The Corporate & Commercial Law Society Blog, HNLU

Tag: privacy

  • Aligning RBI Directives with DPDP Act in the Banking Sector

    Aligning RBI Directives with DPDP Act in the Banking Sector

    BY VISHWAROOP CHATTERJEE AND NACHIKETA NARAIN, SECOND-YEAR STUDENTS AT RGNUL, PATIALA.

    Introduction 

    The intersection of banking and data protection is perhaps the next big leap for both the sectors. The banking sector is one of the most prone and vulnerable spaces for massive data breaches that can have severe financial and legal consequences. The lack of an effective cybersecurity infrastructure will lead to an onslaught of cyber-crimes such as fraudulent financial activities, phishing, data selling, ransomware, etc. The Government has introduced the  Digital Personal Data Protection Act (‘DPDP Act’) and the proposed Digital India Act which sheds positive light on the government’s intention for data protection. However, the mere introduction of legal provisions is not the solution, corporations have been notorious for acting as data brokers which results in data leaks. As a result, the financial data has always been prone to data breaches. 

    In this article, the authors shall deal with the analysis of the current laws that govern data protection with an understanding of the DPDP Act and its emphasis on the role of RBI as the watchdog of data privacy in the banking sector. 

    Failure To Comply with Data Protection Protocols: The Kotak Mahindra Bank Incident

    Digital banking is the new norm and yet, banks have been failing to be well equipped with a robust digital infrastructure for the protection of their consumer’s data. The recent actions against Kotak Mahindra Bank by the apex financial institution (‘RBI’) under Section 35A of the Banking Regulation Act, 1949 is an example of failure of banks to equip themselves with robust digital infrastructure for the protection of consumer data. RBI has barred the mentioned bank from onboarding customers through its online service platforms and issuing new credit cards. According to the RBI, Kotak Mahindra Bank failed to comply with various data protection protocols, and deficiencies were identified in IT inventory management, risk vendor management, data security and data leak prevention strategy, etc. RBI had notified the mentioned bank in 2022 and 2023 about the security lapses and provided them with a corrective action plan which Kotak Mahindra failed to comply with. A well-established Indian Bank failing to meet RBI’s data protection protocols is a worrisome event as other banks might follow if these lapses are left unchecked. 

    Data Privacy in Banking Sector

    In the case of  HDFC Bank Limited v. Jesna Jose,   it was held that with the advent of the digital age, the bank must be held liable for any unauthorised transaction or fraudulent activity from an act arising out of the bank’s negligence. This was done to keep a watch on the banks’ data privacy systems and to ensure that they minimise any unauthorised or fraudulent activity. The judgement relied upon the precedent set by the Chairman, Punjab National Bank v. Leader Valves Ltd which held that if the bank manages the account, it is incumbent upon the bank to ensure the safety and security of the account. The section 43(a) of the Information Technology Act, 2000 deals with the liability of a corporate body to compensate in instances of failure to protect sensitive data. Most importantly, the master direction issued by RBI on IT outsourcing services serves as a cornerstone to keep third-party data processors in the financial ecosystem in check.  

    One question that may arise here is, does RBI have the legal jurisdiction to enforce banks with data privacy compliances? In the case of Internet & Mobile Assn. of India v. RBI, (2020) one of the issues was the jurisdiction of RBI in matters not directly linked with traditional monetary policies. The judgement held that when RBI is not any other statutory body but a creature on its own that can exercise its power in its capacity for policymaking, operational risks or  regulation for enforcement and such directions would become supplementary to the Reserve Bank Of India Act, 1934 itself. Hence, it becomes a duty for the banks to comply with the data privacy directives of RBI.

    Analysis and Suggestions to the DPDP Act

    In the digital economy, consumers utilise the financial services offered to them by giving their personal data. This trade of confidential data for financial services is a highly sensitive aspect that must be backed by sturdy mechanisms protecting the confidentiality of sensitive data from misuse. 

    The most prominent issue that arises with the DPDP Act is that it has failed to differentiate between personal data and sensitive personal data. Under Section 2(h) of the Act, it defines data as the representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means. This classification may perhaps be too vague in the realm of the banking sector since it deals with highly sensitive consumer data that needs greater protection than other personal data since it contains sensitive financial information besides personal information. 

    The first suggestion is to classify the various types of data that need regulation. The vague definition is restrictive for the efficient regulation of different data sets. Therefore, there should be categorisation of data sets. The EU GDPR, UK GDPR, and US state laws like the California Consumer Privacy Act categorise certain types of data as ‘sensitive’ and deserving of extra protection. The DPDP Act can take a similar approach. This will provide clarification to data fiduciaries in the banking sector to regulate sensitive financial data with a well-defined approach.

    Moreover, the DPDP Act has misaligned accountability with respect to data fiduciaries and data processors. It defines data fiduciaries essentially as corporations who possess customer data and determine how the data will be processed. Whereas, a data processor is an entity that processes the data on behalf of the fiduciary.  The DPDP Act focuses on the guidelines for the data fiduciary and leaves the data processors with minimal regulation. The only significant element for data processors is subsection (9) of section 9 which states that a data fiduciary must have a contract with the data processor. 

    The DPDP Act falls short of providing the necessary clarity for processors on how to handle such data. Firstly, it fails to specify the security controls that processors are expected to implement. Secondly, the Act is deficient in outlining clear protocols for processors to follow in the event of security lapses. Lastly, the Act neglects to establish clear guidelines for handling requests for data from government authorities, resulting in ambiguity and potential liability issues. 

    This essentially makes it clear that there are hardly any guidelines or standards that ensure that these data processors undertake their responsibilities in a safe and secure manner so as to protect the sensitive data they handle; these data processors can ultimately emerge as the ‘unruly horse’ in the digital realm. This necessitates the framing of certain standards which the data processors comply with. Chapter 5 of the Master Direction by the RBI can be referred that clearly outlines the rules of the agreement pertaining to the data processors. 

    Hence, the second suggestion is to properly define the roles of the data processors in the DPDP Act like the RBI has done for its regulated entities by clearly laying out a roadmap that gives directions to data processors on data breaches, storage of data, risk management and etc. The relationship between data fiduciaries and data processors cannot be sufficed by a mere contractual agreement. 

    Some of the directions for data processors can be referred from the RBI Master Directions. As per this, the service providers (similar to data processors) are required to define the services they will deliver and the standards they will adhere to in order to meet in terms of quality and quantity. Moreover, the service provider is responsible for maintaining confidentiality and security of the data with ‘Regulated Entity’ (similar to data fiduciaries) pertaining to the customers or its own data. The agreement should define as to which data can the service provider share with other entities.

    Conclusion 

    The world of technology is adapting and the Banking and Finance world cannot be left behind. The RBI must act as the custodian of Data Privacy in the realm of Banking and Finance. The current DPDP Act needs revision and needs to be harmonised with the RBI directives to provide better clarity for the data protection of the finance world. 

    Moreover, it would be essential for the DPDP Act to categorise the various Data types as they may be susceptible to varying levels of risk. The Act must also adapt or incorporate RBI’s master directions on IT outsourcing to clearly establish the roles of Data Fiduciary and Data Processors. The legal ambiguity with the data processors is a regulatory gap that must be dealt with to create an efficient digital banking sector. India’s digital economy generating about $200 billion of economic value besides also being the second-fastest digitizing economy. Therefore, it is necessary for India to advance these data protocols. A secure digital infrastructure provides consumer trust and safety which paves the way for a resilient and sustainable banking sector. 

  • India’s New Digital Personal Data Protection Laws & Its Implications For M&A Compliance

    India’s New Digital Personal Data Protection Laws & Its Implications For M&A Compliance

    BY DEVINA SOMANI, FOURTH-YEAR STUDENT AT JGLS, HARYANA

    Introduction

    India’s recently implemented Digital Personal Data Protection Act, 2023 (DPDP Act)on 11th August, 2023 exclusively pertains to the processing of personal data, regardless of its initial form (digital or analog subsequently converted into digital format). Under the Act, ‘personal data,’ is described as ‘any information relating to a recognizable individual.‘

    The Act introduces ‘significant data fiduciaries’ (“SDFs”) with added duties based on data scale, sensitivity and impact. SDFs appoint a Data Protection Officer (“DPO”) and face transfer restrictions. ‘Data processors’ handle data for fiduciaries, ‘data principals’ being the subjects. The ‘Consent manager,’ registered with the Data Protection Board, centralizes consent management as a Data Fiduciary (holds responsibility for processing personal data), ensuring transparent and accessible handling. 

    The DPDP Act does not apply to handling the personal data of individuals located offshore if processed in India based on a contract between an entity in India and one located outside it. This exclusion aims to support Indian outsourcing firms regularly managing data of individuals outside India. However, it might hinder the chances of the European Union (“EU”) and similar regions considering India as offering sufficient protection for data transferred to such firms. Therefore, under the Act, Cross-border data transfers are generally allowed unless restricted by the government, benefiting IT companies by enabling uninterrupted operations. Moreover, the Act prioritizes existing restrictions on the transfer of personal data abroad including mandates from RBI to store payment data within India.

    The Impact of the New Data Privacy and Protection laws on Mergers and Acquisitions

    When it comes to Mergers & Acquisitions, evaluating the Act’s impact would primarily involve determining whether the chosen M&A structure falls within exempted M&A Scenarios, allowing a focused compliance effort on the applicable provisions.  Section 17(e) of the Act states that the rules concerning the obligations of Data Fiduciaries and the rights and responsibilities of Data Principals in Chapters II and III will not be applicable in situations where data processing is essential for certain corporate actions like mergers, amalgamations, reconstructions, or transfers of undertakings between companies that are authorized and approved by a court, tribunal, or competent authority as per prevailing laws. However, any sharing or processing of personal data for M&A purposes outside the scope of a court-approved scheme must adhere to the Act’s provisions. 

    Should the structure not align, comprehensive compliance measures spanning the entire M&A lifecycle become necessary. This entails identifying personal data footprints through an in-depth discovery process, where records of processing are established, customer consent protocols are navigated for conflicting data, and data privacy policies for the merged entity are implemented. The buyer will have to scrutinize the type of data relevant to the target’s business and its significance in their operations. Similarly, it will need to assess whether the target company’s business model presents additional complexities or unexpected privacy vulnerabilities compared to the buyer’s current model. For instance, if specific privacy regulations apply to a particular sector of the business (such as financial institutions or insurance companies), this will likely alter the approach to how the due diligence is conducted. It becomes crucial to consider these sector-specific regulations and responsibilities when assessing the transaction’s risks and implications under the Act. Moreover, in a transaction involving a party where the primary business of the entity involves data processing (like an advertising agency or a company focused on big data and artificial intelligence), the significance of the data handled in their operations becomes even more pronounced.

    Similarily, different considerations arise regarding data protection in Share sales and Asset sale transactions. For share sales, where only the shares of a company are transferred to the buyer, the company retains control over its personal data, such as employee records and customer contact details. As this control does not shift, there is no obligation to inform data subjects about post-transfer data processing unless the nature or purpose changes. However, it is advisable for the company to notify data subjects about the change in ownership to prevent any potential confusion or distrust. Any alterations to the buyer’s data protection documents post-transfer, like privacy policies, should be communicated to data subjects if they are significant. On the other hand, during  Asset sales, unlike Share sales, personal data often moves from the seller to the buyer, where it becomes necessary to inform the data subjects as the controller’s identity changes. If the buyer obtains personal data, it must furnish privacy policies or other data protection documents to the concerned data subjects. This aligns with transparency principle followed by the General Data Protection Regulation (“GDPR”). The seller might agree to implement new policies before the sale’s completion. The specifics outlined in the privacy policy or other applicable data protection documents, especially regarding employees, are crucial.

    Data Privacy Considerations in the Pre-Acquisition Phase

    M&A deals involve handling extensive Personal Data of the target company, where a buyer’s due diligence will involve inquiry into information about data tied to the acquired target like data on employees, customers, vendors, contractors, suppliers, and business partners (Data Principals). If the seller or target discloses this personal data during the due diligence, compliance with the Act’s consent requirements (Section 6 of the DPDP Act, 2023) is necessary at that stage. Additionally, in a business transfer like a ‘slump sale,‘ where the entire business is transferred, processing personal data of customers and vendors requires consent. The seller, as the Data Fiduciary, must obtain consent before processing such data, issue notices and seek fresh consent if necessary. Since getting approvals during mergers and acquisitions can be challenging at times, alternative options may include Data Sharing Agreements(“DSAs”) which establish the specific terms and conditions governing data sharing, regardless of whether the data is transmitted within India or abroad.

    In order to spot potential privacy risks, the buyer must initially comprehend the kinds of personal data handled by the target company. To assure and safeguard the buyer, the seller can provide assurances through Representations and Warranties. Additionally, the buyer should seek indemnification specifically concerning any repercussions resulting from identified non-compliance with data protection laws uncovered during due diligence. A prerequisite condition mandating the target to secure consent from pertinent data subjects. Can be incorporated into the transaction documents as condition precedents which might necessitate rectification of any non-compliance with relevant laws discovered during due diligence before finalization.

    As an acquiring entity, it is vital to grasp the involvement of third-party processors linked to the target company and ascertain the scale of international data transfers. Significant focus should center on any cloud service providers engaged, the methods and locations of data storage, and the array of contracts and data processing agreements (“DPAs”) the company has in place. 

    In the course of an M&A deal, companies must restrict the handling of employee data to what is essential for the transaction’s objectives. Upholding principles like data minimization and purpose limitation safeguards employee privacy during this process. The Act specifies that processing Personal Data for employment purposes is deemed a ‘legitimate’ utilization. This implies that an employee’s Personal Data could potentially undergo processing without their explicit consent under certain conditions, namely: (1) Utilization of the Data Principal’s information for their employment. (2) Employing the data to shield the employer against potential loss or legal responsibility, (3) Providing any service or benefit requested by an employee who acts as a Data Principal. In a scenario where a seller might argue for the necessity of divulging such information, their rationale could be centered on ensuring that a potential buyer extends comparable offers to employees for recruitment purposes. As this disclosure directly links to the employment status of the Data Principal, it falls within the purview of legitimate use and, therefore, stands exempted from the necessity of seeking consent as outlined in the Data Protection Act. 

    Moreover, the legislation emphasizes the criticality of maintaining the accuracy and consistency of employee data, particularly when these data influence decisions impacting employee. Employers are further required to promptly report any breaches of personal data to the Data Protection Board (“DPB”) and affected individuals. Additionally, they must facilitate the erasure of personal data once its intended purpose is fulfilled, aligning with the overarching principles of the Act. To fulfill the transition to the Act, employers are granted the leeway to continue processing employee data until consent for such data is withdrawn. However, they are mandated to furnish employees with a comprehensive notice detailing the types of personal data being processed, the procedures to exercise their rights under the new regulations, and avenues for lodging complaints as per the guidelines under the Act. 

    Data Privacy Related-Risks Upon Completion of Transaction

    Upon the completion of the transaction, the buyer typically expects to receive all personal data associated with the acquired business. In cases where there is a cross-border transfer of data at closing, there may be risks associated with conflict between such transfer and stricter regulations imposed by existing Indian laws on transferring personal data outside India, such as the Reserve Bank of India’s mandate for payment system data storage within the country. Section 16(2) of the Act explicitly states that it does not override current transfer restrictions set by various sector-specific laws or administrative regulations in India. Depending on the transaction’s nature, such as a spin-off of an independent subsidiary, the transferred personal data might continue to be hosted on the target’s systems sold as part of the deal. 

    In M&A transactions, the involvement of a third-party entity gaining access to personal data constitutes a “transfer” that could potentially breach the consent requirements under Section 6(1) of the DPDP Act. Hence, it becomes crucial to inform data subjects about such transfers. The seller should provide specific information to data subjects about the transfer of their data to a third party at the time of the transfer. After the transaction’s closure, the buyer must consider the necessary steps to utilize the acquired data while ensuring compliance with the DPDP Act, 2023. 

    Henceforth, it becomes crucial for the buyer to safeguard the information as mandated by DPDP Act and refrain from further disclosing the personal data without consent of the data principals as under Section 6 of the DPDP Act. As such, the seller may establish a “Data Protection Agreement” with the buyer concerning these obligations, which can also include adherence to any restrictions in the seller’s contracts with third parties regarding the shared personal data before closing.

    Conclusion

    India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) has a significant impact on Mergers and Acquisitions (M&A). Replacing earlier regulations, the DPDP Act governs data handling, emphasizing consent, legitimate use, and the role of Data Fiduciaries. In M&A, it prompts necessary consent requirements during a due diligence, affecting both Share and Asset sale transactions. Employment-related data processing under the Act demands adherence to the consent framework under the Act even during transitions. Post-transaction risks emerge concerning cross-border data transfers and compliance with sector-specific Indian laws. Navigating these complexities demands proactive compliance measures to adapt to India’s ever evolving landscape in Data Privacy Laws during such M&A transactions.