Naavi.org

Preliminary reports suggest that the Government is releasing the report submitted by Kris Gopalakrishna Committee on Data Governance for public comments.

 The committee was formed  for the purpose of recommending the regulation on Non Personal Data which is of relevance to Big Data Companies.

The copy of the report is not yet available in public domain but some details are available through this article in Economic Times

The detailed report is available here.

Public comments can be made upto August 13 here.

Some of the recommendations that the committee could have made are

1. Appointment of a regulator for regulating non personal data
2. Payment for processed non personal data by the industry to the Government

The panel  is reported to have suggested that

-data can be requested from businesses and government by various stakeholders — the government, citizens, startups, private organizations, and non-profit organizations — for social welfare, regulatory, sovereign, and economic purposes.

-Data for sovereign purposes may be requested for national security, legal purpose, or meeting a sectoral regulation requirement.

We may await for more information.

Copy of the Report

Naavi

P.S: Log in here for submission of comments

On July 31, 2017, I had written an article “Is Net4India closing down its operations?”

At that time I had some problems and subsequently my issues were to some extent resolved. However, in recent days, I am receiving many complaints from other persons affected by similar problems.

I had recently drawn the attention of Mr Samiran Gupta through another article “Name and Shame Rogue Domain Name Registrars” in the context of preventing Phishing frauds. But I did not get any response from him.

I have now taken up the issue of Net4India again with Mr Samiran Gupta and sent him the following e-mail.

Dear Mr Samiran

Naavi.org has believed on knowledge dissemination and through out the 20 years of existence tried to spread knowledge freely. In the process, when some body wants to publish any article of their own on Naavi.org, I have obliged if the content is of relevance to the audience who frequent Naavi.org. When such content is published, Naavi.org would be an “Intermediary” and would be liable as per the provisions of ITA 2000/8 and also be able to claim the benefits of exemption from liability under Section 79 of ITA 2000/8.

But some times, people may misuse the facility of allowing guest posts.

One such occasion arose recently, when I received a request from a person named Badal Patel from myadvo.in. The article was titled “GDPR Compliance Checklist for Indian Companies”.

On February 29, 2020, I received an email as follows:

Hi,

I would love to provide a guest contribution to your blog. I’m also open to any of your ideas as well.

Anytime I guest post on a prominent blog like yours I always make sure to do 1200+ words, with images and data to back up any points I make.

I promise there will be no fluff, just actionable advice.

Let me know what you think. I’m excited to hear back from you.

Keep Up The Good Work.

Best Regards
Badal      

The sender was identified as

The much awaited Module G program of the Foundation of Data Protection Professionals in India or FDPPI (www.fdppi.in) which will provide training on  many relevant Data Protection Laws of the world including GDPR, CCPA, Singapore PDPA, DIFC Data Protection law and HIPAA will commence today (11th July 2020)at 4.00 pm IST.

The sessions will be online for 90 minutes each on Saturdays and Sundays starting from today upto August 23.

This is a significant step FDPPI has taken in preparing the Indian Data Protection Community to be aware of the multiple Data Protection laws to which the organisations in India are exposed to.

So far, Indian professionals had to opt for expensive global certification programs ane even in such programs the learnings were  often limited to one specific law such as GDPR. FDPPI recognizes that the life of a DPO in an Indian company is different from that of the DPOs in other countries. Most Indian companies handle personal data of different companies and it would be inappropriate if they apply “GDPR knowledge” alone as if every other law is covered by GDPR compliance.

FDPPI’s course is therefore structured to provide a reasonable overview of multiple data protection laws and given an opportunity for the student to develop a discerning view on these different laws.

FDPPI has already covered the Indian law separately in one full module over 14- hours of online training leading to certification of Module-I. Now this module called Module G will cover over 18 hours of online training and cover GDPR in fair detail and then the other laws to the extent feasible.

These certifications are two modules of the “Certified Expert Data Protection Professional” program developed by FDPPI. This Certification is still available for interested persons under the E Education initiative of Naavi/Cyber Law College.

While individual certificates such as “Certified Data Protection Professional (Module-G)”  will be issued to those participants who register for the Course along with Certification exam from FDPPI (Total Cost rs 18000), those who have opted only for the training and not for taking the certification exam (Total Cost Rs 6000/-) will receive participation certificate from the training partner, Cyber Law College.

This Certification program as well as the PDPSI framework of implementation of data protection regulation are two significant “Atma Nirbhar Bharat” initiatives taken by FDPPI in the field of Data Protection.

The objective of these programs is to establish “National Self Reliance in Data Protection Certifications, Implementation and Audits”

Those who have missed the registration and want to catch up before today afternoon when the program starts, may peruse the Prospectus and make payment through the following link to join the program.

REGISTRATION CLOSED

Naavi

According to a report in Business Standard  the Kris Goplakrishna Committee has submitted its report on “Data Governance” to the Government. One of the recommended regulations that has been leaked appears to be for setting up of a new regulator which perhaps may be called the Data Governance Authority. (DGA)

It would be interesting how the functions of the DGA would be defined in a manner that it does not interfere with the DPA. The critical aspect of this seggregation of roles between DPA and DGA is the classification of data as “Personal Data” and “Non Personal Data”. The issues of “Data Identifiers”, the “De-identification/Pseudonymization” or “Anonyization” will need to be clarified so that the industry is clear on what is regulated by DPA and what is regulated by DGA.

The concept of “Differential Privacy” which we discussed yesterday will be extremely relevant since the proponents of “Differential Privacy” claim that it could be an alternate to “Anonymization Before Big data analysis”.

The DPA as it stands today would like the personal data be anonymized before the Big Data industry takes it up for aggregation and generation of community related inferences. The “Differential Privacy” advocates however claim that they can process identifiable personal data and ensure that disclosures remain e “Anonymous”.

Similarly, there is a need to debate on a definition of “Shared Personal Data” and “Community  Personal Data” which can be clarified when the new Data Governance law is drafted.

Naavi

It appears that the Personal Data Protection Bill 2019 is stuck with the Covid lock down of the Parliamentary activities. According to a report from Media Nama sources , there is a technical objection to use of “Virtual meetings of the Parliamentary committee”. This is touted as violation of the “Parliamentary Privileges”.

While this argument may suit all those who want the Government to remain dysfunctional, it is time to question this concept. Medianama quotes its “Anonymous Sources” (which itself is a breach of parliamentary privilege) that virtual meetings cannot take place because it will introduce a third party into the activity which is the video conferencing platform.

It is a ridiculous argument when the Supreme Court itself has adopted “Virtual hearings” as part of its activities and Parliamentary proceedings are broad cast live across the globe.

The argument is suggesting a surrender of democracy to Covid and has to be defeated.

I hope that the JPC will not allow this argument to prevail and adopt Virtual meetings as part of its procedure. The video platform can be managed by NIC and a separate server within the Parliamentary building can be set up for the purpose. The connections can be on a VPN so that it is encrypted from the user’s end to the server. The depositions can be conducted in such a manner that streaming video is pushed from the user’s application to the server and the session of a deponent is closed after his deposition is over. A secure app based browser can be used to retain confidentiality and authenticity.

It is time the MeitY should provide the confidence to the Parliamentary members and the Speaker that we have the technology to create a secure virtual arrangement and conduct the proceedings.

Naavi