JPC recommendations on Data Bill 2019 out of sync: IAMAI

The recommendations of the joint committee on personal data protection have fundamentally altered the structure of the Personal Data Protection Bill to a generic Data Protection Bill, industry body IAMAI said on Thursday.

The Internet and Mobile Association of India (IAMAI) said the recent Joint Parliamentary Committee’s (JPC) report on the Personal Data Protection Bill, 2019, is out of sync, with India taking the leadership position in the techade.

It said the JPC recommendations to treat intermediaries as publishers under certain circumstances may have drastic impacts on the use of social platforms, free speech and creativity.

”Social media intermediaries continue to have safe harbour provisions and are not regulated as publishers, based on their ‘ability’ to control content, given that this ability stems from a legal obligation.

”Such a provision may have drastic impacts on the use of social platforms, free speech and creativity. It also poses a risk to the digital ecosystem, particularly considering that it is not associated with data protection,” the industry body said.

The JPC report was submitted to Parliament on December 16, 2021.

The Association is of the view that the JPC recommendations are likely to negatively impact a cross section of tech industry segments such as large tech companies, tech services companies as well as digital start-ups that form the backbone of India’s tech leadership aspirations.

According to IAMAI, whose members include Google, Facebook and Paytm, among others, the JPC has recommended stringent data localisation requirements, which will lead to difficulties in compliance and will be harmful for global and domestic companies alike.

”Placing restrictions on cross-border flows may lead to higher business failure rates, create barriers on the growth of start-ups, increase costs of compliance for companies and slow down socioeconomic benefits reaped from the digital economy.

”It will also inevitably have a drastic negative impact on the ability of Indian consumers to access a truly global internet,” the industry body said.

It added that the additional requirement, suggested by the JPC, tasking the Data Protection Authority (DPA) to consult the government on all cross-border sensitive personal data transfers not only contradicts established global practices and undermines the role of the DPA, but also subjects data flows to a cumbersome and inefficient process.

Some of the Opposition leaders have also raised similar concerns on the proposed Data Protection Bill.

IAMAI said the retrospective clause to bring back data taken abroad poses significant operational and technical challenges, especially since relevant businesses would be subject to policies which were not enforced at the time of data collection.

IAMAI said the changes recommended by the JPC expand the scope of the Bill to include non-personal data along with the personal ones.

”However, the recommendation fails to account for the differing value propositions offered by the two. This recommendation is also premature as the Expert Committee report on non-personal data is yet to be finalised,” it said.

The industry body has urged the government to refrain from developing new standards as recommended by the JPC that the DPA should create a framework to monitor, test, and certify hardware and software for computing devices as there is a time-tested regime, which devices sold in India are subjected to. Moreover, such a requirement will hamper India’s ability to attract global businesses and investments.

IAMAI has also expressed concern on the proposed imposition of age restrictions of 18 years on certain services. The industry body said age bar will exclude an important demographic from the digital ecosystem and will contradict most data regimes.

The rigid approach of setting 18 years as the blanket age of consent will be against the principle of ‘the best interest of the child’ in a digital world, as it will create barriers for a child to attain educational and recreational fulfilment available on the internet, it said.

”The association is of the view that collectively the JPC recommendations have fundamentally altered the structure of the bill from that of a Personal Data Protection Bill to a generic Data Protection Bill.

”This in itself calls for wider stakeholder consultations and impact assessment reports before these recommendations are hardcoded into law,” IAMAI said. PTI