Vidwat Sabha to discuss IRCTC Data Conundrum

IRCTC Data Monetization proposal has drawn attention of a wide set of audience. It is reported that the Standing Committee of IT headed by Mr Shashi Taroor has summoned IRCTC officials to discuss the plan.

In the light of these developments, FDPPI is holding a “Vidwat Sabha” (A discussion by experts) at 7.00 pm today on the You Tube. It is open to all and request interested audience to join. (For background information please check this article and also this article on Monetization)

 

 

 

 

 

 

Posted in Cyber Law | Leave a comment

Regulation of Monetization of Data in NPDAI and IRCTC issue: Shape of Things to Come..13 (Monetization)

(Continued from the previous article)

P.S: This series of articles is an attempt to place some issues before the Government of India which promises to bring a new Data Protection Law that is futuristic, comprehensive and Perfect. 

In our continued discussion on “The Shape of Things to Come”, we have so far discussed the following.

  1. Introduction
2. Preamble 3.Regulators
4. Chapterization 5. Privacy Definition 6. Clarifications-Binary
7. Clarifications-Privacy 8. Definitions-Data 9. Definitions-Roles
10. Exemptions-Privacy 11. Advertising 12. Dropping of Central Regulatory authority

We have also discussed IRCTC issue in particular in two articles and three other articles on Digital India Act regarding Block Chains, and Meta Verse,

While discussing the “Chapterization” of the proposed NDPAI, we had suggested a separate Chapter for “Data Valuation Framework” to discuss all issues regarding data valuation.

The IRCTC issue has now pre-empted the discussion of some aspects that should go into this Chapter.

Naavi has already published detailed recommendations on “Data Valuation Standard of India”   (DVSI) where we have discussed suggestions on why Data needs to be brought into the Balance Sheet of a Company as an “Special Asset” and how it can be valued  etc. The objective of DVSI was to provide visibility to the value of the asset which the DPO/CISO would be required to protect so that  the Board could deploy appropriate resources in terms of men and material.

It is found that “Monetization” as a concept has not been specifically discussed either under GDPR or under PDPB 2019. In fact, privacy activists hate the word “Monetization” though all Data Professionals live out of the revenue generated by “Advertising” and “Advertising” itself is one avatar of “Monetization”.

In our recommendations on the Shape of Things to Come we have already discussed the need for defining “Advertising Profile” and the means of using it. This concept has to go with the larger definition of “Monetization” and “Data Valuation” which may be specifically addressed in a separate Chapter.

If the term “Monetization” is defined in law, then the Courts will have some guideline on how to interpret the objections that may be raised later when the data protection law is in place. Not providing a definition will leave a wide scope for interpretation which may be detrimental to the economy and business.

We therefore consider that IRCTC tender issue has provided us an opportunity to debate this point whether “Monetization” has to be defined in data protection law and if so how.

Our suggestion is to define Monetization as follows:

Monetization of Data

Monetization of Data means a structured plan to generate revenue out of Data   in the custody of a Data Manager whether personal or non personal, and includes use of the data for advertising or promotion of the products and services of the Data Manager and/or licensing the use of data to another data manager.

Explanation: Monetization of data can be of anonymised or identified or de-identified or Pseudonymized personal data. However Anonymized personal data is non  personal data and its use does not require consent of the erstwhile data principal.

Monetisation would be a type of use of data and may be subject to “Consent” if the data is identifiable or de-identified or pseudonymized. However when data is anonymised as per the acceptable standard it is considered non personal data and there is no identifiable data principal associated with such data and hence consent is not essential to be documented. In the event an “Anonymised” personal data is “De-anonymisable”, then it would be treated as “Negligence” or “Failure of Due Diligence” of the anonymization done by the Data Manager and treated accordingly for fixing liability.

The IRCTC plan as per its tender document consists of using the monetization for its own benefit. As long as any sharing of processed data is in anonymised form, IRCTC may be within the law. In other cases of use of data for itself, a proper explicit consent may be necessary for monetization.

In the IRCTC issue as reflected in the tender document therefore, the ability of IRCTC to use monetization may be within the data protection law. However it needs to ensure that appropriate controls are in place before the data is entrusted to an outside agency for further processing.

My personal advise to IRCTC is to make use of the “Pseudonymization Gateway” software recommended by the undersigned for “Certification of Data Importers in India for GDPR compliance” and keep the control on the data with themselves and not share identifiable data with any private sector company. Even for processing of anonymized data by any external company, adequate controls, restrictions and indemnities should be incorporated to prevent use of data by the agency outside the contract with IRCTC.

At present the tender document may not have all necessary controls in this respect and at the time of evaluating and approving the contracts, IRCTC should take steps to incorporate suitable controls to prevent “Further Monetization” of secondary data by the agents to whom the processing contract is awarded.

Such “Recommended Controls” to regulate “Unauthorized Monetization” needs to be incorporated in the “Monetization Policy” of an organization that should be part of the “Privacy By Design Policy” to be filed with and certified by the Data Protection Authority.

Some more thoughts on this may be incorporated in the further discussions on “Shape of Things to Come”.

Naavi


P.S: These discussions are presently for a debate and is a work in progress awaiting more inputs for further refinement. It is understood that the Government may already have a draft and may completely ignore all these recommendations. However, it is considered that these suggestions will assist in the development of “Jurisprudence” in the field of Data Governance in India and hence these discussions will continue until the Government releases its own version for further debate. Other professionals who are interested in participating in this exercise and particularly the Research and Academic organizations are invited to participate. Since this exercise is too complex to institutionalize, it is being presented at this stage as only the thoughts of Naavi.  Views expressed here may be considered as personal views of Naavi and not that of FDPPI or any other organization that Naavi may be associated with. 

  1. Introduction
2. Preamble 3.Regulators
4. Chapterization 5. Privacy Definition 6. Clarifications-Binary
7. Clarifications-Privacy 8. Definitions-Data 9. Definitions-Roles
10. Exemptions-Privacy 11. Advertising 12. Dropping of Central Regulatory authority
13. Regulation of Monetization of Data  14. Automated means ..

 

Posted in Cyber Law | Leave a comment

IRCTC Should not become another scam like CIBIL

(Continued from the previous article)

The initial reactions from the market on the IRCTC tender document which spoke of appointing a consultant to study and implement a “Data Monetization” policy was to suggest as if IRCTC is about to loot the public and infringe on the privacy rights in a big way.  Simultaneously there were a few reports to suggest that IRCTC will backtrack and withdraw the proposal because of the criticisms.

In the past IRCTC has been accused of not adopting adequate information security on its ticket reservation platform and using excessive advertising to the extent of annoying the users. A few articles have also been written in this website on these issues.

However that does not mean that IRCTC should be blindly criticised for their latest move in trying to create higher value out of its data assets. As long as the “Data Monetization Program” is handled without a marginal adverse effect on the customers of IRCTC, there should be an open mind to appreciate that there has been a recognition that certain assets of the organization which have a value can be re-valued and used in a better manner to generate more revenue.

It is fine to flag the Privacy infringement risks but there is a need for critics to study the intentions as expressed in the tender document, and thereafter follow the implementation plan to raise their objections to the next level.

We would also like IRCTC to not chicken out like the UIDAI (in withdrawing its tender for monitoring social media) or the Government in withdrawing the farm laws. Instead they should stand and fight the opposition in cases like the Agniveer scheme. If there intentions are honest, they should not cave in for the criticism which will only embolden the critics for further such attacks to prevent the Government from introducing any progressive measures.

We have appreciated the Indian Railways when they have expressed plans to generate solar energy by planting solar panels on train tops, convert bogies into mobile hospitals during Covid time etc. Similarly any other innovative measures to use their data assets and generate more revenue is not to be opposed per-se.

Naavi has been advocating that “Data Valuation” and “Bringing Visibility to the Data in the financial statements” of an organization is required and we have added it as one of the suggested Data Protection controls under the DPCSI (Data Protection Compliance Standard of India). We have discussed this topic extensively both under Naavi.org as well as under the separate website www.dvsi.in .

(please also refer this article or to the video available here)

We therefore look at the IRCTC projects with an open mind and look at what are the positives behind this tender. We reject the hypocrisy of critics who accept the private sector’s attempt to monetize the data surreptitiously and raise public money through IPOs and the dubious records of some organizations which opposed the data protection bill till it was withdrawn and are now using the withdrawal of PDPB 2019 as another ground of criticism. The same critics also objected to the provision in PDPB 2019 which empowered the Government to pick up anonymized personal data from private sector companies for public good though they were aware that the private sector companies were collecting and monetizing personal data in violation of all known norms.

The subject tender document indicates two projects.

Under Project A, the objective is “To study monetization of digital data of Railways” . In this project the Railways will share the kind of applications they use and the type of data collected so that the consultant can understand the data environment and identify the potential value of the data collected and how they can be leveraged. At this stage there is no need for the consultant to access real personal data except for testing purposes.

IRCTC can “Pseudonymize” the personal data even for testing purpose so that “No harm” is caused to the passengers due to any activity that arises from this tender.

The tender document specifies that the study shall be conducted in compliance with laws including ITA 2000 and its amendments as well as the Personal Data Protection Bill 2018 of India.

We may point out that they could have mentioned the JPC vetted PDPB 2019 instead of PDPB 2018 though the justification could be that PDPB 2018 is a draft owned by the Justice Srikrishna Committee and cannot be questioned on political bias.

The deliverables under the project are creation of a framework for using the data and crating a monetization strategy.

What IRCTC has set out to do is what every “Data Driven Business Organizations” needed to do immediately after Kris Gopalakrishnan committee gave its report on “Non Personal Data Governance Framework”.  This committee suggested that organizations need to recognize “Data Business” within their activities and generate a recognition of “Data Assets”.

We have earlier pointed out two incidents in USA where data valuations have prevented companies from declaring insolvent and two cases from India where lack of data valuation resulted in one company being declared insolvent and another company selling valuable national assets to a foreign agency without any record of consideration collected. Briefly the incidents are discussed below. There could be many more such incidents which we may not be aware.

1.Case of United Airlines and American Airlines

United Airlines collaterised its passenger data held in the “Milege Plus” scheme (loyalty scheme) which was valued at $20 billion at a time its market capitalization was at $ 9 billion.

Similarly, American Airlines valued its loyalty scheme data of “AAdvantage” at $19.5 billion when its market capitalization was $8 billion

2. Caesar Entertainment Operating Corp

Creditors of this company encashed its Total rewards customer loyalty data base for over $1 billion which was more than the value of Ceaser’s Property.

3. Case of Net4India.com

Net4india.com was the leading domain name registration company in India which the NCLT declared as insolvent because of their inability to repay Rs 100 crores of borrowings from SBI. In the process, NCLT failed to recognize the presence and value of data assets worth far more than Rs 100 crores and let the company be closed liquidating the real estate and causing losses to more than 3 lakh customers of Net4India. (Check out for details here)

4. Case of CIBIL and Trans Union

CIBIL is the credit rating agency started under a separate statute to assist the Indian Banking industry. Initially it was owned to the extent of 80% by Banks in India and agreed to share the data of borrowers for better debt management. However today this organization has become “Trans union CIBIL” which is a private sector company listed in USA with a share holding of 92%. In the process, sensitive personal data of 500 million Indians, worth over a few lakhs of crores of INR became the property of this US private company.  This was a scam because the loss was on the account of Indian Banks who transferred their shares to Trans Union under an undisclosed deal.

We have also pointed out earlier that Vodafone is sitting on a gold mine of monetizable information which could be beneficial to its share holders.

In any of these instances there is no need to sell customer’s data. The value of the data is substantial even in anonymized form or pseudonymized form or de-identified form.

Value of data in identified form is even higher and can be used provided there is appropriate “Consent” from the data principals.

Naavi had developed a patent application around 2008-2009 under the title “Ad View Certification” where monetization of “Advertisement Views on websites” were sought to be monetized with a sharing of revenue with the contributors of data. These were the days before the concept of “Data Subject” or “Data Controller” or “Data Protection” were known in India. The patent was abandoned as it was not commercialized.

What IRCTC is set to do and what Net4India and CIBIL failed to do is therefore well within the realms of possibility and can be achieved without causing any privacy harm to the railway passengers.

While IRCTC estimates a value of Rs 1000 crores to be unearthed, our estimation is that it could go to several tens of thousands of crores. Implementation of digital assets to discover this Rs 1000 crore value is the scope of Project B in the IRCTC tender.

If this tender goes through, it will be one of the Big Tech companies  with experience in big data analytics which may be  involved. Their objective could be to discover data value in excess of Rs 1000 crores, hand over Rs 1000 crores to IRCTC and exploit the rest.

The challenge for Privacy Activists therefore is to ensure that IRCTC either through  ignorance or through corruption does not become another CIBIL when lakhs of crores worth data is made accessible by the implementer of this project (Particularly Project B).

If at all we need to criticise the tender is to question the ability of IRCTC to safeguard its assets from being exploited.

Though it is stated in the tender document that,

” The implementation strategies of Bidder shall comply with various Acts or laws including IT Act 2000 and its amendments, User data privacy laws including GDPR (General Data Protection Regulation) and current ‘Personal Data Protection Bill 2018 of India, and accordingly propose the business models for monetization of Digital Assets and  the Bidder shall ascertain the legality and extent of Monetization of Digital Data of IRCTC before the potential is delved into.”

…it is not explicit on protection of stealing of data particularly since this could be implemented as a Build-Operate-Transfer project.

This project will generate what Kris Gopalakrishnan Committee termed as “Sovereign Data” and it needs to be protected like the Gold or Minerals which are dug out by a private operator from a Government owned mines.

One objection we would like to notify is that the tender  does not appear to have flagged the Cyber Security threat including the Data Theft risk and identified corrective measures with indemnity and criminal consequences.

The real concern is in the data being handed over to an unscrupulous operator, developed into a valuable asset but the utility of the same is not available to the Indian Government.

Will IRCTC clarify on this concern?

Naavi

Also refer

CBI Enquiry is required for finding the truth behind TransUNion taking over CIBIL

Is Trans Union-CIBIL guilty of accessing Critical Personal Data through surreptitious means?

Mistaken Identity lands TransUnion in a $40 million class action suit

Posted in Cyber Law | Leave a comment

IRCTC Tender and Data Protection

IRCTC has issued a tender document on “Monetization of Data” which has invoked strong reactions from Privacy and Data Protection industry.  A copy of the document is available below.

Tender document

In 2018, UIDAI had issued another tender request regarding “Monitoring of Social Media”. This was a tender for monitoring reports about UIDAI in the media just like scanning of news papers by reputation management companies. But the Andolan Jeevies raised a hue and cry, the pliant and ignorant Supreme Court obliged and the cowardly Government withdrew the tender notification.

Details of the above UIDAI incident are available in the search link below:

1.Search on Naavi.org for UIDAI+tender

2. “Supreme Court Slams UIDAI”.. Is it a fake news created by Economic times?

3.Supreme Court should make public the suggestions made by Abhishek Manu Singhvi

Now a similar incident has surfaced about a tender document. This tender issue is directly related to the “Privacy” and also is issued by an organization under the Railway Ministry which is supervised by Mr Ashvini Vaishnaw who is also the cabinet minister for IT.

Naturally we should therefore expect a vehement opposition from the Privacy Activists far larger than in the UIDAI case. But at present the MeitY has also withdrawn the PDPB 2019 and created a perceptional vacuum regarding the availability of law in India for data protection. (P.S: I call this vacuum “Perceptional” since ITA 2000 continues to exist at present and Section 43A continues to apply).

Will the Government be capable of standing upto the opposition and justify the tender? or withdraw it is the question.

Already there is one report that suggests that the tender may be withdrawn.

Kindly peruse the following articles:

  1. IRCTC plans to sell user data, seeks Rs 1000 crore in revenue, floats tender
  2. IRCTC to mothball monetization of data over privacy concerns: Report

However this would be a good case for academic debate and we should discuss this in the interest of creating “Data Protection Jurisprudence”.

We shall therefore analyse the issue in greater detail in the continuation of this article.

Watch out for the continued article..

Naavi

 

Posted in Cyber Law | Leave a comment

Is Inc42.com driving our Ministry of IT?..Shape of things to come..New Data Protection Act of India-12

(Continued from the previous article)

P.S: This series of articles is an attempt to place some issues before the Government of India which promises to bring a new Data Protection Law that is futuristic, comprehensive and Perfect. 


There is an interesting headline appearing in inc42.com today which is a media considered as an anti-Government media. It says “Govt May Drop Centralised Data Protection Authority From New Privacy Bill: Report .

The article confidently proclaims that the concept of DPA as was proposed in the Data Protection Bill would be scrapped and in its place Government is planning to introduce a “Grievance Redressal Mechanism”.

The logic for the same is also provided in the news report which says.. “A lot of the functions that were allotted to DPA were out of its remit; the collection, storage and sharing of personal data will either be worked into the law itself or be included in the rules that will be made under the law, the report quoted an official as saying.”

It proceeds further to say

” According to the official, the government does not want to not overwhelm one authority and increase compliance costs for small companies.”

..and also that “Another official was quoted as saying that the government is looking at making the bill as uncomplicated as possible.”

It appears that there were more than one official who was perhaps sitting across a pub table and talking to journalists at inc42.com and Hindustan Times about what is being contemplated.

I wonder who are the officials who are leaking such views to inc42.com. If any official from Meity is providing such information, the Government should be seriously concerned how such information is leaking out before it is officially announced. Probably an investigation has to be conducted to know if there is any violation of the official secrets act.

A thought however occurs…are these reports being planted…?

Because the Government wants to test the reaction of the public on such suggestions? or

Is  inc42.com which is asking the MeitY to act as suggested and behaving like a super minister?

Either way, the honour of MeitY and that of the Ministers are at stake since it is clear that decisions are being taken by vested interests in the market on what kind of law is required.

I am reminded of the Nirav Modi -PNB fraud case where it is reported that Letters of Guarantee were being issued by the clerks in Nirav Modi’s office instead of the Bank Officers from their  Bank servers.

It appears that inc42.com is the Nirav Modi for the Ministry.

There is a fair possibility that inc42.com may be bluffing just to create an opinion on what is suggested and the reporter could have confused himself/herself with the grievance redressal system suggested under the Intermediary Guidelines under ITA 2000.

It must be stated that this proposition under Intermediary Guidelines is itself ultra-vires ITA 2000 and it was a reflection of the quality of advisors who had finalized the idea. The same set of un-informed persons must be suggesting that the Data Protection Authority can be scrapped and the “Grievance Redressal Mechanism” can take over all the responsibilities of the proposed DPA.

It should be noted that the article of inc42.com quotes Mr Rajeev Chandrashekar and gives the impression that these thoughts including that “Bill would hurt Start ups” are his thoughts.  I am sure that Mr Rajeev Chandrashekar who sat through the JPC is aware that PDPB 2019 provided 3 years of Sand Box provision which could be used by Start ups to postpone the implementation of the provisions.

If a further two years were given for implementation,  then a total of five years time would have been available for start ups to implement PDPB 2019 after its passage.  So it is unlikely that Mr Rajeev Chandrashekar would have held such a view.

It is however necessary that Mr Rajeev Chandrashekar should clear his name and disown the press reports which are being leaked apparently from his office.

For the information of all, we would like to say that the functions of the DPA are not limited to “Grievance Redressal” which is taken care of by the Adjudicator and the Appellate Tribunal. There are other functions of the DPA which perhaps the Inc42.com reporter is not aware.

It is clear that the PR mechanism of the Anti Government lobby is at work and trying to plant such stories from time to time to create a ground for the Government to create a draft which will embarrass the Modi Government.

It is unfortunate that the Ministers are not serious in preventing such fake reports  quoting their names.

This  is part of the Information Warfare which the Government is trying to address through the Intermediary Guidelines.

I hope better senses will prevail with the Ministry which should take steps to curb “Quotes” from their officials. If inc42.com has any suggestions, it is free to make them as their suggestions and not drag the names of ghost employees of the Ministry.

At the same time, if the officials of the Ministry donot openly disown the statements attributed to the officials, it should be considered as an admission that it is correct and there is a conspiracy to let the draft be prepared by the media than the real experts.

We therefore demand that the Secretary of MeitY provides a public clarification about the names of the officials who have been leaking the draft under preparation.

Naavi


P.S: These discussions are presently for a debate and is a work in progress awaiting more inputs for further refinement. It is understood that the Government may already have a draft and may completely ignore all these recommendations. However, it is considered that these suggestions will assist in the development of “Jurisprudence” in the field of Data Governance in India and hence these discussions will continue until the Government releases its own version for further debate. Other professionals who are interested in participating in this exercise and particularly the Research and Academic organizations are invited to participate. Since this exercise is too complex to institutionalize, it is being presented at this stage as only the thoughts of Naavi.  Views expressed here may be considered as personal views of Naavi and not that of FDPPI or any other organization that Naavi may be associated with. 

  1. Introduction
2. Preamble 3.Regulators
4. Chapterization 5. Privacy Definition 6. Clarifications-Binary
7. Clarifications-Privacy 8. Definitions-Data 9. Definitions-Roles
10. Exemptions-Privacy 11. Advertising 12. Dropping of Central Regulatory authority
13. Regulation of Monetization of Data  14. Automated means ..

 

Posted in Cyber Law | Leave a comment

Digital India Act…Discussions-3: Is Blockchain covered under the ITA 2000?…

This is part of a series of articles on the proposed Digital India Act set to replace the ITA 2000 which was once amended in 2008.  Now MeitY is interested in bringing the law upto date to accommodate the current technology eco system which includes Blockchain, Artificial Intelligence, Meta Verse, Crypto Currencies and new crimes like Ransomware.

In this context some discussions have ensued in the media stating the inability of the current ITA 2000 to cover the new IT environment such as Blockchain, Meta Verse etc.

We have already been presenting a series of articles on the New Data Protection Act of India addressing the replacement of the PDPB 2019 which was also shelved.  Since media has already started a motivated discussion on the Digital India Act as a replacement of ITA 2000, we need to simultaneously start a branch  of discussion on ITA 2000 replacement with DIA in addition to the PDPB 2019 replacement with the NDPAI.

I request all interested persons to keep watching this space and add their comments.


Block Chain is a favourite of one section of the society because it is the platform on which the popular Crypto Currency namely the Bitcoin runs. We are all aware that the Bitcoin is the currency of criminals and store house of digital black money and it’s popularity is because it facilitates corruption and monetization of crime.

In order to provide respectability to this Bitcoin platform other applications are often quoted to say that Block Chain is a useful technology. However if Block Chain is a distributed ledger of electronic transactions with a “Consensus Based Authentication”, it has already been overtaken by new technology like Hedera Hash graph.

We understand that there is a strong Bitcoin lobby in the MeitY which would like to legitimize Bitcoins and other Crypto Currencies. The Finance Ministry is also also in favour of Crypto Currency regularization. Supreme Court understands that Bitcoin is a good system for corruption and therefore supported the Bitcoin lobby against the RBI. The RBI is steadfastly opposed to regularization of Crypto Currency and the MHA may also be worried that Crypto currencies would be used for financing terrorism against the country.

In this background, we strongly oppose any backdoor being opened through the Digital India Act to give legal acceptability to Crypto Currencies.

Let us however look at the need for changes to be made to ITA 2000 that would affect the Crypto Currencies and Block Chain.

Block Chain in its popular form is a  technology where bundles of transactions are added to a block and connected to another bundle of transactions in the next block and continue the process of creating a ledger of transactions as a chain of data blocks.

Each Block contains a summary of transactions of a particular type  within a limit set by the block. Each block will have a block identity and the data will be distributed to a group of entities called the nodes. Every node will have a record of the transactions so that no change can be made to the block without it going out of sync with the block copies already with other nodes.  The transactions added into the block will be in encrypted form so that they cannot be altered. In the Bitcoin system a reward may be provided for one node in every block for creating the node along with a proof of work in the form of solving a puzzle.

If each data block is “Data” as defined in ITA 2000, there is no change of law required to provide legal recognition to a “Block Chain”.  Existing ITA 2000 recognizes electronic documents excluding those which are listed under Section 1(4)-Schedule I.

The exclusions provided in ITA 2000 are not based on what technical type of document it represents such as whether it was created on Microsoft Windows OS or Linux or Apple iOS or a Block Chain. The exclusions are based on the functional utility of the electronic document for the human users such as

a) Promissory Note and Bill of Exchange

b) Power of Attorney

c) Trust Deed

d) Will

e) Document of Title to an immovable Property

Any of the above documents created as an electronic document does not have “Legal Recognition” as any other document such as a contract document  created in electronic form.

If Block Chain is used for creation of any of these documents they would not be legally recognized. However in all other documents including “Smart Contracts”, a block chain document would be legally recognized and hence even under the current law, a block chain document for purposes other than the excluded documents, is usable.

Encryption and Digital Signature if it is part of the document, ITA 2000 has corresponding provisions which is legally acceptable as authentication.

The use of Block Chain for Crypto Currency would however be not possible because the RBI Act prohibits the any person other than RBI to issue an instrument which can be used as a “Currency” for general purpose exchange for goods and services.

A Crypto Currency by nature is an “Electronic Document” and it is recognised as such under ITA 2000. However if two persons exchange Crypto Currency with an understanding that it is “Currency” or “Notes”, it is prohibited under law and it is punishable.

In order to be more specific, it is possible to mention under Schedule I of the ITA 2000 that “Any instrument used as Crypto Currency” is one of the excluded documents.

As regards NFT, it is not necessarily considered as “Currency” since it is non fungible and unique. Hence it is valid under ITA 2000. However, purchase and sale of an NFT has to be done through legit currency like INR and not with any Crypto Currency.

In view of the above, we donot need any new law to address the Block Chain. It is therefore in-correct to say that ITA 2000 is archaic and cannot handle the issue of blockchain. If at all any body wants the new law to address Bitcoins or Crypto Currency, it is only to regularize the usage of Crypto Currency in violation of the RBI Act.

As regards crimes related to NFTs, it is within the Section 66 of ITA 2000 and does not need a new law as it relates to modification or alteration of the electronic document or  denying its access to the legitimate owner. Hence both Section 43 and 66 are applicable.

I wish MeitY consults persons who are aware of the law under ITA 2000 before releasing statements that ITA 2000 cannot handle modern technology.

Problems related to crime investigation in Crypto world arises because of anonymity of the transactions and the PKI encryption used. ITA 2000 has the power to demand decryption but like the “Proton Mail” the Crypto Exchanges are not co-operative.  Crypto Exchanges are however intermediaries and they will be not only liable for money laundering for their own transactions but also for the customers if they cannot identify them.

Under the new Intermediary guideline every user needs to go through KYC process at the time of registration and log records of every transaction need to be maintained. If the Exchanges and Wallet Account companies are foreign companies, the Government will find it difficult because this is a Criminal Mafia and will not co-operate with any Government agency.

In view of the above, the MeitY will be acting in violation of the law of the land if they donot specifically ban Crypto Currencies. If there is any attempt to legitimize the Crypto Currency in the new Act, then it will be ultra vires the law of the country.

We need to see if the power of corruption will provide courage to MeitY to regularize Bitcoins and Crypto Currencies in one pretext or the other. If so, we need to see if Mr Narendra Modi can understand the problem and take action.

RBI should not compromise its principles and it is unlikely to happen as long as the current Governor is in place. We donot know if RBI is compromised later.

We trust that the Supreme Court under the current CJI does not cave in  like the bench which heard the in-famous Crypto Currency case which was a fraud on the Indian legal system.

Let us keep our fingers crossed….

(More will follow)

Naavi

 

Posted in Cyber Law | Leave a comment