Header image alt text

Naavi.org

Building a Responsible Cyber Society…Since 1998

Our honorable Minister of IT Mr Ravi Shankar Prasad has stated that India will create a Global bench mark with its Data Protection Act which is being drafted now.

While we welcome the goal set by the Minister, it is time to discuss how India should approach creating the Global Bench Mark. The proposed Act will be based on the report of the Justice Srikrishna Committee which will actually draft the contours of the Act to which the Government will just add some structure.

Since Justice Srikrishna comes from the judicial background and we are fresh with the 9 member Supreme Court bench decision that “Privacy is a Fundamental Right”, it would be reasonable to speculate that the proposed “Data Protection Act” will operationalize the “Informational Privacy” as discussed in the judgement.

After the judgement, there is already a discussion on whether mobile information is subject to Privacy and whether Police can seize mobiles etc. There is therefore an apprehension that if the law is not properly drafted, there would be serious hindrance on the capability of Police in particular to carry out investigations. Criminals and Suspects will quickly jump to Courts and bring stay and by the time Police are able to get the stay vacated, the electronic evidence might have been irrevocably erased.

The proposed act will note that “Privacy” is equivalent to “Right to Control personal Information in data form” and hence protection of Personal information is the objective of the Data Protection Act.

Will the Act therefore focus only on protecting “Data that contains the personal information”? or will it extend its scope to all types of data including those which constitute say Copyright, Domain Names, Patents?, Will it also extend to corporate information such as financial data, marketing data or HR data? Will it also extend to log records? telephone conversations? …are all matters that this act will perhaps try to address.

This means that the Act should define what is “Data that has to be protected”? and then proceed to classify them into “personal” and “sensitive personal”, “other” etc.

The Act needs to also define who owns “Data” and whether “Data” is a property? and how the Data can be used by who soever owns?

When Data gets aggregated, value gets added and there is always a question whether this value addition belongs to the data subject or the data processor or the data controller who actually instructs the data processor to process the data in a particular manner. Under the Copyright law, the data base administrator gets the copyright on the aggregation part and therefore it recognizes different property rights between the raw data supplier who is the data subject and the entity which adds value which is the data processor or any other entity that uses the raw data .

If Copyright law recognizes copyright on data base creator, then similar principle has to be used in the data protection law also recognizing that the nature of property changes from the data subject to the data processor.

Once we recognize that “Data” is a “Commodity” and different values can be ascribed to it in different stages of its life time, we need to recognize it as a property which can also be traded.

Recently a store in London was reported to be accepting “Personal Data” as payment in exchange for goods. 

The “Data Dollar Store” appears to value the data you present and allow you to trade them. In a way it is a “barter” system . From the initial reports, it appears they may accept some photographs etc as “Personal Data with value”.

Of course if you offer “Digital Money”, perhaps they may not refuse since this also is “Data”… but the concept is interesting particularly for people who can create valuable personal data instances.

Coming back to our discussion on Data Protection Act, there are some practical problems that the authors of the law will encounter. Since the Supreme Court has not really defined “Privacy” but went on a wild discussion on what one eats or where one travels etc is all “Privacy”, the Zomatos and Make My Trips will be dealing with “Privacy Sensitive Information”. If therefore Government makes any law that tells how such companies need to collect information and deal with it, such a law may be questioned as a violation of a Fundamental Right not being saved by the exceptions of national security etc.

We realize that if we take this extreme view, then there can be no e-commerce without some form of personal data being shared with the service provider. Currently, accepted privacy principle is that one can collect personal information as long as it is necessary to provide the service offered and a “Consent” is provided by the data subject in the form of a “Deemed Contract”. The only discussion is on the quality of disclosure and ethics of the collector in collecting only the minimal required information and using it only for the purpose it is required.

But can the Government make a law stating that “The Fundamental Right of Privacy can be infringed by any individual if he has taken a consent in the form of undigitally signed web/mobile based acceptance forming a deemed contract in which the data subject’s rights are agreed to be infringed”. Will it be a “Contract for a consideration that is legally untenable”?

If we take a stand that this is a globally accepted principle and there is nothing wrong in the data subject entering into a contract with another person saying that he can make use of the personal data and he is not pressing his fundamental right, then we are automatically accepting that “Data is a commodity that can be transferred for consideration”.

Will Justice Srikrishna committee be having sufficient courage to say that “Personal Data” is a “Property of the Data Subject” and he can sell it for a price which includes agreement to use the services offered by a service provider?. If they do, then Government will not have any problem with its Aadhaar per-se or mandatory linking of Aadhaar with PAN or mobile number etc.

But If they do, they may be standing against the spirit of the 9 member Supreme Court judgement.

If the Srikrishna committee hesitates and continues to carry over the uncertainty on the definition of Privacy from the Judgement to the committee’s findings, the problem gets transferred to the Meity in drafting the law.

The Government can simply define the law as a “Law to protect the Confidentiality, Integrity and Availability” of Information and make it more as Cyber Security law than anything else. It will of course create the office of the Data Commissioner. It  may also introduce licensing of data processing and other regulations and in the process may make the life of E Commerce entities such as the Zomatos and Make My Trips miserable.

In the end, the law will be an extension of ITA 2008 and will not add much to the domain of “Privacy Protection”.

In all probability, this is what is going to happen and we will continue to keep worrying about the definition of Privacy and  without understanding its nature try to protect it in data form.

Considering the futility of such an exercise, I would like the Government to accept that given the wide definition of “Privacy Right” as ascribed by the Supreme Court, it is not possible to make a law that protects the unknown and omnipresent. 

Instead, the Government may focus on how the Citizens can be compensated when a “Data Breach” occurs and go onto define “Data Breach” and its consequences.

The definition of “Data” can apply to any information in electronic form and “Breach” is defined as any action which is a violation of a contractual agreement.

If we take this approach we need not define what is “Data that is Personal Information”, “Data that is Sensitive personal information” and “Data that is neither a personal information or a sensitive personal information.”.

If the  Supreme Court can use a strategy to define the “Privacy Right” without defining “Privacy”, Government may be able to create a “Data Protection Law” without treading on the difficulty of defining “Data which is Personal information that forms part of the Privacy Rights”.

The existing law in ITA 2000/8 and the rules there under, are sufficient to carry on the market activities since it already provides a definition of personal Information as well as Sensitive personal information in addition to the larger set called “Data”.

The new law can state that any person can enter into a contract with his data as a commodity and bring the data protection requirements under the Indian Contract Act read along with ITA 2000/8.

The new law can also enable and empower any business that may be set up to buy, sell, process or exchange data under a contractual agreement with the data subject or a personal data custodian to whom the data subject has transferred his personal data.

This will define the “Data Trading” concept and provide clarity to companies in Data Analytics and Big Data activities. It will also prevent the IoT industry from being stumped with the new Privacy debate since any information collected by the IoT device is likely to be considered as “Personal Data”. Though IoT data is linked to the device ID, along with the purchase and installation information, it is linked to the personal data of the owner and his location and hence will become a part of the “Privacy Right”. The CCTV captures will also be legally protected if a person walks into a mall and is being photographed by the CCTV system in exchange of the benefit of walking through the premises.

Additionally innovative companies may set up business to de-identify a data set and create value there on before they are actually sold for a profit which they can share with the data subject at the time of re-identification.

Some company may also set up a “Regulated Anonymity” system where it will absorb the identity and provide a proxy ID to the user with which he can do all transactions on the internet. The business can even run an  “Identity Gateway” where the identity such as Aadhaar or PAN etc can be pseudonomized without adversely affecting any service or security requirements of the Government while at the same time protecting the critical identity data from unknown threats.

It is to be recognized however that these intermediaries are still vulnerable to an Equifax type of attack on their systems which could compromise the customer data if they donot implement appropriate security measures.

In such a eco-system, the so called “Data Protection Law” may change its objective from “Protecting Data” to “Protecting the Citizens from  the consequences of a Data Breach” where Data breach is defined as an unauthorized data access in contravention of the data sharing contract.

Such consequences will of course expand on what ITA 2008 now says as “Intermediary Responsibilities”, “Civil Liabilities” and “Cyber Crimes” but with a better implementation mechanism.

The new law can additionally define a system of “Leasing of Personal Data” different from “Selling of Personal Data” to meet temporary requirements. This would automatically incorporate a right some where nearing the “Right to Data Erasure” as referred to in GDPR since data leased cannot be used beyond the lease period. It will automatically terminate the rights of the data processor and shift the onus on him to get the contract renewed much better than the current “Opt-In” system.

The new law can also talk of “Fundamental Duties” of a citizen as a “Data Subject” and uphold his fundamental rights to decide how he can use his personal data including monetizing the personal data as if it is a property that belongs to him. If there after a challenge is mounted on the law in the Supreme Court and it  has to take objection to this law, they have to object to the provision that defines the fundamental duty and fundamental right of a citizen to deal with his own data property. Hence the law may be protected against a legal challenge.

In this context, it would be better to call this law not as “Data Protection Law of India” but as “Data Breach Protection Law of India”.

Naavi

Equifax Data Breach… What are the learning points for our Data Protection Act?

Posted by Vijayashankar Na on September 10, 2017
Posted in Cyber Law  | 1 Comment

The Equifax Data Breach in USA is considered one of the most severe data breach of all times. For records, it is said that the largest data breach in terms of records compromised was Yahoo data breach with 1 billion compromises and the next was MySpace data breach involving 360 million accounts. But the nature of data that has been compromised in Equifax incident makes it the most severe in terms of the consequences.

Equifax has admitted a breach to the extent of 143 million accounts of US citizens and there could be more in UK and Canada. It is therefore the third biggest in terms of data breach numbers and could climb higher.

Equifax is a credit rating company and holds records of not only its direct customers but also other members of the public who might have never directly interacted with and given consent for sharing any of their personal or sensitive personal information. The 143 million number may reflect its client base and actual data breach in terms of numbers could be far higher.

The type of information that Equifax held in respect of different persons could vary from personal information such as Name birth dates, addresses, Social Security Numbers, Driving license numbers etc. Being a credit monitoring company, Equifax collected vast amount of financial information from consumers without their knowledge. Associated information such as the Credit card data is also suspected to have been compromised in thousands of cases.

In the light of the information available in public we can look at what lessons we can draw in India from this data breach.

CIBIL is under similar Risk

The Indian equivalent of Equifax is “CIBIL” and similar agencies like Experian India, Credit mantri. According to Bankbazaar.com, equifax also operates in India. We should brace ourselves for a similar breach in India where the sensitive information with CIBIL may one day be breached.

In India credit rating agencies initially started with CRISIL and CARE which focussed on rating of Corporate securities and Fixed Deposits of NBFCs. CRISIL and CARE learnt their trade by experimenting their credit rating systems against the NBFC industry in India and can be historically held accountable for  one of the worst financial disasters in India with the failure of CRB capital Markets and subsequent developments that caused an upheaval in the NBFC market.

The undersigned was one of the early proponents of personal credit rating mechanism but at that time, only First Leasing Ltd headed by Mr Farouk Irani was speaking of Personal Credit rating. It is a tragedy that today Mr Farouk Irani is in deep trouble and under ED investigation but the fact that he was one of the early thought leaders in the field of Personal Credit Rating in India has to be acknowledged. The undersigned was however trying to convince the Shriram Group with a wide spread presence in the personal lending sector through their “Chit Funds” to enter the field of Personal Credit Rating but could not succeed. After nearly 15 years, we are now into the era of the foreign Credit rating agencies including Equifax.

There are a few of this new generation agencies which profess to make credit assessments through social media activities of individuals and in the process collect large volumes of personal data. CIBIL is a little more civilized since it directly collects data from the Banks and lenders under the RBI patronage and hence need not scan the social media for information. The accuracy of data with CIBIL is debatable but it is perhaps still a good reference point for most lenders.

Going by the history of how Indian Credit rating agencies have developed,  it is not unrealistic to expect that CIBIL data is today accessible through hundreds of service providers and not all of them will be as secure as they should be and hence the possibility of data breach from Indian credit rating agencies is very much possible. Just as Aadhaar data was easily accessible through many e-hospital portals, CIBIL data is accessible through many Apps and portals which can be compromised by hackers to extract sensitive data. Hence a repeat of Equifax incident in India with CIBIL can be expected. It will at least be a “Risk” that CIBIL needs to patch.

One of the mistakes that we are making in India is to create an integrated frame of data reference through Aadhaar and PAN as well as UPI and GST. These strategies have resulted in a single interface which if breached can expose a billion data sets. Had the data been distributed some on aadhaar number, some on PAN number and some on Bank account numbers etc, then breaches would have been contained in individual silos. Government in a bid to manage the information, has used a strategy to integrate all sensitive data using a single user ID such as Aadhaar instead of silently working behind the scenes to integrate the data bases in the back end.

This wrong strategy has created a higher risk and a greater incentive for hackers

Privacy Risk back in debate

The Equifax data breach has indicated that in such cases, the sensitive personal information gets leaked from agencies which were never given a consent to collect such information in the first place. In the context of the debate on “Privacy is a Fundamental Right” it is a moot point how CIBIL’s activities may be questioned in the coming days in India.

Inadequacy of Cyber Insurance

The Equifax incident also throws up the inadequacy of Cyber Insurance for such organizations since the cost of the breach such as providing notices to 143 million persons, providing free credit monitoring to persons who have lost credit card information and suffered consequences of identity theft with the compromise of social security numbers etc will run to a billion of dollars as against the US $ 100-150 million dollar insurance that the company now holds.

Insider Trading possibility

The share prices of the company has come down by 14% after the incident and one need not be surprised if the company folds up and goes bankrupt. It is interesting to note that some of the executives of the Company are reported to have sold large chunks of shares just before the breach which indicates a possible insider trading. This could also indicate internal dissensions that could have led to the breach though for records Equifax attributes the breach to some vulnerabilities in the “Open source Struts Software distributed by the non profit Apache Software Foundation”.

We all know that in all cases of data breach there is a gap between the recognition of data breach within the Company and its confirmation and disclosure. If the company is a listed company, during this period many persons within the company will have sensitive corporate information that has not been reported to the stock exchange and hence constitutes a breach of stock market obligations.

At the same time if the executives start trading on the stock markets, it will constitute insider trading.

It is therefore essential that under the Information Security policy, a listed company should mandate that no member of the internal team who is aware of the breach shall trade the shares in the market.

Equifax Response

It is also interesting to note how Equifax has responded to the incident through their website which is an indication to Indian Companies who often flounder when faced with major PR disasters.

Equifax.com now redirects to the personal section where a prominent mention has been made

on the incident and a redirection is provided to a new site equifaxsecurity2017.com

In this website full details of the developments are provided and this forms a public disclosure of the breach incident. It also provides for checking the potential impact against a social security number.

At this point of time we are not aware how Equifax is addressing the possible breach of persons who are outside USA. It is also now known if their data has also been breached.

The equifax breach affecting the social security numbers through a user organization is exactly what we in India have faced and will continue to face regarding the breach of Aadhaar data in India.

The reality is that when you allow data to be used by a number of users (Data really exists for this purpose and this cannot be avoided) and they can also store the data extracted from a central source, we cannot always ensure that the security cannot be breached at the user’s end where the data from the central source is stored. Most of the time The leaked data cannot be distinguished as to the source of the leak and hence the central data base has to face the public spat.

Since the media persons donot understand the intricacies of data usage, they always blame wrong persons for the breach and Police tend to follow the media trial. In the process citizens always get incomplete and inaccurate information of the incident and its impact.

Data Protection Act

The problem with the Aadhaar data base in India is that it is linked to the biometrics and hence once the data is leaked, the privacy value of the data is lost for ever. Even in the USA, with the leak of the social security numbers associated with the equifax set of data,  when used with other biometric data bases could mean permanent loss of Privacy for all the affected victims.

Under the present circumstances all around the world where “Privacy” is linked to “Personal Information” stored by millions of intermediaries and the possibility of large scale data breaches, it is futile to believe that “Right to Privacy as Right to control how the personal information in data form is to be used” really exists.

The Government of India is now trying to form a “Data Protection Act” and the Minister aims at meeting global standards of data protection in India through this Act. But if the global standards of data protection is indicated by what happened in Equifax, it is clear that we are chasing  a dream that cannot be fulfilled.

It is better that both the Government and the Supreme Court realizes that “Data Protection” is a good faith, best effort and the focus cannot be on “Data has to be protected in such a manner that it cannot be breached”.

On the other hand if we focus on “Data Trading” as a concept and declare “Data as a Property” which the individuals can trade, at least we will not be misleading the public that “Data Protection” and “Privacy Protection through Data Protection” can be implemented in India to the extent they believe it should be.

Once this concept of “Data Trading” is accepted in law, we may be able to legitimize “Data Pseudonomization” as a business proposition and the concept of “Regulated Anonymity” can actually be put in practice.

At present, the Srikrishna Panel on data protection is unlikely to be considering any such proposal and hence the Data Protection Act which will follow may miss an opportunity to pursue realistic data protection regime in India.

In our opinion, there is no practical use in simply repeating the words

“Privacy is a Fundamental Right and Personal Data Protection is a constitutional obligation of the Government” which should be translated into a Data Protection Law”

Instead of beating round the bush we must accept that Data cannot be protected for ever and we need to plan the data protection act with a declaration in the preamble that

“Data Protection is a journey in which the goal will never be reached and hence the law aims at providing only a framework for responsible data sharing with the consent of the data subjects and providing for legal remedies for breach”.

The law may therefore in effect not be a “Data Protection Act” but a “Data Breach Act” or “Data Breach Protection Act” whatever may the title assigned. It should incorporate all the lessons that Equifax teaches us along with other similar experiences.

Any other expectation is hypocrisy.

Naavi

 

Related Articles:

Reuters-Sept 8:

Indian Credit Rating Agencies

Equifax is in India

What Equifax says on September 8