Certificate in Personal Data Protection Act

Posted on October 19, 2018 by 98410spice

Cyber Law College, a pioneer in Cyber Law Education in  India is continuing its tradition and has launched a new Course on Personal Data Protection Act (PDPA 2018), which is the first such course in India.

In October 2000, when ITA 2000 was notified, Cyber Law College was one of the first to start an educational initiative with a Certificate Course in Cyber Laws. Subsequently, Cyber Law College has started a course on HIPAA and more recently a Course on GDPR. Presently all the above three courses are available online through www.apnacourse.com  with recorded videos from Naavi.

The PDPA 2018 is presently in the form of a Bill and has been presented in the Parliament as a recommendation from the Justice Srikrishna Committee. The Government has collected public comments on the draft Bill and is likely to proceed with the formalities in passing the Act during the winter session of the Parliament.

The Government is under an obligation to the Supreme Court to pass this Act at the earliest, though there could be some hurdles and delays in the process. Considering the pending elections to the Loksabha by  May, 2019, it is likely that the Government may push through the Act and if necessary, promulgate an ordinance. This law more or less in the current form is therefore expected to become effective shortly.

Once it becomes a law, it would be as powerful than ITA 2000/8 since the industry has a huge stake in its compliance.  All personal data user industries in India need to designate “Data Protection Officers” with relevant knowledge and skills. It will therefore open the doors for employment for Data Protection professionals who have a good knowledge of the law and an understanding of technology.

PDPA 2018 will also introduce a new set of Adjudication and Appellate Tribunal activities exclusively for contraventions of PDPA 2018. There will also be prosecutions under PDPA 2018 by the Police. Hence the knowledge of PDPA 2018 would be a key asset of any law professional.

From the Business perspective, “Persona Data” being an important ingredient of the IT industry, particularly those betting on Big Data and IoT, the incorporation of compliance of PDPA 2018 by design into the business architecture of an organization becomes a key management concern. There will be several new business opportunities that would arise out of this Act which could be harnessed by innovative entrepreneurs.

Hence from the point of view of professionals in the Technology, Law and Management, awareness of PDPA 2018 and a clarity on its provisions becomes important for professional development.

Considering the fact that Formal Academic Institutions are only now gearing up tot he teaching of ITA 2000/8 they will not be able introduce courses on PDPA 2018 for some time. Professionals therefore need to equip themselves either on their own or through courses such as what is being proposed by Cyber Law College.

PDPA 2018 is an amalgamation of some of the provisions of ITA 2000/8 and the international data protection laws such as GDPR and hence this course would provide a reasonable sensitization of the GDPR provisions also.

The course content proposed by Cyber Law College also includes another draft law called DISHA 2018 which is of interest to the Health Care industry in India and is related to HIPAA of USA. The students of this Course will therefore get sensitised to the HIPAA as well.

The Course therefore provides a good opportunity to students and professionals to understand the emerging law and be prepared when the law becomes effective and compliance becomes industry’s a concern immediately thereafter.

The enrollment for the first batch would be available for about one month and the online interactive classes would commence some time in November. (Schedule to be announced).

The Prospectus released by Cyber Law College is available here.

For more details, follow Cyber Law College

Naavi

Posted in Cyber Law | Tagged , , , | Leave a comment

Cyber Criminals disturb the Hornet’s Nest in Bengaluru by attacking the DGP

Posted on October 18, 2018 by 98410spice

In an interesting cyber crime reported from Bangaluru, the DGP and Chief of Internal Security Division, Mr Ashit Mohan Prasad, IPS, was defrauded by Cyber Criminals to the extent of Rs 2 lakhs. This was a typical fraud in which the victim had shared some of his debit card details to fraudsters over phone. A complaint has been lodged with the Cyber Crime wing on Monday (15th October 2018) and further developments are awaited.

We may recall that some time back one MP from Karnataka and another DGP had also fallen prey to such frauds.

Recently, the undersigned had come across another complaint with the Cyber Crime Cell which was registered on “Unknown Accused” and without including all the relevant sections of ITA 2000/8. Though a request has been made for correction to the FIR, no response has been received from the Police. Further we are not aware if the investigation is being carried out at all and if so whether the investigation is proceeding in the right direction. We need to wait for the charge sheet to be filed (if ever it would be filed) to find out the details of the case diary and whether an investigation was really conducted or not.

With this approach, there is no surprise that the first conviction in Bengaluru for Cyber Crimes came only last month despite the talents and facilities that are available to Bengaluru Cyber Crime police at the CID complex which are perhaps the best in India.

According to the report more than 3000 cases have been registered in the newly formed Cyber Crime PS and probably most of them are against “Unknown Persons” and only for the purpose of records.

Now that the complaint has been filed by the DGP himself, it would be interesting to know how the Cyber Crime wing will go about its investigation and how the relevant Bank will react under the Limited Liability obligation.

Let’s watch the developments and check of there is a common law for the ordinary citizens of Bengaluru and also the others.

I fully appreciate that the Cyber Crime wing is understaffed, over burdened with complaints and need to refer most of the complaints for guidance to the Cyber Crime division in CID office. But these are limitations about which the public are not concerned. It is the top brass of the police who need to resolve this issue.

Some time back, I had proposed that Police should register online complaints, authorize approved NGOs to vet the complaints and raise simple queries such as IP resolution to the ISPs etc so that the burden on the Police would come down.  Obviously, there was no response from the Police whether in Karnataka or elsewhere.

The T K Vishwanathan commitee had also suggested some changes to the CrPc to improve the Cyber Crime handling capability. The State Government could have taken the lead in making some of these recommendations effective. But they donot consider this a priority.

It would be repetitive if I point out the deficiencies in the system and let us not spend time on the past. Let us at least now look at what we can do in the future. I therefore request both the Police in Bengaluru and the Home department, with people like Pratap Reddy and Sanjay Sahay available as experts to focus on making Karnataka a safe state for Cyber transactions.

Hopefully Mr Ashit Mohan Prasad himself should opt to take the lead in driving the Cyber Crime wing to be more effective and useful. I am sure there are many others who can take care of VIP security whether during Dussera or at other times and capable officers who have an aptitude for Cyber Crime investigations need to be provided in sufficient numbers to the Cyber Crime wing in the Infantry road, to make it effective.

Hope my views would be taken as constructive criticism which it truly is.

Naavi

 

Posted in Cyber Law | Tagged , | Leave a comment

The 18 year Journey Since the Digital Society was born in India

Posted on October 17, 2018 by 98410spice

Information Technology Act 2000 (ITA 2000) was notified on 17th October 2000 and today is the 18th year after India legally recognized the Electronic Document as equivalent to Paper Document and Digital Signature as equivalent to physical signature leading to the possibility of a legally valid contracts being formed entirely with electronic documents. For all legal purpose, the Digital Society of India took formal birth on that day and therefore we have been recognizing this day therefore as the “Digital Society Day”.

Naavi has been tracing the developments in this field first through the domain name naavi.com and then through naavi.org.

The year that has gone by has been eventful with “Privacy” hogging the limelight. The year started in the background of the Privacy Judgement from Supreme Court holding “Privacy as a Fundamental Right”. The Justice Srikrishna Committee came up with its white paper, sought public comments and towards the end of the year came up with its report and the draft Personal Data Protection Act 2018. This is one of the biggest changes in the Cyber Law environment in India since ITA 2000 was born since PDPA 2018 is entirely about “Informational Privacy” and “Data Protection”.

The year 2019 promises to be a continuation of the Privacy and Data Protection issues and we will see many developments including the establishment of the Data Protection Authority of India. Section 43A of ITA 2000/8 would be deleted and PDPA 2018 would take over the concept of “Reasonable Security”.

The Cyber Crime scenario was dotted with two big Banking frauds namely the PNB fraud and the Cosmos Bank fraud which indicated how the digital banking system could be easily defrauded if Bankers donot manage security as is expected of them. Hopefully they would learn their lessons and fortify their defences.

The Supreme Court through its Aadhaar Judgement has given a small jolt to the industry and hopefully the situation would ease out with the use of Virtual ID as a means of e-KYC and e-Sign, once necessary formalities are completed.

During the year, the Government notified some agencies under Section 79A and activated the concept of the Digital Evidence Examiner.  However, a two member bench of the Supreme Court muddied the waters under Section 65B by trying to over turn an earlier 3 member bench decision in the Basheer case.

Technology continued to pose new challenges with Artificial Intelligence and Quantum Computing making further strides. This raises the concern that if the Indian Supreme Court cannot properly appreciate the Section 65 B concept of electronic evidence after 18 years, will it be able to tackle disputes such as the Uber Self driven car accident, or the activities of the humanoid robots like Sophia. The concepts of Super Positioning and Entanglement in Quantum Computing could be a real challenge for the Indian judiciary in the days to come.

On the home front, Naavi.org continued its fight against Bitcoin to an extent that it appears that the Government has reined in the growth of this black money instrument. We are awaiting a proper burial of the system in due course as the trend has reversed across the world in this regard disfavouring the Bitcoin recognition as an proxy for currency.

Additionally Cyber Law College conducted two offline Cyber Law Courses in Bengaluru, first in BMS Law College and then in St Joseph Law College (presently in progress). Naavi also continues to engage himself with NLSUI and NALSAR in the Cyber Law courses conducted under their banner as guest faculty.  Cyber Law College has also extended its use of the Apnacourse online platform with the introduction of a course on GDPR.

Now the biggest step of the year taken by Cyber Law College is the launch of a course on Personal Data Protection Act 2018 (PDPA 2018) to support the movement of PDPA 2018 awareness in India. The launch has just now been announced and hopefully, some professionals and students would take advantage of the opportunity to be the early learners of the emerging Privacy law in India. This course not only covers PDPA 2018 but also another emerging law called DISHA 2018 (proposed) besides discussing the impact of GDPR on Indian companies. These courses are intended to develop a truly knowledgeable Privacy professional in India who is equipped with the knowledge of laws as applicable in India.

Yet another step which is significant for Naavi personally is the promotion of a Section 8 Company namely the “Foundation of Data Protection Professionals in India” to bring together a larger section of stake holders in ensuring that Data Protection Industry in India would be represented by and managed with an Indian perspective rather than importing the perspective from the foreign markets.

The current activities of Naavi and Cyber Law College are much relevant for an organization like FDPPI and could also help  FDPPI to blossom faster than it otherwise would.  Some of the current activities of Cyber Law College could therefore be pledged and used for the benefit of  FDPPI in the coming days.

Naavi

 

Posted in Cyber Law | 1 Comment

Online Course on Personal Data Protection Act 2018

Posted on October 16, 2018 by 98410spice

Cyber Law College, which is a pioneering institution in India dedicated to Cyber Law Education is starting an online course on Personal Data Protection Act 2018.

The Course will cover the draft Act as is being discussed in the Parliament and will include the accompanying draft proposed law for Health care namely the DISHA 2018.

Details are available at Cyber Law College website.

The Course fee would be Rs 6000/- and registration would commence from 19th October 2018.

Classes would be conducted by Naavi online as per schedule to be fixed.

I look forward to the support of the community in this regard.

Naavi

Posted in Cyber Law | Leave a comment

Bengaluru as the Data Protection Capital of India

Posted on October 16, 2018 by 98410spice

Naavi has been in the forefront of creating awareness of Cyber Laws in India. In 2005, Naavi had taken up a program called “Karnataka Cyber Laws Awareness Movement” under which several programs were undertaken in Karnataka.

Now time has come to start a similar activity for the Personal Data Protection Act 2018 which is presently in draft stage but is likely to become an important legislation in India.

While Cyber Law College will be focussing on some structured courses in this regard, we are glad to note that the Foundation of Data Protection Professionals in India (FDPPI) would be undertaking a “PDPA Awareness Movement” by conducting Awareness lectures in Bengaluru to begin with, in different organizations on the basis of invitations.

The program is being conducted by a team of professional members of FDPPI.

It is expected that the program would spread to other parts of India also in due course.

Naavi

Posted in Cyber Law | Leave a comment

Let Data Protection Law of India define the Instrument creating a Data Fiduciary

Posted on October 15, 2018 by 98410spice

The Draft of Personal Data Protection Act 2018 (PDPA 2018) which is being discussed in the Parliament has one extremely important hurdle to be crossed. The hurdle is how to establish a relationship between the Data Principal and the Data Fiduciary in such a manner that the Consent is provided “Explicitly” in certain cases incorporating the several requirements of Informational Privacy  such as how the personal data may be processed by the Data Fiduciary.

The GDPR called the person whose personal data is being discussed as the “Data Subject” and the entity which determines how the data would be processed as the “Data Controller”. Though the Data Controller was to take consent from the Data subject, it is clear that it is the “Data Controller” who takes over the control over Personal data and the Data Subject lives with the hope that the Data Controller will fulfill the obligations that he has contractually agreed in the letter of consent.

Some legislations prefer to consider “Data” as a “Property” and “Personal Data” as the property who is identifiable in the set of the subject data. By considering data as “property”, the property owner’s right can be recognized as owning a property which can be sold or assigned to the Data Controller (Data Buyer?).

But the Srikrishna Panel preferred to steer clear of both the approaches namely  “Data as a Right that can be transferred by a consent contract” and “Data” as “Property” . It preferred to call the Data Subject as “Data Principal” and the Data Controller as a “Data Fiduciary”. The reason that Justice Srikrishna provided for this departure was very innovative. He felt that by recognizing the role of the Data Controller as a “Data Fiduciary”, we are imputing a certain set of expectations on the Fiduciary which is beyond what can be expressed in a Consent contract. Hence, with or without  a “Contractual Binding” created by a “Consent Form”, the Fiduciary is bound to protect the “Privacy Right” of the individual.

“Privacy” being a “State of Mind”, it is difficult to be defined. Protecting the Privacy Right by writing down a few lines in a Consent form would therefor not suffice. The Data undergoes a metamorphosis after it is delivered to the Fiduciary and the Consent is signed when neither the Data Subject or the Data Controller is aware what is the potential of the data as it undergoes processing.

This dynamic nature of data and possible discovery of value after the hand over of data by the data subject, makes the Consent meaning less as a contract, since at the time of signing of the Consent, there would be  lack of acceptance of the “Facts” surrounding the object called “Personal Data” which is being handed over.

Hence the Consent fails the definition of “Contract” as defined in the Indian Contract Act. At the same time, the Supreme Court in its Aadhaar judgement has held that at least a private company cannot contractually obtain a consent to collect sensitive personal data using a consent contract.

Hence accepting  “Consent” as a “Contract”  appears untenable both under the Contract Act and because of the the Supreme Court verdict on Aadhaar.

Had PDPA 2018 adopted the GDPR definition of Data transfer from the Data Subject to the Data Controller as a contractual agreement called “Consent”, then we would have  reached a legal dead end in passing the PDPA 2018.

It was a blessing in disguise that the Srikrishna Committee decided to adopt a “Fiduciary” concept for the Data Subject-Data Controller relationship.

While this has resolved the problem of “Consent Contract” being considered void, it has however created another problem.

The “Fiduciary” relationship pre-supposes the existence of a “Trustee-beneficiary Relationship” between the Data Fiduciary and the Data Principal.

If we consider that “Consent” is a written representation of what the “Fiduciary Relationship” implies, then the “Consent” has to pass the test of being a “Trust deed”.

In the electronic world, a trust deed suffers from two deficiencies namely lack of “Stamp duty payment” and lack of recognition under Information Technology Act by virtue of Section 1(4).

Thus the “Consent” in electronic writing which is what a “Privacy Policy” accepted by a “Click Wrap” contract means, is not legally acceptable under Indian law.

We therefore end up with a situation where the Consent Contract is neither recognized under the Contract Act nor the Trust Act.

Solution is to create a new Instrument

There is no need to get disheartened by the failure of the Contract Act and the trust Act to solve our problem of getting a legally recognized instrument that can validate an electronic consent. There are at least two ways by which this problem can be resolved.

First is to amend the Section 1(4) by providing an exemption for the Data Fiduciary Creation instrument under PDPA 2018 and also provide exemption for the instrument from the Stamp Duty.

Second is to define the “Data Fiduciary Creation Instrument” as a new type of electronic document that is neither a Contract under the Contract Act or a Trust deed under the Trust Act. If this definition is included in PDPA 2018, there will be no need to amend the ITA 2000 nor the Stamp Duty Act.

Consent in a Privacy context requires to be an “Informed Consent” where the data principal is informed of his rights and also the details of processing etc., as per law. But in practice, it is difficult to make the Consent really fulfill all the details that may be required under law to be included and even if included, the “Consent fatigue” will ensure that the data principal does not take the trouble of understanding the details.

Hence the “Fiduciary creation instrument” will  superimposes the duties imposed by the PDPA 2018 on the data fiduciary in addition to the written provisions of the Consent.

Let’s hope that this innovative approach is taken to ensure that “Consent” in electronic form would be considered as an instrument of creation of the fiduciary relationship.

Naavi

Posted in Cyber Law | Tagged , , | 1 Comment