Understanding the GDPR: General Data Protection Regulation

Posted on July 21, 2018 by Vijayashankar Na

{This is a guest post from Dan Sincavage, Co-Founder, www.tenfold.com }

The GDPR–or General Data Protection Regulation–is a regulation passed by the European Union on April 27, 2016, with an effective start date of May 25, 2018. Officially classified as regulation 2016/679, the GDPR expands upon and replaces the Data Protection Directive 95/46/EC of 1995. It serves as the EU’s effort to synchronize and harmonize laws on citizen and resident data privacy throughout its member states.

GDPR is based on Privacy by Design/Default, a set of user-centric principles that bequeath a sacred status to user privacy from the get-go rather than as an afterthought. Piggybacking on that is ability of users to sue organizations under the GDPR who might mishandle personal data. To accomplish this, the GDPR mandates new user-oriented information-handling processes to which EU companies will soon find themselves beholden, not to mention subject to significant penalties in the event of a violation.

The complete text of the GDPR legislation clocks in at 88 pages. There exist within it 173 recitals and 99 articles, each one applying universally to all EU member states. The key provisions of this sweeping legislation are provided below, and constitute the essence of what the law entails and how it affects data storage and retrieval for all related EU entities.

Who the Law Protects

There is a slight bit of confusion when it comes to just who falls under the protective auspices of the GDPR measure. The term “natural person” appears frequently throughout the text, and while this indeed refers to EU citizens, it actually extends further to those merely residing in the EU.

To wit, a natural person in EU nomenclature is any human possessing “legal personality”. That’s a very law-like definition that essentially boils down to a person who acts on their own behalf rather than in the interests of a business entity (sometimes known as a “legal entity”) or a government entity (or “public entity”).

To simplify matters, all humans native to or residing inside the EU with data to protect are blanketed under the term “data subject”. The rights of these data subjects to control and even extensively delete their private data is at the heart of the GDPR.

How GDPR Defines Personal Data

The GDPR defines personal data quite simply: Information (“data”) that can be used to identify a natural person (“data subject”). This seems self-evident on its surface, and indeed, certain identity-related elements fall naturally within this definition, such as name, ID number, home address, and more. But in the current era of sophisticated online data tracking technology, the amount of transmittable, personally identifiable data has ballooned (at least in the EU’s opinion), and with it, the number of privacy touch points potentially available to corporate and government bodies.

This massive list includes, but is not limited to, online identifiers such as IP addresses, social media accounts, email addresses, accounts numbers, browser cookies, and more. Constituent to this are direct identifiers and indirect identifiers, both of which establish the data subject’s identity by degrees. For instance, a direct identifier is a name, ID number, home address, and so on. Indirect identifiers include date of birth, location, or even title, and while they don’t pinpoint data subjects directly, they can nevertheless unmask a person’s identity when used in concert.

Personal Data vs Sensitive Personal Data: What’s the Difference?

In short, sensitive personal data is more or less a subset of personal data. However, as the name implies, sensitive personal data is information that is not as objectively verified as standard personal data. For instance, a data subject’s home address or date of birth can be independently and objectively verified. Under the GDPR, this is personal data, but it’s not “sensitive”. Another way to think of sensitive data is as “privileged” information, i.e. data that must be communicated by the subject themselves.

Some examples of sensitive personal data include:

  • Racial or ethnic origin
  • Religious beliefs
  • Genetic data
  • Trade union membership
  • Biometric data
  • Health data
  • Sexual orientation
  • Data pertaining to the subject’s sex life

The GDPR’s aim is not to restrict the processing of personal data altogether, only to eliminate those instances where data might be processed without the full and clear consent of the data subject. In any respect, the GDPR dictates that data must be processed transparently and equitably at all times. This sounds simples on the surface, but unfortunately for the controllers handling personal data, there are a number of requisites in the GDPR that reveal the attendant difficulty involved.

At least one of the following requisites must be met for lawfully processing personal data:

  • Direct consent from the data subject
  • Execution of an agreed-upon contract or as a preliminary step thereof
  • Legal compliance on the controller’s behalf
  • Protection of the subject’s vital interests or those of another person
  • Tasks performed in the public interest or as an extension of the controller’s official authority
  • Tasks performed in the controller’s legitimate interests or that of a third party unless superseded by the rights and natural protections of the subject, especially children

While not exceedingly divergent from the above, the standards for lawfully processing sensitive personal data are nonetheless more tightly confined to at least one of the following (some of which are duplicated from personal data):

  • Explicit consent of the subject
  • Necessary for obligations to employment, social protection and social security laws, and collective agreements
  • Protection of subject’s interests when subject is incapable of consent, whether physically or legally
  • Processing of data belonging to members or former members of and by a not-for-profit entity with a political, philosophical, religious, or trade union affiliation; strictly prohibited from divulging said data to third parties
  • Data made public by subject
  • Necessary for legal claims
  • Tasks performed in the public interest
  • Administering preventative or occupational medicine, assessing subject’s working capacity, medical diagnosis, health or social care
  • Public health as a public interest, including protection against cross-border health threats or to guarantee quality healthcare, medicine, or medical devices
  • For purposes of data storage, inquiry, and statistics

What Is a Controller?

According to GDPR lingo, a controller is the entity–natural person, legal entity, public agency, authority, or similar–that makes the decision on why personal data is being processed. They specify whose data will be collected, which categories of data to include, the length of time needed to store the data, and more. Not only that, but a controller determines if the data subject needs to be alerted that their personal data is about to be processed or if the subject’s consent is needed prior.

In that same vein, controllers are most often with whom data subjects will directly come in contact. As the public “face” of the data processing endeavor, controllers are the ones responsible for ensuring tight controls on how the subject’s information is managed. Aside from protecting the trust and privacy of the subject, the controller must ensure compliance with the GDPR at every turn.

But just as the data subject need not be an EU citizen, neither must the controller be based in the EU. Controllers can originate anywhere across the globe; so long as they engage in the processing of data for natural persons currently in the EU, they are bound by GDPR guidelines. The best examples of this come by way of social media giants such as Facebook and Twitter; search engines like Yahoo!, Bing, and Google; or retail outlets like Amazon, eBay, and more. Despite being headquartered within the US, these companies must regardless fulfill the requirements of the GDPR or risk non-compliance.

To make matters slightly more complicated, controllers not originating within the EU must designate a representative from inside the EU to help process data in a way that satisfies the GDPR. The representative accomplishes this by coordinating with that nation’s governmental body in charge of overseeing GDPR compliance, also known as the supervisory authority. It’s more or less a checks and balance system to prevent non-EU nations from roguish data processing.

What Is a Processor?

While controllers oversee the whys and whats of personal data processing, processors are the entities designated by the controller to perform the processing itself. The processor may be a natural person, a legal entity, public agency, authority, or similar, and as with controllers, they may also originate outside the EU. No matter the location or the type of entity, the bottom line remains the same: as long as the processor is managing personal data belonging to a natural person within an EU member state, GDPR still applies.

Rather than micromanaging every processing-related task, controllers may choose to rely on the processor’s systems and data security. However, controllers are the ones ultimately responsible for making sure this happens.

What is a Supervisory Authority?

Each member of the EU is required by GDPR to arrange a supervisory authority whose chief duty involves monitoring whether the regulation is being faithfully applied. The GDPR states in no uncertain terms that the regulation must be enforced consistently within every EU member state. To make this a reality, supervisory authorities are mandated to cooperate with one another when it comes to the free flow of data. Member nations are allowed to arrange for multiple supervisory authorities, but one must be chosen as a representative before the European Data Protection Board (EDPB). The same supervisory authority is also required to guarantee that the other supervisory authorities are following GDPR.

What is a Data Protection Officer?

A Data Protection Officer (DPO) is required under GDPR rules to manage and implement an organization’s data protection policies. This applies to any entity that archives extreme levels of personal data. And it doesn’t necessarily apply only to customers or users; any organization with a significant data burden even for its own employees is obligated to elect a DPO. The definition of who constitutes a data subject are far-reaching in the GDPR.

Each DPO will be in charge of educating its parent entity from top to bottom in the requirements for satisfying the regulation. He or she also conducts training for staff members who are directly involved in processing personal data, routinely audit the organization’s data security, and recommend fixes accordingly. In addition, DPOs also liaison with supervisory authorities and enforce the entity’s compliance not only with the GDPR, but with member state laws as well.

Data subjects may interact with DPOs as their main point of contact, too. As the public “face” of the data processing operation, DPOs carry a host of responsibilities, all with the goal of remaining as open, transparent, and subject-focused as possible. These include:

  • Inform subjects for which purposes their data is being processed
  • Provide access to their data
  • Explain the safeguards enacted by the company to secure their data
  • Disclose the involvement of third parties
  • Disclose the duration that their data will be archived
  • Respect the subject’s right to have their data deleted
  • Fulfill all data requests from subjects with timeliness and/or inside of one month from receiving the request

Take, for instance, a security firm that utilizes closed-circuit TV to surveil and monitor either communal areas or private businesses. Because their core activities constitute a public task, this firm would need to elect a DPO. The same is true for any processor that engages in minimal data retrieval or processing such as call centers. By contrast, entities that provide ancillary support, including payroll and IT support, need not install a DPO.

Exactly who can serve as DPO is left largely to the entity’s discretion. The DPO may be “in-house” or external, and they may perform other tasks for the company as well. However, they may do so with the proviso that their work for the company and their work as DPO does not create a conflict of interest.

While the role of DPO will look different from company to company, there are a few qualifications that the DPO must meet as outlined in the GDPR. These include:

  • Expertise in data protection law, both national and European
  • In-depth knowledge of the GDPR
  • Comprehensive understanding of the organization’s data processing structure
  • Ethics and integrity
  • Free to carry out their tasks independently

Data Breaches

We tend to think of “data breach” in rigid terms connoting the theft of confidential information from within the confines of an otherwise guarded data security system. With the GDPR, however, a data breach does not begin or end at theft but instead is defined much more broadly. It can include accidental or illegal destruction, loss, change, unauthorized access to or disclosure of personal data whether processed or archived. Once a breach occurs, controllers must notify the supervisory authority without “undue delay” or inside of 72 hours. This deadline holds true whether the breach was discovered by the processor or by the controller, although it is the controller’s responsibility, not the processor’s, for notifying the supervisory authority.

Controllers must then notify the data subject that their data has been compromised, otherwise known as an individual notification. Despite the thoroughness of the GDPR’s overall coda, it does not mandate individual notifications if certain conditions have been met. These include:

Regarding that last condition, the entity or controller is still required to alert data subjects through public means.

The Right to Erasure

The right to erasure is EU parlance for the right to be forgotten, or the right for a data subject to have their personal data comprehensively deleted. A data subject may invoke their right to erasure under four primary scenarios:

  • The initial purpose for archiving the personal data no longer applies
  • The subject removes their consent
  • The subject requests erasure in the event of non-compliance with GDPR guidelines or breach of data security
  • Legal reasons

Data Minimization

Data minimization is one of the more important Privacy by Design/Default principles mandated by the GDPR, and as the name suggests, it’s all about minimizing the amount of data that is collected, processed, and archived. Controllers are duty-bound to gather only as much personal data as is needed to perform the required task and reserve said data exclusively for the task in question, i.e. no migrating personal data from Task A over to Task B unless the data subject has consented.

Keeping with similar principles laid out elsewhere in the GDPR, data minimization requires controllers to limit the processing of a subject’s personal data according to certain stipulations. More specifically, this means only data that is relevant, adequate, and necessary to the purpose for which it was originally collected. Anything beyond this violates the GDPR and opens the entity to fines.

Right to Rectification

Privacy by design/default may be at the heart of the GDPR as a whole, but part-and-parcel therein is the right of data subjects to contest the processing of inaccurate or incomplete data. They may do so by requesting that the controller in question rectify their associated data, whether correcting false information, filling in missing data, or amending data with a clarifying statement. Controllers must respond to such requests in a timely manner or no later than one month from receipt. 

Consequences for Failure To Comply

The consequences for failing to comply with the GDPR vary depending upon the transgression and can be divided between administrative fines and fines for breaches, whether a data breach or breach of consent, privacy, and the like. For failure to comply with administrative or preparedness standards, entities may be fined the greater of 2% annual global turnover or 10 million euros. Fines for breaches are double at 4% of annual turnover and 20 million euros, whichever is greater.

Conclusion

Without a doubt, the GDPR poses many new risks and challenges for data processing entities across the world who traffic in the personal data of EU residents. Perhaps even scarier is that the stress on collection, processing, and record keeping systems won’t be entirely calculable until after the regulation has actually gone into effect, leaving controllers and processors doing their best to tread water, so to speak, and avoid fines for non-compliance. The trade-off for successfully implementing the regulation, however, is worth it. Users’ personal data will be much less prone to abuse, translating to renewed confidence and trust on the part of data subjects, and greater engagement between all parties involved.

{This is a guest post from Dan Sincavage, Co-Founder, www.tenfold.com }

Posted in Cyber Law | Leave a comment

National Health Stack Plan… This is the Digital Health Aadhaar Scheme…Available for Public Comment

Posted on July 19, 2018 by Vijayashankar Na

The Press Release from  PIB has called for public comments on the proposed National Heath Stack. (NHS)

NHS is the proposed scheme by NITI Aayog that envisages maintenance of a centralized health record for all citizens of the country to facilitate better management of the health care. This would be assisting in the implementation of the ambitious “Modi Care” or “Ayushman Bharath” scheme which is planning to cover 5 lakh to 10 crore poor families under a health insurance program.

Obviously there will be privacy issues, data protection issues and Fraud management issues inherent in such a program and its implementation would be watched keenly by the community of experts.

The Consultation document is available here

The scheme envisages besides creating a master registry of health data of citizens, a federated personal health records (PHR) framework, a National Health Analytics Platform and other components such as Digital Health IDs, Health Data Dictionaries and Supply Chain Management for Drugs, Payment Gateways etc.

Along with DISHA2018, this document will bring revolutionary changes in the way Health Care and Health Care Insurance is likely to be handled in the coming days.

What would be interesting for Data Protection professionals would be to study the proposed “Data Empowerment and Protection Architecture (DEPA) which would interact with the ID systems like Aadhaar etc.

Apart from the Privacy Considerations, Data Protection Requirements, the possibility of “Frauds” has also been envisioned and some thoughts have been given in this direction.

We have the experience of HIPAA and Obama Care in US and hopefully the lessons learnt by the US authorities in administering those programs would come in handy in India when Modi Care is being planned and implemented.

The Political opponents and the supporting sections of the society will raise many questions and perhaps try to ensure the defeat of the program. But people who are interested in national welfare should welcome this massive project and provide assistance to the Government in implementing it successfully.

If we look at the Aadhaar scenario, there has been a competitive criticism by the professionals in the Privacy and Data Protection industry basically led by the political considerations.

Now NHS scheme could be a “Digital Health Aadhaar” scheme having wide ramifications.

I hope that the opposition that surfaced for Aadhaar does not resurface in respect of the NHS and Modi Care program.

I therefore urge all the Data Protection Professionals who were in the forefront of criticising the Aadhaar and even went to the extent of submitting their own objections to the Supreme Court, collaborated with foreign agencies to find loopholes in the Aadhaar system, to take a deep look at the proposed consultation paper and record their views today instead of coming up with their objections later.

Send your comments if any by 1st August 2018 to healthstackniti@gmail.com

[Also refer to www.disha2018.in for information on the proposed Digital Information Security for Health Care Act and the EHR guidelines.]

Naavi

Posted in Cyber Law | Tagged , | 3 Comments

Data Processors may be able to create a Diamond out of Charcoal..if Indian Data Protection Act is innovatively drafted

Posted on July 17, 2018 by Vijayashankar Na

In the Privacy and Data protection circles, a debate is going on for some time in India. Naavi.org had also suggested this to the Srikrishna Committee during the public consultations. (Refer: “Personal Data Should be Considered as Personal Property”). Subsequently, DISHA 2018 in its draft form has endorsed this view.

Now the TRAI Chairman also seems to have suggested “Ownership of telecom data must rest with users: Trai“. Detailed copy of the recommendations is available here.

Though GDPR does not speak the language of ownership, and stops at “Data Subject’s Rights”, the California Privacy Protection Act recognizes the Data Subject’s right to “opt-in” to a selling of personal data and also provides that

” A business may offer financial incentives, including payments to consumers as compensation, for the collection of personal information, the sale of personal information, or the deletion of personal information. A business may also offer a different price, rate, level, or quality of goods or services to the consumer if that price or difference is directly related to the value provided to the consumer by the consumer’s data.”

This provision also indicates that the personal data is considered a possession of value for the data subject which can be exchanged for financial benefits. This is essentially a character of “Property”.

The world therefore seems to be veering down to the view that personal data is the property of a data subject and when he gives a consent for collection, he is actually alienating his property to the Data Collector and providing permission for specific use of the property for which he has a right to charge a price.

This is precisely the nature of “Intellectual Property” when the right is “Licensed” to another person for a price and can be sub licensed with a royalty flowing into the original intellectual property owner as the value keeps building up with the super structures built over the original property.

A similar benefit can be assigned to the Personal Data if it is accepted as a “Property” an “Intangible, Virtual property” recognized as a class of property on its own.

I hope that the Indian Data Protection Act which is under the final drafting stage will recognize this view and ensure that a proper system is introduced to enable data subjects to value their personal data and negotiate with data collectors to get a good price.

The undersigned suggested that there is a need to recognize the role of a “Data Trust” (Refer: “Look beyond GDPR and Create Personal Data Trusts to manage Privacy of data subjects“) with whom the data subject can park their personal data and let them manage it so that the data subject gets a maximum value for his personal data.

Such Data trusts can anonymize, pseudonymize or otherwise re-package the data and create marketable packages and license it under different terms to interested data controllers and data processors. The Data controllers and Data processors can then innovatively aggregate the personal data and create value out of the raw data. 

The need for such a thought has also been explained in detail in the concept of “Theory of Dynamic Data” where the power of an innovative data processor to convert raw data which is worthless in the hands of the individual can be made into a valuable data and part of the value can be shared with the data subject has been outlined. 

“Data Processors may be able to create a Diamond out of Charcoal” is the idea discussed in the above theory which requires the recognition that Data is a property of the data subject and he should have the right to sell it or license it for a consideration and the data processing businessmen can compete fairly with each other in giving the maximum value of the data for the data subject.

If the Government of India recognizes the potential of “Personal Data as a Valuable Personal Property”, billions of Indians can pool together their inherent data asset that is born with them and perhaps create a small fortune for themselves.

Will the authors who draft the Indian Data Protection laws be innovative enough to incorporate the “Theory of Dynamic Data”,  “Licensing of Personal Data” and role of “Data Trusts” in the eco-system, is the moot question. Let’s us wait and see how things shape up.

Naavi

Posted in Cyber Law | Leave a comment

How To Respond to Rogue elements on the Social Media?

Posted on July 13, 2018 by Vijayashankar Na

Internet was a great invention. Social media running on the Internet was a great utilization of technology which gave the ordinary internet user, the power of being a journalist.

Unfortunately, the greed of mankind has taken over both the Internet and the Social Media today. Internet has become the hunting ground of Cyber Criminals which has made “Cyber Security” a critical requirement for any Internet user. Fortunately, the operating system Windows itself providing an in built anti malware protection has made things much better for internet users though criminals still work around it as well as other malware fighting software. This is not the subject of our discussion today.

The other menace that we need to discuss today is that of the misuse of the Social Medial both by criminals for phishing type of activities and also by politically motivated persons to gain political milege like in the traditional media. Over and above these two, we are today finding Cyber terrorists using Social media to spread their sinister messages with “Fake News”.

There is a case for “Real News” however bad it is to be made known to the society though it should be done with some responsibility. Some time even real news released at a wrong time creates more problems than it will solve. Journalists should therefore be responsible and filter the content to some extent and delay its release in some instances in order to see that the “Freedom of Expression” does not create an unintended backlash.

Unfortunately, the traditional media has today become aligned with different political forces to such an extent that no news can be believed implicitly. This applies to the so called “Respectable” news papers and TV channels. The debates and news that are run everyday in the media which includes once respected BBC are all motivated expressions of different sections of people who have some axe to grind. It is very difficult to find unbiased content expressed in a manner in which it can be digested as knowledge by the public.

The problem of “Fake News” on Social media such as WhatsApp has introduced a new dimension since the media is inherently meant to be for consumption amongst known people and is meant to be an instant distributor of views and news. It is self regulated and cannot be filtered without changing the nature of the expression itself.

This has given rise for demand of some bizarre adhoc regulations such as “Registering a WhatsApp Group” etc. WhatsApp itself is toying with the idea of tagging “Forwards” so that the recipient knows that the the forwarded message is not the message which the sender has verified.

Recently the mistake committed by a Court in Tamil Nadu in the S.V.Shekar case  gave a wrong impression to the community that “Forwarding of a message is endorsing”. This is the same argument under which the Palghar girl was charged for “Liking” a face book post against Bal Thackeray. Though this was not a judgement itself, the impression seems to have stuck.

In this context, I would like to recall that way back on December 8, 2000, I had written the following in my blog in response to the presence of a “Rogue Website” called hindustan.org. I am reproducing the article here to reiterate that this kind of problem has been existing since a long time and is not just a creation of the social media itself. (Link here)

How to Counter Rogue Sites

Recently there has been reports of a spate of Rogue Web sites carrying “Anti Indian” messages, the latest being the one from the Tamil Nationalist group interlinked with the Islamic fundamentalists.

It is certainly alarming for the E-Governance of the Country that such sites should come up to disturb the peaceful fabric of the country or a part of it. However it would be interesting to see how the Government reacts to this challenge. This is not the first time that such a web site has come up in India or elsewhere and neither it will be the last time. The Government will have to therefore take a policy decision on how to handle such sites.

The Information Technology Act 2000 (ITA-2000) has empowered the Controller some powers in this regard.

Section 69 of the Act, states as follows:

69 (1): If the controller is satisfied that it is necessary and expedient so to do in the interest of the sovereignty or integrity of India, the security of the state, friendly relations with foreign states or public order or for preventing incitement to the commission of any cognizable offence, for reasons to be recorded in writing, by order, direct any agency of the Government to intercept any information transmitted through the computer resource.

(2) The subscriber or any person in charge of the Computer resource shall, when called upon by any agency which has been directed under subsection (1), extend all facilities and technical assistance to decrypt the information.

(3) The subscriber or any person who fails to assist the agency referred to in the sub section (2) shall be punished with imprisonment for a term which may extend to seven years.

Read with section 75 which extends the provisions of the ITA-2000 to persons outside India, the Controller will be in a position to take appropriate action under the Act to punish the owners of the site, the ISP that hosts the site and the content providers. He can conduct an enquiry with or without the assistance of an Adjudicating officer, pronounce his verdict (Using the quasi judicial powers vested in him through the section 69) and request the enforcement authorities to take action invoking International Public law. Of course such action should be completed within a few days to be of any effect in the Cyber World.
One other easy option for the Indian Government is to block the site from being viewed from within India as they have done in the case of some of the Pakistani newspaper sites.

However, blocking of a site may not be the correct solution since surfers may still access such sites through anonymizer services. Then the Government may have to block these services as well. More over, “Blocking ” is a negative way of regulation and only helps in distancing the Government from understanding the ground realities. It is a part of history now that Mrs Indira Gandhi suffered because of the Press Censorship during Emergency which gave her a wrong impression about the real situation in the Country. The Censorship by blocking those who access Internet with Indian ISP s will create a situation where the sites will continue to build up international viewpoint against the country with no counter point being served.

I therefore suggest for consideration the following model for handling “Objectionable Sites”.

1. Sites which are said to contain “Politically Objectionable material” are reviewed by a virtual committee of experts and voted for or against being declared “Objectionable for Viewing by the Indian Government”.

2. Based on such a verdict delivered through digitally signed e-mail confirmations from the virtual committee members, the Controller can issue a notice to ISP s in India to do the following.

3.Whenever a request for an objectionable site is received from a surfer, an “Objection Notice” to the following effect is displayed in a pop up box.

” The site requested by you contains information considered “Objectionable” by the Government of the Republic of India vide GO No xxx of xx.xx.xx. The reasons for objection can be found here. (Hyper linked Document) A List of sites presenting a counter view point can be found here (Hyper link to list of “Counter view point sites”)

4. You can click here to enter the site. (Hyperlink to “continue”)

The moment a site is declared “objectionable”, the Government should notify the same on the internet and invite the public to register their site or Pages containing counter view points. These can be reviewed and if found suitable, added to the list of “Counter View Point Sites”.

This strategy will enable the Government to use the public resources to produce content which will neutralise the objectionable material. If these sites do an equally good job, all the persons who are targeted to be influenced by the “Objectionable site” may actually be converted to the counter view point. Imagine some body like Mr Arun Shourie commenting on Kashmir problem. The owners of the “Objectionable sites” would think twice about inviting their audience to see his reasoned views on many of the contentious issues in the market.

Once a system is established for the purpose, the Indian Government can take up a request to other friendly Governments to bring an International treaty on mandating such services through the ISP s of their countries. India can take international lead in setting up a new treaty for ” International Cooperation in Cyber Space Governance”.

Naavi
December 8, 2000

The central theme of the suggestion made here was to use the power of the internet itself against the attempt to misuse the system by spreading fake news.

Perhaps this strategy can be used in the WhatsApp situation also.

For example, any forward can be sent to the receiver through a “Forward Server” with a comment from the sender similar to “I donot endorse this”, “I endorse this”, “I am neutral to this opinion” and even place a “Counter view” etc. The recipient can be encouraged to make comments and record “Counter views”, all of which should be available in a link that should go with the forward.

This will enable building up of the counter opinion against a fake news and the senders can be rated on the two criteria of “Forwarding a Fake message” and “Endorsing them”. Recipients can be provided a power to block such senders. Over a period of time the credibility of such endorsements will automatically fall and the receivers themselves will block such senders. When more than 50% of a group block a sender, he can be automatically removed.

There could be many more innovative ways of checking the menace of fake news if the instant messaging platforms address it. if they fail to address this issue, regulators will start arresting admins, admins will start withdrawing and eventually the platform will itself be banned or wither way.  Facebook and WhatsApp are today on the verge of tripping over if they donot take suitable steps to control fake news. It is better if they start thinking of proactively introducing some means of checking spreading of fake news so that they survive.

Naavi

Posted in Cyber Law | Tagged , | Leave a comment

Cyber Appellate Tribunal back in action through TDSAT

Posted on July 9, 2018 by Vijayashankar Na

Information technology Act 2000 (ITA 2000) had an ambitious thought of expediting justice in respect of civil disputes arising out of any contravention of ITA 2000. Accordingly it gave powers to Adjudicators to adjudicate on any claim (Upto Rs 5 crores as per ITA 2008 amendment). It also suggested that the adjudication would be an enquiry process and should ideally be completed  within a period of 4 months.

The process of Adjudication however remained on paper until Mr PWC Davidar acting as the adjudicator in Tamil Nadu (by virtue of his position as the IT Secretary) delivered his landmark judgement in the case of S.Umashankar Vs ICICI Bank. Subsequently more cases were decided by him and more in Mumbai. However, most of these cases ended up in appeals in Cyber Appelate Tribunal (CyAT) in Delhi. CyAT functioned upto June 30 2011 and did not give any relevant judgement apart from dismissing some wrongly referred cases. The Umashankar Vs ICICI Bank appeal filed by ICICI Bank had been tried and arguments completed, written arguments filed by the time the then Chairperson Mr Rajesh Tandon attained superannuation on June 30 2011. The judgement was due on 3rd of July but due to the tenure of Mr Rajesh Tandon not being extended nor a new Chairperson appointed, all matters remained in suspended animation.

In the 2017 budget, CyAT was merged with TDSAT but TDSAT had not started hearing any of the pending cases.

Now it appears that the files have started moving in TDSAT and from the beginning of this month, TDSAT has started sending notices regarding pending cases for preliminary listing.

Let’s hope that the litigants who are waiting for a long time now will at last see justice.

During the last 7 years the scenario in Cyber Crimes in India has changed and this is likely to have its impact on the pending cases. We hope that TDSAT will interpret the provisions of ITA 2000/8 which were designed to make the judicial process simple in a manner that upholds the intention of those who framed ITA 2000/8. 

There are certain issues that still needs to be sorted out to enable TDSAT to fulfill its expected role. 

Naavi was representing several cyber crime victims in the CyAT at the time it closed its doors. Now at least one of those victims is no longer alive to continue the fight. Everybody else including Naavi have grown older by 7 long years before the files are being re-opened. All of us have seen the ugly side of how delays makes delivery of justice irrelevant. During this delay the Banks which enjoyed the fruits of the crime were the beneficiaries and the Cyber Crime victims who had lost their hard earned savings were suffering silently. 

It would be good if TDSAT understands the pain behind most of these cyber crime victims who have lost much of their zeal in this intervening days.

But we cannot lose hope and I am reminded of the Tolstoy’s story “God sees the Truth but Waits”. I therefore look forward to TDSAT ensuring that Justice and Truth prevails even if delayed by 7 years.

Naavi

Posted in Cyber Law | Tagged , , | 1 Comment

BJP being blamed for a Mega Bitcoin scam is a good thing..

Posted on July 9, 2018 by Vijayashankar Na

Bitcoin is the currency of criminals and is the digital black money. Now India’s most corrupt party called Congress is blaming BJP which is making efforts to reduce black money through various measures such as Demonetization, Linking of Aadhaar to Government services, Bank accounts and hopefully to Property holdings of a Bitcoin scam.

Naavi.org holds a view that Bitcoin is the darling of all blackmoney holders and corrupt persons whether they are politicians of X party or Y party or bureaucrats or businessmen. It is therefore possible that some politicians in the BJP may hold Bitcoins and may be sympathetic to the Bitcoin. But there is no doubt that many in the opposition parties have their own bitcoin wealth. I also suspect that most of the blackmoney in Swiss Banks has already been converted into Bitcoins or other altcoins. I would be surprised that the Congress as a party would not be the leader in such money laundering activities given the expert economists who are in the party.

The reluctance of the Government of India, particularly the officials of the Finance Ministry indicate that there is a lobby in the Ministry of Finance which is reluctant to take any action to ban Bitcoins and eliminate digital black money despite the pressure from the top brass of BJP. RBI is taking some steps within its own powers but it appears that it is not getting the support from the Finance Ministry. From time to time Mr Jaitely or somebody else comes up with a statement that something is being done but soon there are some leaks from unknown ministry officials stating that Bitcoin would be legalized, regulated etc creating confusion in the market.

Mr Modi and Mr Amit Shah may be worried that just like the Demonetization effort which yielded less than expected results (In general perception) because the Corrupt Gang including Bank officials frustrated its objectives to some extent, any attempt to strike at Bitcoin may generate a bigger backlash from the Corruption brigade.

After all it is so easy to receive bribes in the form of Crypto Coins that bureaucrats and politicians involved in big time corruption would love Bitcoins to continue its existence and they would like to oppose any move to eliminate bitcoins. Hence it is natural to expect the Corrupt politicians like the Congress leaders to do everything to oppose the move politically. Those media people who are hands in glove with such corrupt politicians will try to highlight such political moves and create noise in TV studios. Some politicians may also like to influence the Judiciary if possible that they will fight for Crypto Coins as a part of “Right to Privacy” !.

Given this scenario, it is not surprising that RBI banning the use of Banking Channels for Crypto Exchanges has already been countered by some Exchanges offering alternative channels for conversion of Bitcoins to other Crypto currencies and foreign exchanges and luring the public to break more laws to preserve their black wealth.

In this confusion there are media houses and experts who are trying to teach the public on how to circumvent the RBI’s limited ban on Crypto currencies and continue to break the law at the level of FEMA and PMLA throughvarious articles.

For example, look at the articles “RBI Ban on Cryptocurrency Trade From Today: What Indian Bitcoin Holders can Do!”  or “Bitcoin ban: How cryptocurrency exchanges are circumventing RBI’s circular” . Such articles are meant to guide people to raise an open revolt against the Indian regulation and such attempts need to be put down with an iron hand.

I donot see the rationale of RBI giving a long time for implementing their ban since any time given for implementation in such cases will only be used to circumvent the regulation. It is for this reason that Demonetization had to be announced with an element of surprise which itself was criticized by some who donot understand the mechanism of how such things work.

RBI took more than a few years to announce that “Bitcoin” is not a “Currency” and anybody dealing with a commodity as if it is a substitute for legacy currency was indulging in an illegal activity.

I presume it was because of the officials in the Finance Ministry  who were not in favour of doing anything against Bitcoins even by RBI. The “Expert Committee” constituted for this purpose only dragged the issue further.  This gave enough time for clever corrupt persons to covert their Bitcoin holdings to other alternate currencies. Just as the time given to bring back data of Swiss Banks was used by people to launder the black money into other currencies, the time given for announcing the Government view on Bitcoin has been used and will continue to be used by the corrupt to launder bitcoins into other forms of black money holding.

However, I still feel that it is better late than never and we need to ban Bitcoin completely from our eco system as soon as possible.

Time has come now for declaring that Bitcoin is a menace that has to be eliminated and any person or organization directly or indirectly dealing with Bitcoin or any other Crypto coin (since convertibility of Bitcoin into alt coins is always available without a problem), buying or selling, accepting or promoting the Bitcoin must be declared as an economic offender and proceeded against under laws including PMLA.

Since Bitcoin is the best currency for corruption, it is not surprising that some extortionists may be using it as the means to collect ransom and there could even be a link to a BJP MLA as alleged. If so, let it be exposed and the guilty punished.

I am not worried that Congress has taken up this issue politically  because some BJP MLA’s name has been involved in an incident. At least it will help the Central Government to shake off its lethargy and give more strength to Mr Modi and Amit Shah to be ruthless in coming down heavily against Bitcoin.

If Mr Modi and Shah dithers even now, then likes of Rahul Gandhi will keep talking about it as if Congress is a saint when it comes to Bitcoin issue and it is BJP and BJP alone which is to be blamed for Bitcoin menace.

As I have already written earlier, Mr Modi has to open his third eye to destroy Bitcoin. If he does so, all right thinking persons will support him. (Refer this article: Modi is yet to open his third eye on Bitcoin, the new alternative to Black Money.. Will he wake up in 2018?).

There will be the challenge to convince the voters in the 2019 elections but I feel that our so called illiterate voters are intelligent enough to understand the menace of corruption and accept  a campaign “Banning of Bitcoin is a global fight against Corruption”. Only Modi can take up this challenge and I hope he will do. 

I therefore hope that  Mr Modi himself to come out and make a formal announcement to the nation at least in one of his Man Ki Baat programs that

” Bhaayiyo and Beheno, We are committed to elimination of corruption and consider that all privately owned Crypto Currencies including Bitcoin are  a global menace that feeds on corruption and I therefore launch a global fight against corruption starting with the banning of all private Crypto currencies  first in the Indian economy and then try to persuade other countries to follow.”

I urge Mr Modi to also take up this issue in the UN and try to bring together all countries who have banned Bitcoins into  an “Anti Crypto Currency group of countries” to bring pressure on UN to declare support for banning private crypto currencies.

Naavi

Posted in Cyber Law | Tagged , , , | Leave a comment