Law Optional (Contemporary Legal Developments) by Rajnish Jindal

Model Answer

Question #1. Evaluate the proposed Digital Personal Data Protection Bill, 2022, in safeguarding the privacy of individuals vis-à-vis the right to privacy of the citizens.

Ans. The new Digital Personal Data Protection Bill (DPDP), 2022 released on November 18, 2022 is focused on personal data, as compared to an earlier unwieldy draft. Based on the recommendations of the Justice Srikrishna Committee, the Data Protection Bill was formulated in 2018 and 2019. In 2021, the Personal Data Protection Bill, 2021 (PDP) that incorporated the recommendations of the Joint Parliamentary Committee on the PDP Bill, 2019 was introduced. However, citing the “extensive changes” that the JPC had made to the 2019 Bill, the government withdrew the bill.

The previous bill was inadequate on four levels:

• The extant framework is premised on privacy being a statutory right rather than a fundamental right and does not apply to the processing of personal data by the government;
• It has a limited understanding of the kinds of data to be protected;
• It places scant obligations on the data fiduciaries which, moreover, can be overridden by contract and;
• There are only minimal consequences for the data fiduciaries for the breach of these obligations.

The current legal framework for privacy enshrined in the (Information Technology Rules, 2011) is wholly inadequate to combat harm to data principals, especially since the right to informational privacy has been upheld as a fundamental right by the Supreme Court (S. Puttaswamy vs. Union of India, 2017).

Key features of the New Bill:

1. Regarding Data protection principles: The current draft removes explicit reference to certain data protection principles such as collection limitation. This would allow a data fiduciary to collect any personal data consented to by the data principal.
2. Concept of ‘Deemed consent’: The DPDP Bill, 2022 also introduces the concept of “deemed consent”. It bundles purposes of processing that were either exempt from consent-based processing or were considered “reasonable purposes” for which personal data processing could be undertaken on the ground of “deemed consent”.
3. Fines and Penalties: 

For breach of Law; According to the new bill, Companies dealing with the personal data of consumers that fail to take reasonable safeguards to prevent data breaches could end up facing penalties as high as around Rs.200 crore. Under the previous bill, the penalty proposed on a company for violation of the law was 15 crores or 4 percent of its annual turnover, whichever is higher.

For intimidating: Penalties are expected to vary based on the nature of non-compliance by data fiduciaries - entities that handle and process the personal data of individuals. Companies failing to notify people impacted by a data breach could be fined around Rs.150 crore, and those failing to safeguard children’s data could be fined close to Rs.100 crore.

4. Administration body: The Data Protection Board, an adjudicating body proposed to enforce the provisions of the Bill, is likely to be empowered to impose the fine after giving the companies an opportunity of being heard.
5. Scope of Data being protected: The new Bill will only deal with safeguards around personal data and is learned to have excluded non-personal data from its ambit. Non-personal data essentially means any data that cannot reveal an individual's identity.

Concerns associated:

1. The new bill does not consider the concept of “sensitive personal data”. This includes biometric data, health data, genetic data, etc.
2. This personal data is afforded a higher degree of protection in terms of requiring explicit consent before processing and mandatory data protection impact assessments.
3. The DPDP Bill, 2022 seems to suppose that a notice is only to be provided to take consent of the data principal. This is a limited understanding of the purpose of the notice.
4. A notice is also important for the data principal to exercise data protection rights such as the right to know what personal data is being processed by whom, whether that data needs correction or updating, and also to request deletion of data that may not be relevant for processing.

Way forward:

1. Data protection laws need to ensure that the compliances for data fiduciaries are not so onerous as to make even legitimate processing impractical.
2. The challenge lies in finding an adequate balance between the right to privacy of data principles and reasonable exceptions, especially where government processing of personal data is concerned. 
3. With technological evolutions, an optimum data protection law design needs to be future-proof — it should not be unduly detailed and centered on providing solutions to contemporary concerns while ignoring problems that may emerge going forward.
4. The law needs to be designed for a framework of rights and remedies that is readily exercisable by data principals given their unequal bargaining power concerning data fiduciaries.

Question #2. “Competition Law needs to have necessary provisions to achieve the desired result to examine and adjudicate upon anticompetitive practices. Examine and evaluate this statement in the light of the Competition Act, 2002.

Ans. The Competition Act, 2002 was enacted to promote and sustain competition in markets, protect the interest of consumers, and ensure freedom of trade for market participants. It established the Competition Commission of India (CCI) to eliminate practices having adverse effect on market competition.  Under the Act, enterprises are not allowed to enter into anti-competitive agreements which can cause an appreciable adverse effect on competition in India or abuse their dominant position.  Persons and enterprises are also not allowed to enter into a combination which causes or is likely to cause an appreciable adverse effect on competition within the relevant market in India. Since the Competition Act came into force, Indian markets have grown significantly. There has also been changes in the way businesses operate with the emergence of digital internet based companies and new age markets involving technology.  In 2018, the Ministry of Corporate Affairs constituted the Competition Law Review Committee to ensure that the Competition Act is in line with India’s economic fundamentals. In its deliberations, the Committee noted that certain market practices are not adequately covered by the current regulatory framework. There is a demanding requirement of are several amendments to the Act and changes in the regulatory structure dealing with matters of market competition.

Key Issues and solutions thereof:

1. Evaluating deal value for regulation of combinations:  The Act prohibits any person or enterprise from entering into a combination which may cause an appreciable adverse effect on competition.  Combinations imply mergers, acquisitions, or amalgamation of enterprises. The prohibition applies to transactions where parties involved have: (i) cumulative assets of more than Rs 1,000 crore, or (ii) cumulative turnover of more than Rs 3,000 crore, subject to certain other conditions. The is a requirement of expanding the definition of combinations to include transactions with a value above Rs 2,000 crore. Value of transaction should include every valuable consideration, whether direct, indirect, or deferred for any acquisition, merger, or amalgamation.

Also, acquisitions in the digital markets are valued based on data or certain business innovation of the company being acquired (target).  In such transactions, the target may not have a large asset base and may be in a line of business where products/services are given free or generate insignificant revenue. For instance, Facebook acquired the messaging platform WhatsApp in 2014 for approximately USD 19 billion. Between January to June in 2014, WhatsApp’s revenue was USD 15 million and it reported a net loss of USD 233 million. While such transactions may have an impact on market competition, the CCI currently lacks the legal framework to evaluate them if they do not meet the stipulated criteria based on assets or turnover.  

Certain countries have relied on evaluating the deal value of such transactions in order to assess their impact on market competition.  In the US, premerger notifications have to be filed if a transaction is valued over USD 200 million and does not attract any exemptions. For transactions valued between USD 50 million and USD 200 million, premerger notifications have to be filed if it meets certain other thresholds.  According to the Austrian Federal Cartel Act, 2005, if the value of a merger transaction is greater than 200 million euro, it has to be notified to the Federal Competition Authority. Under the German competition law, there is a deal value threshold of 400 million euro for regulation of acquisitions, subject to certain other criteria.

The Competition Law Review Committee (2019) had recommended the inclusion of a deal value threshold for merger notification under the Competition Act, 2002. The Standing Committee on Commerce (2022) had observed that widening the ambit of merger scrutiny was needed to prohibit e-marketplace companies from engaging in anti-competitive transactions.

2. Definition of control for classification of combinations: For classification of combinations, the Act defines control as control over the affairs or management by one or more enterprises over another enterprise or group.  This definition of control should be amended to include any entity or person having the ability to exercise material influence over the management, affairs, or strategic commercial decisions at par with other commercial laws.

3. Time limit for approval of combinations: The Act requires the CCI to pass an order on an application for approval of combinations within 210 days.  This should be reduced to 100 - 150 days to make this act more meaningful.

4. Anti-competitive agreements definition: Under the Act, anti-competitive agreements include any agreement related to production, supply, storage, or control of goods or services, which can cause an appreciable adverse effect on competition in India.  Any agreement between enterprises or persons, engaged in identical or similar businesses, will have such adverse effect on competition if it meets certain criteria.   These include: (i) directly or indirectly determining purchase or sale prices, (ii) controlling production, supply, markets, or provision of services, or (iii) directly or indirectly leading to collusive bidding.  It should cover under its ambit the enterprises or persons not engaged in identical or similar businesses shall be presumed to be part of such agreements, if they actively participate in the furtherance of such agreements.

5. Settlement and Commitment in anti-competitive proceedings: Under the Act, CCI may initiate proceedings against enterprises on grounds of: (i) entering into anti-competitive agreements, or (ii) abuse of dominant position.  Abuse of dominant position includes: (i) discriminatory conditions in the purchase or sale of goods or services, (ii) restricting production of goods or services, or (iii) indulging in practices leading to the denial of market access.  In this regard CCI should be permitted to close inquiry proceedings if the enterprise offers: (i) settlement (may involve payment), or (ii) commitments (may be structural or behavioural in nature).  The manner and implementation of the framework of settlement and commitment may be specified by CCI through regulations. 

6. Decriminalisation of certain offences: It is demanded that the nature of punishment for certain offences from imposition of fine to penalty.  These offences include failure to comply with orders of CCI and directions of Director General with regard to anti-competitive agreements and abuse of dominant position.

7. Need For New Market Definition: India’s Commission needs to update its definition of market now. Since there are no boundaries in the digital space, defining relevant markets has been a tough task for regulators around the globe.

8. Hub-and-Spoke Cartels: A Hub-and-Spoke arrangement is a kind of cartelization in which vertically related players act as a hub and place horizontal restrictions on suppliers or retailers. At present, the prohibition on anti-competitive agreements only covers entities with similar trades that engage in anti-competitive practices. This ignores hub-and-spoke cartels operated at different levels of the vertical chain by distributors and suppliers.

9. Gun Jumping: It happens when the two or more combining parties close a notified transaction before the approval or have consummated a reportable transaction without bringing it to the Commission’s knowledge. The penalty for gun jumping is total of 1% of the asset or turnover which should be applicable @ 1% of the deal value making it more rational.