With an increasing collection and processing of personal data, lack of a comprehensive data protection law, and growing incidents of data breaches and privacy violations, there was a need to introduce a law that addresses these concerns. The Digital Personal Data Protection Act, 2023, (DPDP ACT, 2023) is a landmark legislation introduced by the government that provides a comprehensive framework for personal data protection.
As data is the centre of the consumer industry, the new Act will have a significant impact. It imposes several regulations on e-commerce/D2C businesses, which will push companies to revamp their strategic approach towards digital safety. Apart from these, other players in the ecosystem, such as retailers, call centre operators, third-party logistics, marketing agencies, sales/distribution outsourcing companies, and payment enablers, will also come under the purview of the new Act.
The DPDP Act gives users certain rights, such as the right to access, right to correct or delete, and the right to object to processing of their personal data. Businesses must familiarise themselves with these rights and begin complying with them.
It is expected to increase the transparency between users, brands or platforms, make businesses accountable, improve security and privacy of user data, and potentially build trust and confidence within the industry. This is because the Act requires businesses to obtain explicit user consent before collecting, processing, or using their personal data. It also requires them to limit the collection and use of personal data to what is necessary for the purpose for which it was collected and to take appropriate security measures to protect personal data from being breached by unauthorised access, use, or disclosure.
As with any opportunity comes certain challenges, consumer-oriented businesses will need to implement new protocols to comply with the Act, invest in new technologies to improve data security, and educate users and staff about data privacy rights.
Overall, the DPDPA is a positive development for the industry in India. However, it is pertinent for players to be aware of some of the challenges that the Act will pose and to take certain steps to address and mitigate these challenges.
Here are some specific ways in which the DPDPA will impact consumer businesses:
Consent: Businesses will need to obtain ‘express consent’ from users before collecting, processing, or using their personal data. This consent must be freely given, specific, informed, and unambiguous. Companies will need to maintain clear communication for the same.
Purpose limitation: They can only collect and use personal data for the specific purpose for which it was collected. Companies must have full clarity on the details they seek from the customers and the purpose of collecting the same.
Data minimisation: Businesses should only collect the bare minimum amount of personal data necessary for the purpose for which it is being collected.
Data security: They must take appropriate security measures to protect personal data from unauthorised access, use, or disclosure. This means that there is need to implement data masking and encryption technologies to mitigate the risk associated with data thefts.
Breach notification: Businesses must notify users of any data breaches that have occurred. Robust mechanisms must be put in place to identify the data breaches. Currently, the time frame for communication has not been defined and the same will be notified in the rules of the act.
Who Will Be Data Fiduciary?
A data fiduciary is responsible for determining the methods and purposes of collecting personal data. In e-commerce, the brand owner, platform provider, or seller on record is usually one of the data controllers since they gather personal data during registration and use it for various purposes like marketing, analytics, and delivery. However, they become data processors if they only provide goods and services without accessing personal data.
In both platform and retailer scenarios, their roles as data fiduciaries may vary depending on their involvement in data collection and processing. The key principle is that any entity determining how personal data is collected and processed acts as a data fiduciary.
E-commerce companies are likely to be significant data fiduciaries under the Act. This is because they collect and process large amounts of personal data about their users, including names, addresses, contact information, payment details, and browsing history. This data can be used for various purposes, such as providing personalised shopping experiences, targeted advertising, and fraud prevention.
As significant data fiduciaries, e-commerce companies will be subject to additional obligations under the DPDPA, such as:
- Ensuring Data Protection: Companies need to check their readiness for data protection including (but not limited to) volume, sensitivity, level of transparency, use of personal data for innovation and research, and resources. They also need to investigate the support required for ensuring compliance, cross-border data flow and customer communication on data usage and sharing data with third parties. Failure to comply with the latest guidelines can result in various penalties.
- Conducting regular data protection impact assessments: This will enhance the cost of compliance for the companies. They must consider technologies that can generate audit logs to track modifications and access to the databases.
- Appointing a data protection officer.
- Obtaining explicit consent from users before collecting or processing their personal data: This is trickier when users are under 18 years of age.
- Providing users with access to their personal data and the ability to erase it: Companies need to explore options for providing data in real time rather than sharing the data with third parties. Technology will play a key role in this by restricting access to the data. Companies will have to build teams to ensure that all the responses to erase the data are taken care of immediately.
- Notifying users of data breaches within a reasonable timeframe: As of now, the Act has not defined “Reasonable Timeframe”. The same will be notified in “Rules”.
Strong consequence management measures, such as non-disclosure agreements, are necessary to deter the misuse of personal data. The focus should be on minimising data collection and sharing only data needed for processing. Data should be encrypted or masked before being shared for enhanced protection.
Recommendations for the industry
- Implement robust data encryption and masking
- Frame proper consent mechanisms
- Make privacy notes visible on websites elucidating data protection
- Update privacy policies in a timely manner
- International companies need to comply with data storage norms across borders
- Ensure no data analytics/campaign targeting is done for children below 18 years
- Accept consumers’ right to delete information from the database when requested.
Overall, the DPDPA is still in its early stages of implementation, so it is not yet clear how it will be enforced. This can be a real challenge for start-ups who are currently more focused on setting up businesses and may not have a robust IT framework in place.
In addition to the legal obligations under the DPDPA, e-commerce / D2C companies have a moral obligation to protect their users’ data. Consumers are becoming increasingly aware of the importance of data privacy and are more likely to do business with companies they trust to handle their data responsibly.
By complying with the DPDPA and taking other steps to protect their users’ data, these businesses can build trust with their customers and position themselves for long-term success.
(The author is partner and industry leader (FMCG and consumer goods) at Grant Thornton Bharat)
Comments
0 comment