PDF

Digital Personal Data Protection Act, 2023

The Purpose of the Act

The Act streamlines the processing of digital personal data, balancing individuals’ rights to guard their data with the imperative to utilize such data for legitimate purposes, ensuring everything is in alignment with the broader spectrum of related issues.

Background & Need for the DPDPA

To cope with the rapid pace of technological advancements and provide a structured framework for personal data protection, the Digital Personal Data Protection Act, 2023 was enacted. This legislation empowers individuals by granting them rights over their data while setting strict guidelines for businesses and organizations that process this data.

Key Terms to Understand

• Data Principal: The individual whose personal data is being processed.
• Data Fiduciary: An entity or individual who determines the purpose and means of processing the personal data.
• Data Processor: The entity processing the data on behalf of the data fiduciary.

Salient Features of the Act

• Data Fiduciaries’ Obligations: These are entities like companies, individuals, and government bodies that process data. Their key responsibilities encompass data processing activities, including collection, storage, and other related operations.
• Data Principals’ Rights & Duties: The Act ensures the rights of Data Principals, essentially the individuals to whom the data pertains. It also introduces penalties for any infringements of these rights, duties, and obligations.
• Promotion of Business & Innovation: By laying down clear guidelines, the Act facilitates ease of living and conducting business, fortifying India’s evolving digital economy and innovation landscape.

Foundational Principles

The Act anchors itself on seven robust principles:

• Ensuring consented, transparent, and lawful data use.
• Limiting data use to the original, specified purpose.
• Gathering only the necessary data (data minimisation).
• Upholding data accuracy.
• Restricting data storage duration.
• Mandating reasonable security protocols.
• Enforcing accountability, particularly in the event of data breaches.

Novel Features of the Act

Apart from being rooted in these principles, the Act sets itself apart by being SARAL – Simple, Accessible, Rational, and Actionable Law. It’s noteworthy for its plain language, illustrative explanations, lack of complex provisions, and minimal cross-references. A pioneering step in inclusivity, the Act uses “she” instead of “he,” marking a significant nod to women in parliamentary legislation.

Empowering Individuals

The Act fortifies individual rights by allowing:

• Access to their processed data.
• Data correction and erasure.
• Grievance redressal channels.
• Nomination rights for representation in case of death or incapacity.

Data Principals can seek recourse with Data Fiduciaries for rights enforcement. If unsatisfactory, they can escalate issues to the Data Protection Board effortlessly.

Duties & Obligations of Data Fiduciaries

Key responsibilities include:

• Implementing robust security safeguards.
• Reporting data breaches to the concerned Data Principal and the Data Protection Board.
• Deleting data post its utility or upon consent withdrawal.
• Maintaining a grievance redressal system.
• Appointing an officer for Data Principal inquiries.

Significant Data Fiduciaries have additional obligations, encompassing data audit appointments and periodic Data Protection Impact Assessments to amplify data protection.

Child Data Protection

Recognizing the vulnerability of children, the Act:

• Mandates parental consent for processing their data.
• Prohibits practices harmful to children, like tracking or targeted ads.

Act Exemptions

Certain entities and scenarios, such as research purposes, startups, legal rights enforcement, and specific Data Fiduciary categories, enjoy exemptions under this Act for various reasons, including national security and public order.

Data Protection Board’s Role

The Board is the watchdog, empowered to:

• Direct data breach remedies.
• Investigate breaches, impose fines.
• Advocate Alternate Dispute Resolution.
• Advise the Government on punitive actions against recurring offenders.

Rights of the Data Principal

Every data principal has pivotal rights under the DPDPA, including:

• Access to their personal data.
• Correct, complete, update, or request erasure of their data.
• Nominate a representative to exercise these rights on their behalf in case of death or incapacity.

Obligations of Organizations and Businesses

Businesses, regardless of size or domain (including MSMEs and startups), have several obligations:

• Ensure data principals can access, correct, and erase their data.
• Correct any inaccurate or misleading personal data upon request.
• Not to disclose recipients of personal data upfront, though they must provide this information upon the data principal’s request.
• Establish robust grievance redressal mechanisms for users, including the designation of a grievance officer.
• Comply with the guidelines even if they are processing the data of foreign residents.

Data Transfer & Processing Across Borders

While the DPDPA doesn’t mandate data retention solely within India, it allows the Central Government to restrict data transfer to certain countries. Businesses must be cognizant of these nuances and sector-specific laws that might apply.

Exemptions & Penalties

It’s crucial for organizations to understand potential repercussions of non-compliance:

• Penalties range from INR 10,000 to a whopping INR 250,00,00,000, depending on the nature of the breach.
• The regulatory board can mandate remedial measures and even suggest mediation between parties.

Preparing for the DPDPA

As the DPDPA comes into effect, it’s vital for businesses to:

• Establish dedicated data protection teams.
• Adapt IT infrastructure and operational procedures.
• Revisit and realign data processing frameworks and contracts.
• Prioritize compliance to prevent significant fines and operational disruptions.

Conclusion

As we transition into an era where data is the new currency, the Digital Personal Data Protection Act, 2023, emerges as a beacon of hope, ensuring that this currency is both secure and used ethically. Whether you’re an individual or a business, understanding this Act is the key to navigating India’s digital landscape effectively.

The digital era has revolutionized how we deal with information. While technology has brought us innumerable advantages, it also comes with the challenge of managing and protecting personal data. With data breaches becoming increasingly common and concerns over individual privacy growing, nations worldwide are introducing robust data protection frameworks. Among them, the Digital Personal Data Protection Act, 2023 (DPDPA) is India’s answer to these challenges. Let’s explore what this means for businesses, individuals, and the broader digital landscape.

The post Detailed Analysis of the Digital Personal Data Protection Act, 2023 appeared first on LexForti .

What are the kinds of issues a Game Developer faces while dealing with Game Publishers?

In the current situation with the pandemic, game developers have had to face many problems. The most obvious one is the unrealistic and overly ambitious approach. It’s well-known that a game is successful when a singular point is focused and perfected. Game publishers do not want to risk titles with no attraction point. The real conflict arises when publishers and developers fail to communicate with each other. This effectively kills any collaboration between the two parties as publishers never take a financial risk, even if they like the idea of a game. Many game developers like to keep the contents of their game a secret, adding fire to the fuel.

What are the ways through which one can optimize their experience while dealing with publishers?

The best way to optimize experience when dealing with game publishers is to just form the habit of listening. Publishers tend to get very protective of their investments. Furthermore, games present a high-risk, high-reward prospect, they cannot trust any developer unless proper communication is established.

Get yourself a Game Publisher Contract – Contact us

Kindly also tell us how game developers approach publishers.

Typically, game developers should approach publishers with a credible game submission. This is highly important because the gaming industry is getting
more specific day by day. Any lapse in concentration and failure to meet a publisher’s requirements can waste a game developer’s effort and time. Game
creators usually take their time, so the chances of getting published increase.

Watch this video on YouTube.

Framing the Monetization Model

One of the most difficult and important aspects of game development is figuring out how to monetize your game. This is especially true for developers who are working with publishers, as the publisher will usually have the final say over how the game is monetized. There are a few different ways that games can be monetized, and each has its own pros and cons. The most common monetization models are microtransactions, subscriptions, and advertising. If a publisher is not content with the way that a game is being monetized, they may push for changes to be made. This can be a difficult process for developers, as they may not agree with the publisher’s vision for the game.

The post  Issues faced by Game Developers while dealing with Game Publishers appeared first on LexForti .

These students initially filed the application in Delhi High Court challenging the 2016 privacy policy. The Court granted a partial relief stating that the data of those WhatsApp Users who delete WhatsApp before the 2016 policy came into effect- cannot be used for any purposes as laid down in the 2016 privacy policy.

Later, WhatsApp updated its user policy on January 4, 2021, in view of which this fresh affidavit was filed by the petitioners before the Supreme Court on January 5, 2021. After hearing the application, Supreme Court has sought response of the Central government, Facebook and WhatsApp in a plea challenging the privacy policy.

The post Supreme Court: WhatsApp may be a trillion-dollar company but people value their privacy. appeared first on LexForti .

The court opined that, until Court understands the issue at hand, it will not issue any notice.

Court stated that

Court asked the Petitioner to clarify the specific ‘data’, the Petitioner is having an issue with.

Petitioner responded that, browsing history is being analyzed by the app and then shared across for commercial usage.

Court responded that

Petitioner averred that, WhatsApp is exempting Europe and US from the said policy; but no such exemption is there for India.

Court reiterated:

Advocate Rohatgi on the Petition, advised Petitioner to go to the Parliament instead of High Court (Ref: on making laws)

Advocate on behalf of WhatsApp and Facebook: Sr Adv Kapil Sibal and Mukul Rohatgi

Advocate (Petitioner): Adv Chaitanya Rohilla

Background

WhatsApp updated it privacy policy on 4th January 2021. Users were forced to accept the newly formed Terms and Condition. If user denies the changes, it would simply terminate the user from availing the services. Later on, WhatsApp clarified that, if user denies the changes, it will not suspend any WhatsApp account.

The post “If you read WhatsApp policy you will be shocked to see, what have you consented for”: Delhi HC appeared first on LexForti .

Introduction

Today, every country in the world is fighting with the novel coronavirus diseases. Many people in the world have lost their lives after getting infected with this virus. The Government of every country has taken various measures to protect people getting infected form this deadly virus. The Government advised the citizens to maintain social distance and take proper precautions while they are out for some work. 

The Government of India had announced nationwide lockdown for 21 days in India after the outbreak of coronavirus in the country. The Central and State Government along with various healthcare officials, non-profit government organizations took various steps to protect the citizens and to slowdown the spread of COVID-19 in the country. After 21 days, the lockdown was extended by the Government because of the rise of the coronavirus cases in the country. During the second lockdown, the Central Government launched Aarogya Setu App, a contact tracing app through which the server will record the data of all the people who came in contact with infected people to limit the spread of coronavirus. It is an app which uses both GPS and Bluetooth to determine the location of the users, when and where the person came in contact with the infected person. The App collects various information of a person such as name, gender, age, profession, phone number, travel history, present location, access to the contacts and health status. Within few days, the app had 98 million downloads and was the fastest downloading app of all time. The App records all the data of the person and accessed by the Government whenever necessary. After the launching of the app, every company, local authorities, societies made it mandatory to download the app. The Government also made mandatory for the travelers to download the Aarogya Setu App while travelling through train or flight. The users had privacy concerns in the App as it is collecting personal data and tracking location with Bluetooth and GPS technology. Therefore, the question arises whether the App is invading the right to privacy of the citizen in the country. 

VIOLATION OF RIGHT TO PRIVACY

Privacy is an important concept in every life of the person. With the advancement of technology, it is necessary to protect and maintain privacy of each person. In our country, there is no proper data protection law in our country which legally protects the sensitive data of the citizens. With the existing legal provisions such as Information Technology Act, 2000, there is limited protection to the data of the citizens of India. Hence, there is very less protection to data privacy in our country. This issue was raised in the case of K.S. Puttuswamy v. Union of India, it was held that the privacy of the individual is an essential aspect of dignity. The ability of the individual o protect a zone of privacy enables the realization of the full value of life and liberty.^[1]

In this landmark judgment Justice DY Chandrachud laid down three fold test for encroachment on privacy- 1) There must be a law in existence to justify the encroachment 2) The intervention must be for fulfilling a legitimate state interest 3) The encroachment should not be disproportionate to the purpose.^[2]

Analyzing the App with the test stated in Justice K.S. Puttuswamy v. Union of India, it is seen that the App is not backed by any particular law but it has been made under Section 35 of Disaster Management Act, 2005 which gives the power to the Central Government to make rules whenever it is necessary. There is a legitimate aim to invade the privacy of a person in this case as it uses the information to suspect coronavirus patient and to trace that how many people had came in contact with the infected person. For this aim, there must large smartphone base which consist of 60-70% population as per the policy. But as per the India Internet 2019 report by IAMAI and Nielsen, the benchmark of smartphone is below the line^[3]. This shows that there is no connection between the aim of the State and the policy implemented by the State. This concludes that the App has failed the second test. While studying the test of proportionality, it is necessary to determine whether the said law is acting as a reasonable restriction in the fundamental right to privacy. In this case, the privacy policy of the App states that the Government is not liable for any unauthorized access of information. It also states that for the personal information can be used for  necessary medical and administrative interventions. But the policy also states that all personal information is stated in an anonymized manner. This shows that though the App stores the information in encrypted form but it does not guarantee that if the information can be used by any unauthorized user. Therefore, it does not pass the test of proportionality. As the App does not fulfill the criteria mentioned in the test, therefore it invades the right to privacy of a person and challenge stating that the encroachment is unreasonable. 

After few weeks of the launch of the App, there were many legal, privacy and security issues relating to the App. It is stated that the information can be used for medical and administrative interventions. This states that the personal information can be used by any department of the Government. There is no specified rules and regulations by the Government in the App regarding the security to protect the collected data. There is no proper legal framework to control the work of the App apart from privacy policy and terms of use. Apart from the legal issues of the App, there were many other security and technical issues regarding the App. The app will be able to provide reliable results only if 60% of the population will download the App but according to reports there are only 24% Indian population own a smartphone.^[4]Many questions were raised regarding the use of both location and Bluetooth, and not only Bluetooth as a source to track the users of the app because the geographic location can be misused by any unauthorized users. The App is not open source and it is not available to the public as there was fear to point flaws in the app’s development.^[5]The security issue is one of the major issues in the Aarogya Setu App. There was a person who had hacked the App and stopped it from gathering the data from GPS and Bluetooth. It was also stated by the India’s cyber security agency that there were many phishing attacks in the name of the App and it was at a rise during this pandemic situation. 

Recently, the Ministry of Electronics and Information Technology of India released Aarogya Setu Data Access and Knowledge Sharing Protocol, 2020. In this protocol, the government has given certain clarifications regarding the app such as the data can be used by other departments of the Government. But the protocol did not the clear the fact of using both Bluetooth and GPS for tracking the users and also about the data collected and stored in an anonymized manner.  

CONCLUSION

Privacy is an vital aspect in an individual’s life. Both are protected and an intrinsic part of Article 21. Today, every country is fighting with the novel coronavirus disease and taking different measures in order to keep their citizens safe. One of the measure is the contact tracing app where the app tracks the users using GPS or Bluetooth or both. India also launched a contact tracing app named Aarogya Setu App which uses both Bluetooth and GPS for tracking the users. There were many legal flaws stated in the Aarogya Setu App main being the violation of fundamental right to privacy as per the test stated in the Puttuswamy case. Though the Government is trying to protect the citizens from coronavirus but it is also necessary to protect the privacy of every citizen in the country. The App has different privacy issues and it is important to resolve all the issues the data stored with the Government is for the public interest. The Government can make the App as an open source code and maintain the transparency with the citizens. It should also secure the data within themselves and do not share with the third party. With all these effective changes, the App will create a proper balance between security, privacy and the protection of public health. 

^[1] Justice K.S. Puttuswamy v. Union of India, (2017) 10 SCC 1

^[2] Ibid.

^[3] India Internet 2019, Internet and Mobile Association of India, Nielsen, available at https://cms.iamai.in/Content/ResearchPapers/d3654bcc-002f-4fc7-ab39-e1fbeb00005d.pdf, (last visited on August 29, 2020)

^[4] Shashank Mohan, No Covid-19 silver bullet: Aarogya Setu endangers India’s Privacy and Its Usefulness is uncertain, May 12, 2020, available at https://scroll.in/article/961641/no-covid-19-silver-bullet-aarogya-setu-endangers-indias-privacy-and-its-usefulness-is-uncertain, (last visited on August 29, 2020)

^[5] Andrew Clarance, Aarogya Set App: Why India’s Covid-19 Contact Tracing App is Contraversial, May 14, 2020, available at https://www.bbc.com/news/world-asia-india-52659520, (last visited on August 29, 2020)

The post A violation of Right to Privacy- Aarogya Setu app appeared first on LexForti .

Introduction

The unrivalled occupancy and rapid advancements of Computers, technology and the Internet has significantly shaped the world into an edified space. With the burgeoning demand and colossal utilizations, its access isn’t limited to a certain set or type of people anymore, instead appears, more or less, as an around-the-globe administration. The fast-paced growth of the web, outstanding reach over people and generation of a global surge of excitement are laudable.

Estimates vary as to the number of people connected to the net. But it’s widely believed that the number is over 60 million, and growing exponentially^[1]. Between 750,000 and 1 million people are caught up in the Internet phenomenon every month, and it is expected that by the end of the century, the total number of users will be at least 150 million and the value of goods, services and information traded globally over the internet will reach US $ 200 billion^[2].

This leads us to elucidating on the concept of cyberspace, which isn’t precisely defined anywhere, although it can be termed as an intangible space in which communication over various computer networks occur simultaneously.  This widespread interconnected digital technology [cyberspace] eventually means that a person sitting in one part of the world can access content of any kind uploaded by a server, oceans away on the other side. Due to these advancements it is apparent that any data and information can be availed in a digitised format—detached from the physical medium—since the internet transcends the physical dimensions of things.

Notwithstanding the foregoing, this as a consequence, makes the notion of property and exclusivity irrelevant. Hence it can be understood that as soon as any information is released into cyberspace, it practically becomes of public use, without any specific ownership; it becomes publici juris. Therefore, it can be used by anybody.

The advantages and scope of publicity of business through e-commerce or business on the World Wide Web can reach the surfers very fast in any part of the world. Unfortunately this has also paved the way for the emergence of cyber crime^[3].

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Cyber crime & The IT Act, 2000

Cyber crime—although an undefined term by an Indian statute—is a catchall attributed to any crime which includes as an essential requirement, a computer and a network. The National Cyber Crime Reporting Portal (a body set up by the government to facilitate reporting of cybercrime complaints) defines the term, as ‘any unlawful act where a computer or communication device or computer network is used to commit or facilitate the commission of crime’^[4]. Cyber crime isn’t confined to fraud, bullying or identity theft anymore. Various activities can be termed as cyber crimes like: CSAM^[5], Cyber bullying, cyber stalking, vishing, online fraud, identity theft, phishing, spamming, data breach, cyber-squatting, pharming, crypto-jacking, espionage, online drug trafficking etc. and several other in accordance with the statutes.

The meteoric rise of cyber crimes in the world is undeniable. But it wasn’t until much later that this quandary was even acknowledged by the general population or legislations. The fact of the matter is that with the breakneck speed of new digital technology build-out—which patently highlights the nifty uses—sadly, ends up shrouding the major drawbacks. Nevertheless, there has been much-needed awareness in the past few years regarding cyber offences; it’s not treated as a trifling matter anymore.   

To deal with the cyber-crimes, the parliament of India has enacted the Information Technology Act, an act based on UNCITRAL^[6] (which adopted model law on e-commerce advocating a shift from paper based environment to a computer based environment^[7]).

The IT Act, 2000 provides legal recognition to digital signatures and electronic records. It is a legal framework to facilitate and safeguard electronic transactions in the electronic medium.

Intellectual Property

The concept of Intellectual Property can be traced back to the Byzantine Empire where monopolies were granted. For instance, the granting of exclusive privileges to inventors of any machine/process to speed up silk-making by Venice’s statutory legislation, or one year monopoly to cooks for new recipes by Greece^[8] . Over time the concept has been given a clearer picture. The most important of this subject herein is the ability of an idea or creation—not necessarily tangible—is termed as a property and has the right to be protected by the law to support artists, creators and other prime movers. 

According to the World Intellectual Property Organization (or WIPO)—one of the 15 specialized agencies of the United Nations—defines Intellectual property as, “creations of the mind: inventions; literary and artistic works; and symbols, names and images used in commerce. Intellectual property can be further categorized into: industrial property and copyright”. 

Industrial Property deals with patents, trademarks, geographical indications and designs, etc. on the other hand, literary, recording, musical, dramatic, cinematographic films and other such artistic works fall within the ambit of Copyright. 

The primary legislations regulating Intellectual property in India are: The Patents Act 1970, The Trade Marks Act 1999, The Geographical Indications of goods (Registration and Protection) Act 1999, The Design Act 2000, The Semiconductor Integrated Circuits Layout-Design Act 2000 and The Copyright Act 1957. Even still, the biggest discrepancy present in our country’s situation is the lack of understanding regarding IPR and Cyber laws—one cannot be separated from the other if online content has to be protected. 

There’s absence of any provision dealing with Intellectual Property in the IT Act, 2000. There isn’t even a mention of the word ‘IPR’ or anything about Intellectual Property protection on its infringement, which currently is a very challenging area in cyberspace.  

IPR and Cyberspace 

Copyright

In hindsight, the internet has created a new, effortless and trouble-free medium for several artists—writers, musicians, authors, content creators, researchers, and other copyright holders—to display their art while working on a global level, creating data accessible to millions of people. 

Contrarily, it has also opened a Pandora’s Box by making it possible for any user to duplicate information and replicate it as his/her own, thereby facilitating ‘copyright’ infringement.

A copyright confers an exclusive right on the owner, for a finite period, to prevent others from exploiting its subject-matter—an invention, a design, or a literary or other artistic work.

Hence, the copyright owner is entitled to certain ‘exclusive rights’ subject to certain provisions, to do or authorise the doing of certain acts in respect of work or a substantial part of it like: (a) in case of literary, dramatic or musical work—its reproduction, issuing copies, performance, adaptation etc., (b) computer programming, (c) artistic work, (d) cinematography film, (e) sound recording; (emphasis supplied)^[9].

According to the statutes, Copyright work shall be deemed to be infringed when any person, without license granted by the owner of the Copyright/Registrar of Copyrights under the Indian Copyright Act, 1957 or in contravention of the conditions of a license so granted or of any condition imposed by a competent authority under the said Act, does anything which exclusive right to do is, by the Act, conferred upon the owner of the copyright^[10]. Furthermore, on distribution either for trade or to an extent to affect pre-judicially the owner (emphasis supplied)^[11].

As far as basic usage of artistic work for an individual is concerned, liability may be escaped by using the defence of private use^[12]. Despite, unauthorised home taping of radio and television programmes becoming rampant all over the world^[13], the courts heretofore, have termed, liability of the end-user depending upon the degree and extent of unauthorized use, according to circumstances^[14]. 

It has been opined in Helliwell v. Piggott-Sims^[15], a UK case that, ‘private and domestic use can be properly said to have been done if the contemplation of its use was only limited to enjoying the collection.’  

The liability for offence [copyright infringement] usually lies on the originator, or the first person to post the copyrighted information on the web regarding requisite knowledge and intention (of committing the crime) to be present. Therefore, if the person has knowledge (of violation of copyrighted work) then the defence of ignorance—regarding the existence of such a law protecting the same—isn’t tenable^[16]. As far as (ISP) Internet Service Providers are concerned due to its system design appears to commit literal infringement of distribution, display or performance rights^[17].

Computer software is also subject matter of copyright protection under the act. Defined in Section 2(ffc) of the Act is a ‘computer programme’ within its meaning. Computer Programmes are thence included in the definition of literary work in the Act^[18] and owners have the right to grant software licenses^[19]. Moreover, The Penal Code, 1860 also reserves the right to punish publication of copyrighted work as the offence of forgery^[20]. In India, the offence of Copyright infringements are pursued under section 63 of the Copyright Act, 1957 ‘whereby any person who knowingly infringes or abets it shall be punishable for term not less than 6 months extendable up to 3 years with fine not less than rupees 50,000.’

Trademark and Domain Name

The Trademark Act, 1999 defines the term as, “A mark capable of being represented graphically and which is capable of distinguishing the goods or services of one person from those of others and may include shape of goods, their packaging and combination of colours”^[21]. Basically a trademark serves the purpose of identifying the product (and its origin), guaranteeing its quality, advertising it, and public (prospective consumer) image^[22]. Common examples can be: Pepsi, Sony, and Colgate etc.

A domain name may constitute a trademark if used for the purposes of identifying the source of goods or services^[23]. The most critical aspect of access to a particular website is the domain name.  Since inception of the domain name system, a domain name has been the identifier of an individual or entity operating within the worldwide web comprising cyberspace. On registration, they allow the owners of the domain names to mark their location in cyberspace by providing an identity and an exclusive mode of marketing products^[24].

‘Cybersquatting’ is a form of infringement of trademark laws. It involves the use of domain name by a person with neither registration nor any inherent rights to the name. These people register trademarks of others as domain names and sell those domain names back to the [trademark] owners or third parties at a higher price for profit. Since domain names establish a sense of online identity, they have major importance for creators. However, there’s more—an essential need to prove a dishonest intention, lack of legitimate rights and interest and similarity of domain name with the trademark in these petitions^[25]. ‘A domain name registrant doesn’t obtain any legal right to use that particular domain name simply because he has registered the domain name, he could still be liable for trademark infringement^[26].’

The Supreme Court was of the opinion that the use of similar domain name may lead to a diversion of users which could result from user’s mistaken access on one domain name instead of the other^[27]. This rationale was followed in succeeding judgements like of Tata Sons Ltd. & Anr. v. Arno Palem & Anr.^[28], as well.  

Furthermore, reverse domain name hijacking or reverse cybersquatting is when a trademark owner tries to secure a domain name by making false cybersquatting claims against a domain name’s rightful owner through legal action. Such issues usually arise with large corporations and wealthy individuals.’

Presently India doesn’t have any specific provision to stop violations as the aforementioned, there is a need for new legislation like the United States—U.S. Anti-Cybersquatting Consumer Protection Act, 1999. It protects the interest of owners of both registered and unregistered trademarks against use of their marks within domain names and also safeguards living persons against use of their personal name under certain circumstances.

Issues

Jurisdiction

The notion of jurisdiction is rooted in territoriality from the point of view of both the court which can properly assert jurisdiction and from the point of view of the law that should be applied while deciding the dispute^[29]. This concept of a ‘territorial space’ becomes complicated with the borderless and non-physical domain of the internet. Furthermore, these enforcement issues become more complex in cases of international transaction. In the case of, Banyan Tree Holding (P) Ltd. v. A. Murali Krishna Reddy^[30], the Delhi HC was dealing with an inter-state issue but the plaintiff was a foreign company which had invoked the jurisdiction of an Indian Court to seek an injunction against the alleged violator of trade mark. The court by large followed the development of common law with no indigenous law developed in India. 

Other Issues

Neither is there a legal compensation under the IT Act nor any provision to punish Cybersquatters; the only relief available is to take the domain back. As already mentioned before, there is lack somewhere in respect of jurisdiction issues, cyber stalking, cyber defamation etc. in the said statute.

Similarly, in the Indian Trademark Act, 1999 and Copyright Act, 1957 there’s a silence on cyber infringement issues. Additionally even with the computer programmes being protected under the copyright act, there’s no remedy for online software piracy^[31]. 

Conclusion

Intellectual Property Rights are a very important aspect in today’s time. There is a massive need for attention in the field for safeguarding the rights of developers, creators, and other artists. In India, although the legislations are going through steady changes there is still a certain requirement for a level of awareness regarding the crimes committed in cyberspace. As the internet provides a massive platform to performers—blatant, unchecked and continuous IPR violations on the internet—pushes intellectual property of people in a downslide motion which isn’t a good thing for the creative process and empowerment of this country. There is an urgent need for stricter laws in this field to avoid further infringements. And hopefully there will be.

^[1] Tan Tee Jim, Net Effect Copyright Conundrum in Cyberspace, 9 SAcLJ 229, 229 (1997).

^[2] See “The Business Times”, 22 September 1997 and “Business Week”, 5 May 1997. 

^[3] Harish Chander, Cyber Laws and IT Protection, 14 (PHI learning Private Ltd. Publication 2012).

^[4] Aprajita Rana & Rohan Bagai, Cybersecurity in India, Lexology (Feb. 24, 2020), https://www.lexology.com/library/detail.aspx?g=4cd0bdb1-da7d-4a04-bd9c-30881dd3eadf

^[5] Child Sexually Abusive Material/Child Pornography

^[6] United Nations Commission on International Trade Law

^[7] Vakul Sharma, Information Technology, 15 (Universal Law Publishing Company 2013).

^[8] Mr. Atul Satwa Jaybhaye, Cyber Law & IPR Issues: The Indian Perspective, Bharat Law Rev., Apr.-June 2016, at 166, 168. 

^[9] Indian Copyright Act, 1957 § 14.

^[10] Ibid, § 51(a)(i)

^[11] Ibid, § 51(b)(ii)

^[12] Ibid, § 52.

^[13] Dr. Gupta & Agarwal, Cyber Laws, 148 (Premier Publishing Company 2010)

^[14] Prosieben Media A.G. v. Carlton U.K. Television Ltd. [1999] FSR 610, 619.

^[15] [1980] FSR 582.

^[16] Rodneyd Ryder, Intellectual Property and the Internet (Lexis Nexis – Butterworths 2002) 320.

^[17] Ryder supra note 15, 320. 

^[18] Indian Copyright Act, 1957 § 2(o)

^[19] Jaybhaye supra note 8, 171.

^[20] Indian Penal Code, 1860, § 463, 464.

^[21] The Trademark Act, 1999 § 2(1)(zb)

^[22] Dr. B.L. Wadhera, Law relating to Intellectual Property, 134 (Universal Law Publishing Company 2009)

^[23] Raymond Limited v. Raymond Pharmaceutical Pvt. Ltd., 2016 SCC OnLine Bom 5159.

^[24] Ibid. 

^[25] Chander supra note 3.

^[26] Yahoo Inc. v. Aakash Arora & Anr.,78 (1999) DLT 285.

^[27] Satyam Infoway Ltd. V. Sifynet Solutions Pvt. Ltd., AIR 2004 SC 3540. 

^[28] 2013 (54) PTC 429 (Del).

^[29] S Muralidhar, Jurisdictional Issues in Cyberspace, 6 IJLT 1, 2-3 (2010).

^[30] 2009 SCC OnLine Del 3780.

^[31] Jaybhaye supra note 8.

The post Cyberspace: A Surfeit of IPR issues appeared first on LexForti .

Introduction

The landmark judgement of K.S. Puttaswamy v. Union of India paved the way for the Right to Privacy to become a protected right within the purview of Fundamental Rights as defined in Part III of the Indian Constitution. This allows the right to be readily enforced by the existing judicial mechanism as opposed to a right that is available only as far as it impacts constitutionally guaranteed freedoms. This allows for a foundation to be laid which advocates for the protection of rights such as the right against invasive and arbitrary scrutiny by the State, free expression of one’s sexual or gender orientation, religious and spiritual expression as well as data protection. An offset of this revolutionary judgement is the introduction of the Personal Data Protection Bill.

With the intention to create a cohesive and effective data protection law, the Government set up a committee under the chairmanship of retired Supreme Court judge, Justice BN Srikrishna[1] which birthed the Draft Personal Data Protection Bill, 2018. However, after much debate and engagement with industry professionals and policy think tanks, a revised bill has been approved by the Cabinet and finally tabled before the Indian Parliament as the Personal Data Protection Bill, 2019.

The Bill essentially regulates the processing of personal information and data by the government as well as domestic and foreign companies.[2] It therefore seeks to protect personal information and privacy rights of individuals. The bill does contain some fair points which are a determined nod towards data protection. However, the bill, in its totality falls short of this agenda of protection of data and digital rights, instead providing more pervasive and invasive powers of surveillance to the government. The Bill, instead of protecting personal information of citizens from all external agencies, allows for such information to be delivered to the government on a silver platter.

The Good

Reduction of the Data Localization Requirements.

The PDP, 2019 Bill has diluted the proposed Data Localization requirements as had been mentioned in the PDP, 2018 bill. Data Localization refers to the mandatory storing of one serving copy of personal data on the server by every data fiduciary within the territory of India.[3] Under the new bill, personal data, even sensitive and critical personal data, can be transferred in accordance to a regulatory framework. It is a positive move to allow easier operation of businesses as global companies can now transfer and process personal data across different jurisdictions. This may result in actively decreasing operational costs for a number of organizations.

However, the Bill still mandates localization of sensitive personal data.[4] Given that under the 2019 Bill, the Central Government can expand the span of ‘sensitive personal data’[5] as well as ‘critical personal data’[6] by consulting the Authority[7], such localization, even if explicit consent of the data principal is taken, just seems to allow surveillance by the State. The lack of a concrete definition of ‘critical personal data’ further creates ground for confusion and misrepresentation.

Right of Erasure

One of the positive aspects of the 2019 PDP Bill is the provisions which allow for the right to erasure[8] as well as the right to correction or modification of personal data.[9] It also vests the data fiduciary with the responsibility to provide principals in writing, the relevant justification[10] if they are rejecting an application of erasure or modification and further even indicate this disputation by the principal alongside the relevant personal data.[11]

This allows for the data to be adequately modified to reflect true information by the data principal personally and also to prevent retention of personal data by the data fiduciary after it has been duly processed, thereby protecting private information of the individuals.

The Bad

Government to use Anonymized Personal/Non-personal data

One distinct provision of the PDP, 2019 Bill is that the Central Government reserves the right to direct any data fiduciary or processor to share personal anonymized data or non-personal data with the intention to use such data reserves “…to enable better targeting of delivery of services or formulation of evidence-based policies by the Central Government, in such manner as may be prescribed.”[12]  While, in policy this seems well and good, given that there are provisions of anonymity so sharing of such data cannot be traced back to the data principals. However, there are numerous concerns when it comes to implementation of this provision.

Firstly, given that the definition of “non-personal data” has not been clearly defined in the Bill, the execution of this provision becomes questionable. Secondly, there are no safeguards instituted to prevent any leak of information. This is a major problem because given the infrastructural disparity, without safeguards in place, we have no guarantees if proper anonymization of personal data can be done by all fiduciaries. Further, there could be cases where non-personal data can be converted into personally identifiable data. Lack of safeguards will lead to shoddy implementation which. This can result in major violation of privacy, with hardly any attachment of accountability.  

Creation of a sandbox

The PDP Bill 2019 requires for creation of a sandbox for “...the purpose of encouraging innovation in artificial intelligence, machine-learning or any other emerging technology in public interest.”[13]

This sandbox is essentially to allow certain entities involved in work as mentioned above to be exempted from complying with all or some requirements of the 2019 Bill. However, what is problematic is that the requirements which could be overruled by the entities in the sandbox are those relating to purpose limitations[14] and restrictions on retention of personal data.[15] This means that the entities are exempted from providing “clear and specific purposes of the technology or activity.”[16] In circumstances where the purpose has not been defined clearly, it becomes extremely difficult for data principals to give free and informed consent. Allowing enterprises to process personal data for without the explicit consent given by data principles to that particular activity leads to violation of basic principles of privacy.

Social Media User Verification

While growing influence of social media allows for political engagement, solidarity, vocalization of dissent, it has also allowed for an uncontrollable thread of fake news and misinformation being disbursed under anonymous profiles so much so that elections have failed to remain free and fair. In an attempt to combat this spread of misinformation, the Bill allows the Central Government to deem any social media intermediary as a significant data fiduciary.[17] As a significant data fiduciary, they have wider responsibilities such as data protection impact assessments[18], maintenance of records[19], audit of policies[20], and appointment of a data protection officer.[21]

 It further obligates every social media intermediary to enable users who register their service with them, to voluntarily verify their accounts.[22] This voluntary verification will have an overt visible mark of verification, noticeable to all users. Such a provision will entail people attaching government issued IDs to their social media account, allowing for such companies to be in possession of sensitive personal data which can then be used for profiling and targeting users. Not only does his provision in no way combats misinformation but the idea of willingly thrusting sensitive personal data into the hands of big players in the social media space also achieves the opposite of data privacy of individuals.

The Ugly

Arbitrary exemptions for law enforcement and other agencies

One of the provisions that is a major threat to the data privacy rights of individuals is Section 35 of the PDP Bill, which allows the Central Government to unilaterally exempt any government agency from all or select provisions of the Bill, thereby providing easy access to personal data of many. At least the 2018 draft Bill also allowed this but restricted such access for security purposes based on principles of “necessity and proportionality and on the basis of authorisation of law.”[23]In the 2019 PDP Bill, determinants such as necessity and proportionality, acting as safeguards are nowhere mentioned, in complete defiance of the Puttaswamy judgement which evolved these concepts. This grants massive and largely unfettered access of personal data to the Government, enabling pervasive surveillance. Such the lack of such safeguards readily hampers privacy rights of individuals.

The Data Protection Authority’s lack of Representation.

The PDP Bill 2019 establishes a Data Protection Authority to regulate and enforce the provisions. It has wide ranging powers including creation of guidelines on how various provisions of the Act apply, to ensure that data protection regulations remain consistent and to enforce compliances.

However, in a horrible move, the entire selection committee, which has been constituted to give recommendations to the Central Government for the appointment of members to the DPA, are made up entirely of members of the Executive.[24] In the 2018 draft there was provision for inclusion of a judicial member in the selection committee,[25] which allowed for diverse representation.

With the 2019 PDP Bill, the DPA becomes fully reliant on the Central Government in terms of its formation as well as membership. This completely obliterates the separation of powers doctrine because the enforcing agency as well the entities that are being enforced are both part of the Executive. The only way the Bill will ensure fair applicability of its provisions is when the DPA becomes independent of the State. For that, there must be sufficient involvement of members from the judicial community to ensure proper representation and prevent conflict of interest.

Conclusion

The bill has been conceived with the intention to ensure protection of data from external agencies and to some extent it carries this in spirit. However, certain problematic provisions as well as lack of explicit safeguards create grounds for criticism. The Bill, allowing for serious ungrounded access of sensitive information to be granted to the State through broad exemptions, sandbox provisions as well as social media verification, legitimise vigilance by the Government. Furthermore, the absence of mechanisms to safeguard the possible leak or release of such sensitive information just warrant poor implementation. Both these scenarios inevitably lead to violation of the principles of privacy that the Bill seeks to protect. If such measures are allowed to manifest as law, India will turn into an Orwellian disaster state.[26]

^[1] Surabhi Agarwal, Justice BN Srikrishna to head Committee for data protection framework, The Economic Times (10:30AM 7^th June, 2020) https://economictimes.indiatimes.com/news/politics-and-nation/justice-bn-srikrishna-to-head-committee-for-data-protection-framework/articleshow/59866006.cms

[2] Section 2(A), The Personal Data Protection Bill, 2019.

^[3] Suneeth Katarki , Namita Viswanath , Ivana Chatterjee, Rithika Reddy Varanasi, India: The Personal Data Protection Bill, 2019: Key Changes And Analysis, mondaq, (10:30AM 7^th June, 2020), https://www.mondaq.com/india/privacy-protection/880200/the-personal-data-protection-bill-2019-key-changes-and-analysis

[4] Section 33(1), The Personal Data Protection Bill, 2019.

[5] Section 15, The Personal Data Protection Bill, 2019.

[6] Section 33(2), The Personal Data Protection Bill, 2019.

[7] Section 3 (5) defines ‘Authority’ to mean the Data Protection Authority of India established under sub-section (1) of section 41, The Personal Data Protection Bill, 2019.

[8] Section 18(1)(d), The Personal Data Protection Bill, 2019.

[9] Section 18(1)(a), The Personal Data Protection Bill, 2019.

[10] Section 18(2), The Personal Data Protection Bill, 2019.

[11] Section 18(3), The Personal Data Protection Bill, 2019.

[12] Section 91(2), The Personal Data Protection Bill, 2019.

[13] Section 40(1), The Personal Data Protection Bill, 2019.

[14] Section 40(4)(c)(i), The Personal Data Protection Bill, 2019.

[15] Section 40(4)(c)(iv), The Personal Data Protection Bill, 2019.

[16] Supra. note 12

[17] Section 26(4), The Personal Data Protection Bill, 2019.

[18] Section 27, The Personal Data Protection Bill, 2019.

[19] Section 28, The Personal Data Protection Bill, 2019.

[20] Section 29, The Personal Data Protection Bill, 2019.

[21] Section 30, The Personal Data Protection Bill, 2019.

[22] Section 28(3), The Personal Data Protection Bill, 2019

[23] Section 42, The Personal Data Protection Bill, 2019.

[24] Section 42(2), The Personal Data Protection Bill, 2019

[25] Section 50(2), The Personal Data Protection Bill, 2018

[26] Meghna Madavia, Personal Data Protection Bill can turn India into “Orwellian State”: Justice BN Srikrishna, The Economic Times (06:30 PM 8^th June, 2020) http://economictimes.indiatimes.com/news/economy/policy/personal-data-protection-bill-can-turn-india-into-orwellian-state-justice-bn-srikrishna/articleshow/72483355.cms

The post PERSONAL DATA PROTECTION BILL, 2019: THE GOOD, THE BAD AND THE UGLY appeared first on LexForti .