Overlapping concerns, multi-sector impact delaying data protection law

The Digital Personal Data Protection (DPDP) Act has been delayed due to non-release of administrative rules; govt may undertake another round of inter-ministerial consultations to weed out any errors

In a recent report, the 25th Standing Committee on Finance asked the Competition Commission of India (CCI) whether it was feasible to integrate the provisions of the proposed Digital Competition Bill (DCB) with those of the Digital Personal Data Protection (DPDP) Act, which was ratified as a law in August 2022.

 

The CCI maintained that, despite the similar nature of regulations under both, the anti-trust law framework was an essential regulatory tool to address the exploitative and exclusionary behaviour arising from data accumulation by entities with market power.

 

The DPDP Act, which was ratified as a law in 2023, also has provisions that place a larger burden on companies with a larger number of users. Such enterprises, referred to as Significant Data Fiduciaries (SDF), can be classified by the government based on the volume and sensitivity of personal data being processed, the risks to user rights, and the potential impact on the country's sovereignty and integrity, among other factors.

 

While the provisions of the DPDP Act cover almost all facets of online markets, including ensuring that the personal data of Indian users is not shared with governments of other countries, the act has remained inoperational due to a delay in the release of administrative rules to activate it.

 

According to senior officials from the Ministry of Electronics and Information Technology, while feedback and comments from all stakeholders have been submitted, the rules are not being vetted by the Ministry of Law and Justice.

 

One of the possible reasons for the delay in releasing the administrative rules could be the government opting for another round of extensive inter-ministerial and inter-departmental discussions, as the impact of the regulations is likely to be across all sectors, said Prashant Phillips, executive partner at law firm Lakshmikumaran & Sridharan Attorneys. 

 

“This legislation, as such, cuts across different sectors, and each industry in these respective sectors has its own set of problems. It is quite possible that because of the nature of the (DPDP) Act itself, there might have been delayed inputs coming from different ministries,” Phillips said.

 

The government is also acting risk-averse at the moment to ensure that some valid concerns, which may have been overlooked during public consultations, are adequately addressed to avoid litigation later, another official said.

 

Earlier this month, the Internet and Mobile Association of India (IAMAI), which is the largest representative body of startups and internet-based intermediaries in India, flagged its concerns with the DPDP Act.

 

In its submissions, the IAMAI pointed out that some provisions, particularly those requiring AI companies to determine whether all publicly accessible personal data had been voluntarily provided by data principals themselves, were practically unfeasible.

 

“Restrictions on access to publicly available personal data would impose undue compliance burdens on AI companies, hinder technological progress, and could ultimately obstruct the realisation of AI's potential. Such limitations would disproportionately affect startups and smaller companies developing AI models,” the IAMAI said.