By Rahul Sharma
The Supreme Court’s 2017 Puttaswamy judgment recommended the prompt enactment of a robust Data Protection (DP) law to the government. Every passing day without enforceable DP regulation and non-intervention by government and regulators catalyses data loot, unaccounted data breaches and processing abuse which normalizes harm. Recently introduced Digital Personal Data Protection (DPDP) Bill, 2022 has narrowed focus and deviates from its predecessors that went heavy on data sovereignty, localisation and compliance. What explains this change in trajectory from playing hardball to the mantra of keeping it ‘simple’?
FREE READ of the day by MediaNama: Click here to sign-up for our free-read of the day newsletter delivered daily before 9 AM in your inbox.
Context
The world post Covid & Russia-Ukraine armed conflict has accelerated trends set in motion following the global financial crisis. Big power contestation is creating a gulf in global governance where anything can be weaponised. Macroeconomic headwinds, inflation, food security, energy crisis, supply chain resilience, looming recession and job cuts are dominating the global political discourse. These shifts & turmoils are driving newer frameworks, engagements and partnerships.
India senses an opportunity to gain more ground in this window of change. It eyes itself as a natural leader of the global south. It’s exhibiting a willingness to shoulder greater responsibility as a force for good. India is now batting for more integration with the world while simultaneously pursuing the goal of Aatmanirbharta. It’s on an FTA signing spree with UAE, UK, Australia, Gulf etc.
After having missed making most out of the earlier tech revolutions, Cyber, Tech, & Data are seen as the biggest growth frontiers that’ll help India transition from a developing economy to a developed one. Market dynamics and techno-protocol solutions (like UPI, CoWIN, Aadhaar, ONDC) are serving as the foundation for future digital blocks. A revamped regulatory architecture with DPDP, Digital India Act, Data Governance framework, Telecommunications Act & sectoral protocols will serve short-medium term. India now has the G20 Presidency where it intends to showcase its digital transformation journey. It also assumed the Council Chair of Global Partnership on AI. But proposing progressive frameworks or entering into FTAs & multilateral arrangements with digital trade components predicate on having a functioning regulatory regime at home.
There’s a movement amongst the democracies of the world to find alignment on areas of common concerns including tech and data regulations, social media, crypto, ransomware, telecom standards, etc. There are more frank exchanges and feedback to identify areas of convergence and make frameworks interoperable. The West has expressed concerns on data localisation & heavy-handed compliance potentially impacting their firms serving in the Indian market. Similar concerns were echoed by few Indian firms and industry associations.
With subsequent drafts, there is a conscious effort to diverge from EU style data protection approach and structuring of regulations. MeitY Minister Rajeev Chandrashekhar highlighted that an “absolutist†approach of the GDPR won’t suit India given the momentum in start-ups & innovation ecosystem. Even within Europe, there are calls to drift away from more conservative data protection regulatory approaches to one that enables more value creation through use of data & facilitates the data ecosystem.
That’s the opportunity part dictating the draft. But how does it fare on data protection? Does the draft increase transparency and trust? Does the bill advance the design of privacy cognisant processes, systems and algorithms?
What Improved?
What doesn’t cut any ice?
Reconsideration
The draft doesn’t reflect a decade-long discourse to formulate an appropriate data protection regime that matches India’s needs and aspirations. The equilibrium can still be achieved, but at a higher threshold.
Rahul Sharma is Founder, The Perspective & Director, Grade Ace. Views are personal.
This post is released under a CC-BY-SA 4.0 license. Please feel free to republish on your site, with attribution and a link. Adaptation and rewriting, though allowed, should be true to the original.
Also Read:
