889" hostid="261" caption="&amp;lt;p&amp;gt;Twitter&amp;lt;/p&amp;gt;"></div>Twitter Ahead of being questioned by the JPC, the social networking giant issued an apology for showing Leh as a part of China. The committee had earlier asked Twitter to submit a public apology and submit an affidavit regarding the issue. “Leh being shown as a part of China can be construed as an act of treason and is punishable with unto seven years of imprisonment,” Lekhi told <a href="https://www.hindustantimes.com/india-news/act-of-treason-parliament-panel-slams-twitter-on-leh-map-fiasco/story-kBG0bJcSHp2bQQblA1gbCJ.html">Hindustan Times</a>. “The committee was unanimous in flagging the issue and expressed its stern disapproval.” Twitter also came under fire for its practices regarding hate speech and taking down on accounts. According to PTI, Lekhi believes that Twitter may have a little too much control. ”Shadow banning, banning policy… there is no clarity about it. Such actions are very subjective... Twitter is becoming a law unto themselves, and under these circumstances, they are violating Article 19 of the Constitution about the freedom of expression,” she said. <div type="image" title="paytm" msid="78949896" hostid="261" caption="&amp;lt;p&amp;gt;Paytm&amp;lt;/p&amp;gt;"></div> Paytm Paytm is the only indigenous company to have been summoned by the JPC so far. And, it went to the panel with its solution. Paytm pitched that the government should handle the encryption and decryption of data held by global companies while letting data cross borders. However, the proposal was quickly withdrawn after several objections by some of the members of the committee, according to <a href="https://timesofindia.indiatimes.com/business/india-business/parliamentary-panel-question-paytm-about-chinese-investment-google-over-resisting-data-localisation/articleshow/78942848.cms">Times of India.</a> The Vijay Shekhar Sharma-led enterprise was asked about the quantum of Chinese investments it has received and why some of its revenues were directed back to China. It was also probed for details behind the temporary removal of its app from Google Play Store for violating its ‘gambling’ policies. Paytm acknowledged that 35% of its investment was Chinese but that investors don’t have any say in how the company is run. They also clarified that while some personal and sensitive data may be transferred outside India for ‘processing,’ this only occurs when there is explicit consent from the user. SEE ALSO: <a href="https://www.businessinsider.in/science/space/news/kepler-estimates-there-are-at-least-300-million-potentially-habitable-planets-within-the-milky-way-galaxy/articleshow/78946863.cms">Kepler estimates there are at least 300 million potentially habitable planets within the Milky Way galaxy</a> <a href="https://www.businessinsider.in/science/health/news/mit-has-a-new-ai-model-that-can-detect-asymptomatic-covid-19-patients-just-by-the-using-the-sound-of-their-coughs-recorded-over-phone-calls/articleshow/78927475.cms">MIT has a new AI model that can detect asymptomatic COVID-19 patients just by the using the sound of their coughs recorded over phone calls</a> <a href="https://www.businessinsider.in/business/corporates/news/tata-communications-executive-explains-how-iot-is-expanding-beyond-manufacturing-and-which-sectors-are-showing-the-fastest-growth/articleshow/78924587.cms">EXCLUSIVE: Tata Communications’ IoT head explains how COVID is driving the next wave of Internet of Things</a>

You Searched For "Personal Data Protection Bill" and got 12 results

India’s new data protection bill makes a good show of user rights — but can it deliver on its promises?

Prabhjote Gill

Groups of foreign companies are lobbying against India's Personal Data Protection Bill

Prabhjote Gill

Personal data protection bill puts user first and has heavy penalties – cyber experts are happy about it

Sanchita Dash

India's proposed data laws won't apply to the government — businesses cry foul

PTI

Here’s what Sundar Pichai had to say to the Indian government

Prabhjote Gill

Being GDPR compliant doesn't necessarily make companies ready for India's upcoming data protection laws

Prabhjote Gill

Data localisation won't help 'local' firms or improve privacy — but it could cost India $43 billion

Prabhjote Gill

GDPR compliant firms should find it easy to adhere to draft Personal Data Protection Bill in India

Prabhjote Gill

WhatsApp gives in to India’s data localisation policy

Prabhjote Gill

Apple, Amazon, and Microsoft want one more shot at convincing India before data protection bill reaches Parliament

Prabhjote Gill

Here’s what global tech CEOs have to say about India's data protection laws

Prabhjote Gill

Google, Amazon, Twitter, and Facebook remain apprehensive about India’s new data laws but Paytm is open to regulation

Prabhjote Gill

Popular Keywords

Buying Guides