Revision as of 08:45, 14 December 2020

Availability of data

As in 2019

July 5, 2019: The Times of India

The types of data that exists about Indian citizens, as in 2019
From: July 5, 2019: The Times of India

The government made a strong pitch for using data and analytics for social welfare and citizen empowerment, and also made a case for greater engagement with the private sector in processing non-sensitive information. However, it said a focus on user consent and privacy should be the cornerstone of the effort to make it a safer process.

“In the spirit of the Constitution of India, data “of the people, by the people, for the people” must therefore become the mantra for the government,” the survey said. “… economic theory predicts that economy should have, by now, seen a surge in efforts to harness and use data. This has indeed happened, but only partially.”. It said while private companies have harnessed user data as a profitable business model, a lot still needs to be done in many social-welfare areas where the government should step in. “… government intervention is required in other areas where private investment in data remains inadequate. The social sectors of the economy, such as education and healthcare, have lagged the commercial sectors in exploiting data… To ensure that the socially optimum amount of data is harvested and used, the government needs to step in, either by providing the data itself or correcting the incentive structure faced by the private sector, depending on the nature and sensitivity of data.”

Privacy of data, however, needs special focus as efforts towards harvesting information get stronger, the survey said.

The survey also said while there is a fair amount of information that is already collected about citizens, such as birth and death records, tax statements, census data, and health and education information, they are not harmonised and collated together to bring out confirmed trends. “Data collection in India is highly decentralised… if these different pieces could be put together, we would find that the whole is greater than the sum of parts.”

On fears that government may misuse and get unbridled powers through the huge citizen database, it said, “… this is far from the truth. First, large quantities of data already exist in government records, and the objective is only to use this data in a more efficient way.”

As existing paper records get digitised, there is a need for a parallel initiative to convert very process of data collection into a digital one, as agsinst collecting on paper first and converting to a digital format later. On giving certain kinds of data to private companies, it said this should be done with all necessary security safeguards.

General Data Protection Regulation

Salient features: 2018

Kim Arora, May 8: The Times of India

Indian IT Act and the GDPR
From: Kim Arora, May 8: The Times of India

Come May 25, and internet and tech companies that handle user data of any sort will have a new legal provision to comply with. The General Data Protection Regulation or the GDPR is a new law that came into force in the European Union in May 2018.

What does the GDPR do?

GDPR enshrines data protection and privacy rights for European users, and holds companies handling their data, wherever they may be, liable for violations. The penalties run into hefty fines — highest being 20 million euros or 4% of annual turnover — whichever is greater. Facebook has sprung into action to redistribute its data-handling operations. Microsoft-owned LinkedIn has done the same. Twitter has updated its privacy policy too. Indian tech, publishing and e-commerce companies will also have to review how they handle, store and erase data.

What does the law say?

The EU law comes into force on May 25, and decrees that consumers or “data subjects” have right to erasure of their data and a right to port their data from one place to another. It also places a premium on the data subjects’ consent to collection and processing of data. Although the law is being introduced in the EU, its ramifications extend the world over. That is because it is not focused on regulatory measures for tech companies, but rather on the protection of EU citizens and their data. Since internet and tech companies the world over handle data from across the globe, the consequences of breaking the law extend to them. The law was introduced in 2016, with data controllers and processors the worldover given two years, until this year’s May deadline to comply.

What is at stake?

In April, a Goldman Sachs report said that Facebook, which got 24% of its global revenue from EU, could suffer a negative impact of up to 7% because of GDPR. That month, Facebook recalibrated its operations in such a way that non-EU users, who earlier fell under Facebook’s Ireland incorporation, were shifted to the US-based counterpart.

What's the status of Indian companies when it comes to compliance?

Experts and industry watchers say Indian companies are still behind when it comes to GDPR compliance. “We have been speaking with organisations for the last 18-24 months. Most companies have woken up to this only six months ago. Some of the Fortune 500 companies and other MNCs have done good work in data discovery and information flow mapping. Smaller organisations are not well-prepared. They feel it is a distraction from core business,” says Shree Parthasarathy, national leader for cyber risk services, Deloitte.

Industry bodies in India are attempting to handhold companies through the regulatory maze. Nasscom and the Data Security Council of India held familiarisation workshops in March in Delhi, Mumbai and Bengaluru. “Nasscom has also launched a GDPR Helpdesk for member companies to have their questions resolved,” says Gagan Sabharwal, senior director for global trade development, Nasscom.

What does it mean for Indian users of internetbased services or products?

You will continue to use online products and services the way you did. The EU law is not designed to protect citizens outside of it. Indian businesses handling EU user data, however, will have to take another look at the way they collect and use data or face massive fines.