Big Tech companies meet: Govt to clear air on digital data privacy

Big tech firms, startups, e-commerce players among list of invitees

Big Tech firms such as Meta (Facebook), Google, Apple and Amazon  will get a chance on Wednesday to raise their doubts on the implementation of the Digital Personal Data Protection (DPDP) Act, 2023. Passed in Parliament last month, the digital data privacy legislation caused a stir in the industry because of some tough clauses and the absence of a clear roadmap so far.
 

Age-gating, as a step to prevent children below 18 years from accessing various apps, is among the biggest concerns of the big tech and social media firms. An extended transition period to the new regime has also been an industry ask.      
 

Besides big tech companies, the Centre has invited startups, e-commerce players, small businesses, advocacy groups and law firms, on September 20 to discuss the transition period required for implementation of the data privacy law.
 

During the consultation, top officials of the Ministry of Electronics and Information Technology (MeitY) will also deliberate on the rulebook for digital platforms to comply with the law. Minister of State for Electronics and Information Technology Rajeev Chandrasekhar is expected to be present at the meeting.
 

The digital data privacy law was cleared after four years of work, multiple rounds of deliberation and numerous iterations. The Act provides broad principles of data protection, but the way of implementation and the exact processes will be “as may be prescribed” in the rulebook. The Act has defined 26 matters on which the government can make rules to carry out the purposes of the law.
 

“The first thing is that we have to notify the transition period that is required for the industry. That conversation is still ongoing. We have discussed this with the state and central government (entities) and they certainly need more time to transition. Startups and MSMEs also want more time,” a senior government official said.
 

MeitY officials have already conducted meetings with consumer protection groups who have pushed for immediate enactment of the Privacy Act. The draft rules to implement the law are also ready, a government official said.
 

The ministry is likely to propose a time of six months for the law to come into effect. Chandrasekhar had earlier indicated that there would be a longer transition period for small businesses and government entities to fully comply with the law.
 

The law mandates platforms to obtain “verifiable consent” from a parent or legal guardian before processing the personal data of users under the age of 18. This provision was one of the most contentious issues during the public consultations on the Bill. According to sources, the big tech firms believe they have the necessary mechanisms to comply with the law.
 

However, the tech giants are likely to engage with the government on the issue of parental consent for processing children’s data. According to sources, this provision has raised serious concerns about “unintended consequences” for digital inclusion, privacy, and children’s safety.

Digital platforms will need to take unconditional, free, specific, and informed consent from users presented in clear and plain language for processing their data. Users will be able to withdraw this consent at any point post which the platforms must stop processing their data and erase it.

Every platform will need to provide a notice explaining the purpose of data processing and the rights of the users. The notice has to be made available in all 22 official languages. The platforms that have already collected personal data will need to send a notice to users allowing them to withdraw their consent. The rulebook assumes significance as it will define how all of these and the remaining requirements of the Act will need to be implemented.

“We have a series of rules to do and then we will have a series of consultation meetings based on the transition period for different platforms,’’ the official said. If the effective date is six months from now, the rules could be notified by February, he added.