Naavi.org

Let Data Protection Law of India define the Instrument creating a Data Fiduciary

Posted on October 15, 2018 by 98410spice

The Draft of Personal Data Protection Act 2018 (PDPA 2018) which is being discussed in the Parliament has one extremely important hurdle to be crossed. The hurdle is how to establish a relationship between the Data Principal and the Data Fiduciary in such a manner that the Consent is provided “Explicitly” in certain cases incorporating the several requirements of Informational Privacy such as how the personal data may be processed by the Data Fiduciary.

The GDPR called the person whose personal data is being discussed as the “Data Subject” and the entity which determines how the data would be processed as the “Data Controller”. Though the Data Controller was to take consent from the Data subject, it is clear that it is the “Data Controller” who takes over the control over Personal data and the Data Subject lives with the hope that the Data Controller will fulfill the obligations that he has contractually agreed in the letter of consent.

Some legislations prefer to consider “Data” as a “Property” and “Personal Data” as the property who is identifiable in the set of the subject data. By considering data as “property”, the property owner’s right can be recognized as owning a property which can be sold or assigned to the Data Controller (Data Buyer?).

But the Srikrishna Panel preferred to steer clear of both the approaches namely “Data as a Right that can be transferred by a consent contract” and “Data” as “Property” . It preferred to call the Data Subject as “Data Principal” and the Data Controller as a “Data Fiduciary”. The reason that Justice Srikrishna provided for this departure was very innovative. He felt that by recognizing the role of the Data Controller as a “Data Fiduciary”, we are imputing a certain set of expectations on the Fiduciary which is beyond what can be expressed in a Consent contract. Hence, with or without a “Contractual Binding” created by a “Consent Form”, the Fiduciary is bound to protect the “Privacy Right” of the individual.

“Privacy” being a “State of Mind”, it is difficult to be defined. Protecting the Privacy Right by writing down a few lines in a Consent form would therefor not suffice. The Data undergoes a metamorphosis after it is delivered to the Fiduciary and the Consent is signed when neither the Data Subject or the Data Controller is aware what is the potential of the data as it undergoes processing.

This dynamic nature of data and possible discovery of value after the hand over of data by the data subject, makes the Consent meaning less as a contract, since at the time of signing of the Consent, there would be lack of acceptance of the “Facts” surrounding the object called “Personal Data” which is being handed over.

Hence the Consent fails the definition of “Contract” as defined in the Indian Contract Act. At the same time, the Supreme Court in its Aadhaar judgement has held that at least a private company cannot contractually obtain a consent to collect sensitive personal data using a consent contract.

Hence accepting “Consent” as a “Contract” appears untenable both under the Contract Act and because of the the Supreme Court verdict on Aadhaar.

Had PDPA 2018 adopted the GDPR definition of Data transfer from the Data Subject to the Data Controller as a contractual agreement called “Consent”, then we would have reached a legal dead end in passing the PDPA 2018.

It was a blessing in disguise that the Srikrishna Committee decided to adopt a “Fiduciary” concept for the Data Subject-Data Controller relationship.

While this has resolved the problem of “Consent Contract” being considered void, it has however created another problem.

The “Fiduciary” relationship pre-supposes the existence of a “Trustee-beneficiary Relationship” between the Data Fiduciary and the Data Principal.

If we consider that “Consent” is a written representation of what the “Fiduciary Relationship” implies, then the “Consent” has to pass the test of being a “Trust deed”.

In the electronic world, a trust deed suffers from two deficiencies namely lack of “Stamp duty payment” and lack of recognition under Information Technology Act by virtue of Section 1(4).

Thus the “Consent” in electronic writing which is what a “Privacy Policy” accepted by a “Click Wrap” contract means, is not legally acceptable under Indian law.

We therefore end up with a situation where the Consent Contract is neither recognized under the Contract Act nor the Trust Act.

Solution is to create a new Instrument

There is no need to get disheartened by the failure of the Contract Act and the trust Act to solve our problem of getting a legally recognized instrument that can validate an electronic consent. There are at least two ways by which this problem can be resolved.

First is to amend the Section 1(4) by providing an exemption for the Data Fiduciary Creation instrument under PDPA 2018 and also provide exemption for the instrument from the Stamp Duty.

Second is to define the “Data Fiduciary Creation Instrument” as a new type of electronic document that is neither a Contract under the Contract Act or a Trust deed under the Trust Act. If this definition is included in PDPA 2018, there will be no need to amend the ITA 2000 nor the Stamp Duty Act.

Consent in a Privacy context requires to be an “Informed Consent” where the data principal is informed of his rights and also the details of processing etc., as per law. But in practice, it is difficult to make the Consent really fulfill all the details that may be required under law to be included and even if included, the “Consent fatigue” will ensure that the data principal does not take the trouble of understanding the details.

Hence the “Fiduciary creation instrument” will superimposes the duties imposed by the PDPA 2018 on the data fiduciary in addition to the written provisions of the Consent.

Let’s hope that this innovative approach is taken to ensure that “Consent” in electronic form would be considered as an instrument of creation of the fiduciary relationship.

Naavi

FDPPI submits its Comments on PDPA 2018

Posted on October 11, 2018 by 98410spice

FDPPI, an organization of Data protection Professionals in India has presented its comments on the draft PDPA 2018 (Personal Data Protection Act 2018) as presented by the Ministry of Electronics Information Technology (MeitY) under the recommendation of the Justice Srikrishna Committee.

The extended last date for submission was October 10, 2018. Considering the recent Judgement of the Supreme Court, the Government is under an obligation to pass the legislation at the earliest so that a Data Protection Law will be in place in the country as envisaged by the Supreme Court.

A Copy of the recommendations submitted by FDPPI is available here

The comments/recommendations of FDPPI contain several new thoughts which have not been under discussion since the draft was available. They will be elaborated in greater detail in a series of articles here.

Naavi

Disclaimer: The views expressed here and elsewhere on this site are the personal views of Naavi and not the views of any organization or group that he may be associated with.

Posted in Cyber Law | Leave a comment

Last Day for Comments on PDPA 2018 is 10th October

Posted on October 8, 2018 by 98410spice

The draft of the Personal Data Protection Act 2018 has been submitted by the Justice Srikrishna Committee along with its report. Copies of both are available at www.pdpa2018.in.

The Government of India has requested for public comments to be submitted on the draft Bill which is in the Parliament before October 10, 2018.

The comments can be submitted at http://meity.gov.in/content/data-protection-bill-feedback

Naavi.org has discussed this subject extensively ever since the Srikrishna Committee has come into existence. Some suggestions were submitted by Naavi.org during the time the Committee held its discussions. Some were submitted after the Committee submitted its reports. After the recent Aadhaar Judgement, another list of comments on the impact of this judgement on Privacy has also been separately recorded so that there is a large number of thoughts before the public to debate about.

I wish public go through all these comments and suggestions and whether they agree or disagree, use them to stir up their own thoughts on the subject so that they can formulate their own comments and present it to the Government.

I hope that the following list of articles provide the information that one may look for as background material for forming their individual opinion.

There could be more articles if one searches through naavi.org. Using the information available here, public may send their comments.

Additionally, FDPPI (Foundation of Data Protection Professionals in India) will be collating the comments from its members and sending it to the Ministry. Those of you who want your comments to be included in the Naavi.org comments or in FDPPI comments, can send them to Naavi or to FDPPI by e-mail, by the end of today.

Naavi

Posted in Cyber Law | Leave a comment

The Cosmos Bank fraud.. Could better security at NPCI have prevented it?

Posted on October 7, 2018 by 98410spice

The recent fraud in which Rs 94 crores were siphoned off the Cosmos Bank system on August 11th and 13th through over 14800 ATM withdrawals has once again highlighted that for fraudsters it makes no difference if the money comes from a Cooperative bank or an SBI . They seek to attack the systems where the security is weak .

If a Bank like Cosmos Bank of Pune thinks it is big enough to offer cards and ATM facility to its customers and implement a CBS system over multiple branches, it must understand the risk of expanding the vulnerability of the systems and it requires adequate security measures to be in place.

A few years Bank (2013) the Bank of Muscat Fraud was carried out in which about Rs 250 crores were fraudulently drawn out from the Bank through about 40000 ATM transactions carried out in 27 different countries in two bursts each of which lasted only a few hours. The fraud was carried out by hacking into the back end systems of the card data processors in India. The second and the larger burst of this fraud occurred three months after the first indicating that the vulnerability was not recognized and corrected when the first burst of withdrawals took place.

Subsequently RBI has been warning the Banks to ensure that adequate security measures are taken by the Banks. But at the same time, RBI has been pushing co-operative Banks to the use of technology without providing them adequate support and time in terms of introducing security measures. In the meantime some of the Co-operative Banks have grown big and introduced innovative technology based services without adequately covering the risks.

The Cosmos Bank episode is indicative of this negligence as the method of withdrawal of the money by fraudsters is similar to the Bank of Muscat fraud…namely cloned cards used to withdraw money from ATMs in foreign centers. But the modus operandi appears more sophisticated.

In the Bank of Muscat incident, the systems of the card processing companies were hacked and the information of about two dozen pre paid cards were changed. In the Cosmos Bank case, it appears that the fraudsters created a proxy server to approve the ATM transactions and bypassed the real CBS system to fool the ATMs into believing that the transactions were approved by the Bank. They also cloned debit cards both VISA and Rupay cards and withdrew money in 28 different countries. One of the contributory factors was that the ATMs were using Windows XP system which some time back was also the cause of ransomware attack on some Indian Banks.

Though NPCI has indicated that there was a malware attack in the Bank that created a proxy authentication system, NPCI cannot wash its hands off because there could be several security measures which it may be able to implement at the Switch level to prevent frauds of this nature.

For example, it is not clear why the ATM switch operated by NPCI should allow any ATMs anywhere in the world to connect to it if such ATM is running on a Windows XP system. It would have been prudent that NPCI stops servicing such outdated and proven to be fraud prone systems even if such systems are from abroad.

Also a question needs to be asked, if there is an ATM withdrawal request (and thousands of them in quick succession) from a Co-operative Bank customer/s from abroad, does it not automatically indicate a “Risk” since we donot expect customers of Cooperative Banks to be globe trotting executives?

It is our view that such transactions should have been stopped and flagged at the switch itself before being transferred to the Bank’s server.

I am sure that NPCI will frown if we say that they are responsible the breach of security in Cosmos Bank but we need to ponder if they could have by upgrading their own risk identification and management measures have prevented the Cosmos Bank fraud.

But unless we accept that the ATM, the Switch and the Bank’s server all parts of an integrated financial authentication system and secure the transaction in its totality, the customers of the Banks and the owners of the Banks will be exposed to risks that will ultimately fall on individuals who trusted the system.

From the legal perspective, it is the Bank which engages the services of the Switch and the ATM to provide services to its customers and has to ensure through contractual agreements that the intermediaries provide secure service. It is a presumption that if Windows XP systems in ATMs are considered as obsolete, they should not be used by the ATM operators and the Switch should refuse services to such ATM machines.

The Switch operators cannot be dumb routers of transactions but should implement and manage their own security systems to detect suspicious transactions.

In particular, approving transactions from abroad which are outside the legal jurisdiction of India for further investigations should be subjected to a greater level of security prescriptions.

It does not matter if a stray individual is unable to draw money from an ATM while he is on a tour of Thailand or Turkey, and complains of bad service, but it is essential that in order to score a brownie point that the Bank can issue globally acceptable debit cards, the security of the Bank itself is not jeopardised.

RBI should therefore immediately instruct NPCI to impose restrictions that any ATM debit transaction request coming from outside the country is flagged as a special case and subjected to better security measures even while the Banks are also required to do so. It is however possible that it may be only at the switch that the transaction can be better identified as coming from abroad.

Additionally, the switch should maintain the digital signature of all ATMs installed in India and should be able to instantly identify whether the call is from an Indian ATM or from abroad and initiate necessary security procedures as required.

The Switch should identify any abnormal pattern of withdrawals and take immediate action to block the suspicious ATMs, or Cards to prevent continuance of the fraud over an extended time.

Probably frauds will continue to happen even in an increased security preparedness of the Switch but it would make the life of the fraudster difficult and reduce the incidence of frauds.

Look forward to comments from security specialists on the above.

Naavi

Addon:

One of the alert readers of the post has suggested some corrections to what is stated above and I am happy to add the clarifications:

Within India,
1. an ATM of a particular Bank connects to the switch operated by the respective Bank when the transaction relates to the Bank itself.
2. In respect of Inter Bank transactions, the authentication call is routed through NPCI
In the case of foreign transactions, it may be routed through the payment gateway of VISA or an agent of Rupay which could be an aquiring Bank in that country which being an interbank transaction may go through NPCI switch.
In all cases some information such as IP address, ATM ID, Aquiring Bank transaction ID etc., is collected. The OS details may not be presently collected.
NPCI Switch comes into play in InterBank requests and not in inter-bank debit card transactions.

I thank the reader for the clarifications. NPCI may try to check if it can re-define the parameters that the ATM request should contain and how it can be expanded if required so that at least transactions from abroad are filtered effectively.

Transactions in India can be tracked further since RBI insists on the CCTV in ATM and some remedy against the mules is possible.

In case of withdrawals from abroad, the hands of the law enforcement are tied. Consultants like us insist insist that they register FIRs and they are uncomfortable since it is a dead end of investigation any way.

Further Add on:

RBI has indicated that by default cards should not be payable outside India. Banks should ensure that only at the specific request of the customer card should be payable abroad. If therefore a request comes from outside India, the Switch as well as the Bank’s Server should recognize that it is an exceptional transaction and has to be subjected to some kind of secondary verification. The ATM transactions in India, The online transactions and the International transactions should be recognized as different levels of transactions and subjected to the differential levels of authentication. Responsibility for this has to be taken by all the stake holders since the objective is to make the system more secure.

Disclaimer: The views expressed here and elsewhere on this site are the personal views of Naavi and not the views of any organization or group that he may be associated with.

Posted in Cyber Law | Tagged cosmos bank, NPCI | 2 Comments

Aadhar Judgement-10: Let us debate the changes required in PDPA 2018

Posted on October 6, 2018 by 98410spice

This is in continuation of the series of articles on this topic

Over the last 9 articles on Aadhaar Judgement, I have provided some views on the interpretation of the Judgement specifically with reference to the upcoming PDPA 2018 which has been introduced in the Parliament as a bill and will be taken up for debate in the next session. The public comments for the same are open upto 10th October 2018. Since the Adhaar judgement has just now been released, it is necessary that we re-visit our views on the PDPA 2018 draft from the perspective of what the judgement implies.

The Srikrishna Committee itself made an elaborate recommendation on the amendments to the Aadhaar Act in the main report but did not make it part of the draft PDPA 2018. Now the Government apart from making whatever amendments are required to be made in PDPA 2018 may also make the recommended amendments in the Aadhaar Act taking care that they donot conradict what this Aadhaar Judgement has indicated.

I draw the attention of the readers to the Appendix to the Srikrishna Committee Report which contains a detailed list of “Suggested Amendments to the Aadhaar Act”. It is not clear if the Supreme Court while finalizing the judgment went through these suggestions which were put together under the guidance of a former Supreme Court Judge spending nearly one year on understanding the issues involved in designing a Privacy Act.

It is to be noted that the recommendation contained interesting thoughts of alternate forms in which Aadhaar can be used for authetnication (eg Offline Authentication), strengthening of the dispute resolution mechanism (Introduction of adjudication and Appeallate Tribunal), mechanism for obtaining legal sanction for future use by a law passed by the Parliament, etc.

As regards Section 57, this recommendation included “Offline Verification” as the means by which the authentication was to be made so that all the objections that the current judgement has indicated would be completely irrelevant.

We therefore suggest that the Government while passing the PDPA 2018 also pass the amendment to the Aadhaar Act where by they may replace Section 57 with a read dwon Section 57 and introducing a new Section 57A incorporating the recommendations of the Srikrishna Committee.

Srikrishna Committee rightly did not get into providing prescriptions on information security such as the data retention, meta data collection etc and stuck to the legal issues unlike the current judgement. It’s recommendations are therefore worth looking into in detail.

Probably the Government needs to create a sub committee headed by Justice Srikrishna himself to re draw the Appendix in the light of the Supreme Court judgement.

I recommend that organizations such as Foundation of Data Protection Professionals in India (FDPPI) work with premier academic institutions like NLSUI and develop a draft recommendation of refining Appendix to the Srikrishna Committee in the light of this judgement.

Naavi

Disclaimer: The views expressed here and elsewhere on this site are the personal views of Naavi and not the views of any organization or group that he may be associated with.

Posted in Cyber Law | Leave a comment

Aadhaar Judgement-9: Definition of Personal Information revised?

Posted on October 6, 2018 by 98410spice

This is in continuation of our earlier Article in this topic

The judgement of the three judges made a significant observation which may leave a significant impact on the PDPA 2018.

While answering the question “Whether the Aadhaar Act violates right to privacy and is
unconstitutional on this ground?”, the judges observed as follows:

“…it is held that all matters pertaining to an individual do not qualify as being an inherent part of right to privacy. Only those matters over which there would be a reasonable expectation of privacy are protected by Article 21”

Article 21 is the Article under which Privacy has been held as a fundamental right. When the earlier Puttaswamy judgement was pronounced there was some ambiguity about what rights are protected under “Privacy”. Though some of the judges in the bench correctly identified that Privacy is a “Mental State” and not possible to be properly defined and we can only protect “Information Privacy”, there were at least one Judge who went at a tangent to say that any thing can come under “Privacy”. ..What you eat, Where you go, etc are all part of Privacy.

The current judgement however is more sober and it recognizes that any thing and everything connected to a person cannot be considered as a matter of privacy.

In other words, when we identify what is “Personal Information” which is subject to “Privacy Protection” we need to identify ony “those matters over which there would be a reasonable expectation of privacy” as part of the personal information.

For an individual, will his father’s name be considered as private? Will his grand father’s name or mother’s name be considered as private”, Will the mobile number or e-mail address or IP address or meta data associated with a message be considered as “expected to be held private”? are issues that need to be considered.

In other words, the definition of “Personal Information” cannot be omnibus and include “any information that can directly or indirectly be used to identify a person”, which was the opinion which most carried after the GDPR and even in the draft of PDPA 2018.

Now there is a need to tone down the rhetoric of “Any information about a person” being held as “Personal Information” and check if there was a “Reasonable Expectation by the individual that the information had to be held private”.

This is a significant opinion that also has a conflict with that part of the judgement which prohibits collection of meta data such as time of location of a transaction, IP address etc. Can we say that the user of an Aadhaar authentication has a reasonable expectation that UIDAI should not know such information about the transaction? In most cases there is no such expectation.

On the contrary, the Aadhaar users would have a reasonable expectation that such records would be kept by Aadhaar and tomorrow if there is any crime or dispute, the user can call for help from Aadhaar for the information.

For example, if I make a payment of Rs 10000/- through PayTM to another person and later he disputes that he has received the payment, we expect PayTM to stand as witness and confirm that the payment was made from such and such account to such and such account at such and such time etc. Similar expectation about Aadhaar is also reasonable.

Hence the view that meta data should not be collected and if some transaction authentication data is recorded, it is to be discarded within 6 months becomes a contradiction to the view that “All matters pertaining to an individual donot qualify as being inherent part of the right to privacy”.

I welcome this clarification which can be cemented in the PDPA 2018 by the Government.

The Section 3(29) of PDPA 2018 should therefore be redefined as follows:

“3 (29) “Personal data” means data about or relating to a natural person who is directly or indirectly identifiable, having regard to any characteristic, trait, attribute or any other feature of the identity of such natural person, or any combination of such features, or any combination of such features with any other information; subject to the data principal having a reasonable expectation that such data would be protected under Article 21 of the Indian Constitution.”

Naavi

Disclaimer: The views expressed here and elsewhere on this site are the personal views of Naavi and not the views of any organization or group that he may be associated with.

Posted in Cyber Law | 2 Comments