Start-Ups Likely To Be Hit By Data Protection Bill: IAMAI

The proposed regulator in the form of a Data Protection Authority is ‘complex’ with an ‘ill-defined mandate’, says IAMAI.

With ease of doing business being still relatively difficult for start-ups; creation of an additional regulator in the form of a Data Protection Authority will make things much more difficult for Indian tech start-ups, said industry body, Internet and Mobile Association of India (IAMAI) on Tuesday after a consultation session with its members on the impact of the draft Personal Data Protection Bill, 2018.

The bill submitted to the government by a high-level expert group headed by former Supreme Court judge B.N. Srikrishna on 27 July proposes setting up of a Data Protection Authority of India (DPA), an independent regulatory body responsible for the enforcement and effective implementation of the law, consisting of a chairperson and six whole-time members. In case of any appeal against an order of the DPA, an appellate tribunal should be established or an existing appellate tribunal should be granted powers to hear and dispose of any appeal, said the expert panel in its report submitted along with the draft bill.

The proposed regulator is “complex” with an “ill-defined mandate”, a statement from IAMAI said. The industry body said that most important concern emanates from the insurmountable difficulty of collecting and processing personal data proposed in the draft Bill. Restrictive clauses around purpose limitation, storage limitation and collection limitation will make it very difficult for start-ups and potential start-ups to get into the data business, it said.

With absence of avenues to collect primary data from users, start-ups would be forced to depend on incumbent businesses for ‘anonymized data’ that does not come within the ambit of this Bill. “Incumbents may refuse to share data with potential competitors, or demand premium price for anonymized data products. Going forward, such incumbents can become the gatekeepers to the tech sector. This does not augur well for a competitive space required to promote tech start-ups,” the statement said.

The bill which has been put up for public comments and needs parliamentary approval to become an Act, also proposes localization of personal data. The members of the association who are mid-sized start-ups with ambitions to expand in the overseas market feared that their plans may be scuttled by the provisions of data localization.

“Other countries where they are expanding may retaliate by demanding reciprocal data localization. Data localization also forces Indian start-ups to look for more expensive and inefficient local solutions,” IAMAI said. – Live Mint