Others

Surveillance vs Privacy – The Act During The COVID Pandemic

Over 3 billion pieces of data were leaked, admitted Yahoo! in 2016. At the time, it was ranked as the largest data breach in history. This incident followed by data breaches by Facebook, LinkedIn, and MySpace, to name a few, lead us to a larger question – whether technological advancement and privacy can be allies?

The ongoing COVID-19 pandemic has engulfed over 100 countries, with over 20,000 infections and 650 deaths in India, and the government in its efforts to contain the pandemic has placed reliance on technology. So in times such as now, an appropriate adaptation would be – Roti, Kapda, Makaan our Privacy.

The Ministry of Electronics and Information Technology recently launched the ‘Aarogya Setu’ App – meant for contact tracing and information dissemination – which is designed to trace, notify, and provide medical support to those who have come in contact with COVID-19 patients.

However, the App has been heavily criticized for its non-compliance with data protection policies, accountability, and transparency, all of which are essential for privacy protection.

Another major setback is that the App is beneficial contingent on a few conditions – many people have the app installed, have the app running, with Bluetooth, and are location-enabled. But in a country where smartphones are a luxury, meeting the aforesaid prerequisites may be unviable leading to questions about the App’s effectiveness.

Further, experts believe that ratcheting up surveillance and population tracking to fight the virus now, could permanently open the doors to more invasive forms of prying later. More likely than not, the government and law enforcement agencies may have access to sophisticated surveillance mechanisms such as geo-location tagging, and facial and biometric recognition, much after the dust over the pandemic settles.

This data may be exploited and repurposed to further political agendas like communalism, anti-immigration policies, etc. Further, increased surveillance and divulgence of data have disintegrated people’s ability to keep their health status private. In the present scenario, Indians have little recourse to challenge digital exercises of sovereign power.

Presently, the Information Technology Act, 2000 and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 govern India’s data protection regime. However, these legislations fail to protect individual interests in today’s time.

Geo-location tracking and facial recognition apps could invariably violate the right to privacy, but there is no legal framework that regulates or enables the use of such technologies without violating the Fundamental Right to Privacy granted under Article 21 of the Constitution.

Even the Personal Data Protection Bill, 2019 which is likely to be approved by the Parliament in the Monsoon session of 2020 fails to take into account all stakeholders involved in data breaches. For instance, the Bill imposes heavy fines up to Rs 15 crores or 4% of the annual turnover for violations but exempts the ‘consent’ requirement in certain circumstances where – data is required by the State, for legal proceedings, or to respond to a medical emergency.

These regulatory changes, though onerous to many, are almost a natural and necessary trajectory considering India’s growing digital footprint in the world and the enormous amounts of sensitive information they leave at the State’s disposal, with or without consent!

Therefore, given a choice between public health and safety versus privacy in times of a pandemic, we have an obvious answer. This, however, is an oversimplification of the problem and the real challenge lies in balancing the health of many vis-a-vis the privacy of a few. In fact, China is tracking people through their smartphones and classifies each person with a color code — red, yellow, or green — indicating contagion risk.

On the other hand, Israel resorted to surveillance tools used to counter-terrorism to monitor its people and contain the virus. Further, countries like South Korea, Italy, and Singapore are also using a contact-tracing smartphone app to track infected people and Singapore goes a step further by posting information about each coronavirus patient online with details, including relationships with other patients and infected locations.

In the battle to contain the coronavirus, countries including India have implemented several technologies meant to trace, notify, and identify potentially infected persons. However, the deployment of digital surveillance tools poses a serious threat to the balance between public health and individual privacy on a worldwide large scale.

Despite the setbacks of collating facial recognition, biometric data, and geo-location tagging, these surveillance tolls have been beneficial in the containment of the virus.

While the present deluge of surveillance may be a necessary evil to curb COVID-19, unabated tracking of citizens to curb the virus is a disproportionate act of violation of privacy and may usher in an era of unprecedented privacy violations by companies and the government alike. Thus, strengthening India’s data protection regime and making the government accountable for data breaches may give more confidence to users and keep privacy concerns at bay.

Over 3 billion pieces of data were leaked, admitted Yahoo! in 2016. At the time, it was ranked as the largest data breach in history. This incident followed by data breaches by Facebook, LinkedIn, and MySpace, to name a few, lead us to a larger question – whether technological advancement and privacy can be allies?

The ongoing COVID-19 pandemic has engulfed over 100 countries, with over 20,000 infections and 650 deaths in India, and the government in its efforts to contain the pandemic has placed reliance on technology. So in times such as now, an appropriate adaptation would be – Roti, Kapda, Makaan our Privacy.

The Ministry of Electronics and Information Technology recently launched the ‘Aarogya Setu’ App – meant for contact tracing and information dissemination – which is designed to trace, notify, and provide medical support to those who have come in contact with COVID-19 patients.

However, the App has been heavily criticized for its non-compliance with data protection policies, accountability, and transparency, all of which are essential for privacy protection. Another major setback is that the App is beneficial contingent on a few conditions – many people have the app installed, have the app running, with Bluetooth, and are location-enabled.

But in a country where smartphones are a luxury, meeting the aforesaid prerequisites may be unviable leading to questions about the App’s effectiveness.

Further, experts believe that ratcheting up surveillance and population tracking to fight the virus now, could permanently open the doors to more invasive forms of prying later. More likely than not, the government and law enforcement agencies may have access to sophisticated surveillance mechanisms such as geo-location tagging, and facial and biometric recognition, much after the dust over the pandemic settles.

This data may be exploited and repurposed to further political agendas like communalism, anti-immigration policies, etc. Further, increased surveillance and divulgence of data have disintegrated people’s ability to keep their health status private. In the present scenario, Indians have little recourse to challenge digital exercises of sovereign power.

Presently, the Information Technology Act, 2000 and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 govern India’s data protection regime. However, these legislations fail to protect individual interests in today’s time.

Geo-location tracking and facial recognition apps could invariably violate the right to privacy, but there is no legal framework that regulates or enables the use of such technologies without violating the Fundamental Right to Privacy granted under Article 21 of the Constitution.

Even the Personal Data Protection Bill, 2019 which is likely to be approved by the Parliament in the Monsoon session of 2020 fails to take into account all stakeholders involved in data breaches. For instance, the Bill imposes heavy fines up to Rs 15 crores or 4% of the annual turnover for violations but exempts the ‘consent’ requirement in certain circumstances where – data is required by the State, for legal proceedings, or to respond to a medical emergency.

These regulatory changes, though onerous to many, are almost a natural and necessary trajectory considering India’s growing digital footprint in the world and the enormous amounts of sensitive information they leave at the State’s disposal, with or without consent!

Therefore, given a choice between public health and safety versus privacy in times of a pandemic, we have an obvious answer. This, however, is an oversimplification of the problem and the real challenge lies in balancing the health of many vis-a-vis the privacy of a few. In fact, China is tracking people through their smartphones and classifies each person with a color code — red, yellow, or green — indicating contagion risk.

On the other hand, Israel resorted to surveillance tools used to counter-terrorism to monitor its people and contain the virus. Further, countries like South Korea, Italy, and Singapore are also using contact-tracing smartphone apps to track infected people and Singapore goes a step further by posting information about each coronavirus patient online with details, including relationships with other patients and infected locations.

In the battle to contain the coronavirus, countries including India have implemented several technologies meant to trace, notify, and identify potentially infected persons. However, the deployment of digital surveillance tools poses a serious threat to the balance between public health and individual privacy on a worldwide large scale.

Despite the setbacks of collating facial recognition, biometric data, and geo-location tagging, these surveillance tolls have been beneficial in the containment of the virus.

While the present deluge of surveillance may be a necessary evil to curb COVID-19, unabated tracking of citizens to curb the virus is a disproportionate act of violation of privacy and may usher in an era of unprecedented privacy violations by companies and the government alike.

Thus, strengthening India’s data protection regime and making the government accountable for data breaches may give more confidence to users and keep privacy concerns at bay.

---

Tags: electronic surveillance act, arogya sethu, arogya setu, Surveillance vs Privacy, surveillance act, aarogya setu, arogya setu app

Competition or Unlawful Contractual Interference

The formalization and maturation of the nation’s business ecosystem have led to a competitive environment ripe for conflict. With growing competition between multinational companies, the tendency of organizations to indulge in anti-competitive practices amounting to Tortious Interference has increased manifold. Thus, the judiciary is swamped with causes of action for interference with contract or business relations.

In light of an adversarial legal system and predatory business environment, the promulgation of a robust and comprehensive law relating to economic torts becomes essential, especially one that recognizes that contractual obligations are sacrosanct and cannot be skewed to a party’s advantage.

The premise of capitalism of free, fair competition without interference from excessive government regulations vis-à-vis courts’ power to enforce contracts and protect against wrongful predatory conduct may be considered as crossing the line into Tortious Interference with another’s contract. Moreover, the court’s inability to establish a coherent, uniform body of law concerning interference claims indicates that the issue may continue to persist and haunt businesses for long.

In recent years much commercial litigation has involved claims for Tortious Interference with contractual or other business relations. In a recent decision of Inox Leisure Limited vs. PVR Limited, the Delhi High Court further blurred the demarcation between freedom to trade and unlawful contractual interference, as the judgment placed a restraint on the freedom to trade if the person causes a breach or interferes with contractual performance.

Unfortunately, the law in India pertaining to the tort of interference with contractual relations has not particularly evolved with few cases to demonstrate the Indian courts’ view on this aspect. Moreover, this question has not been placed before the Supreme Court to date. With orders passed on the aspect of Tortious Interference, the issues are very fact-based and do not provide an adequate overview of jurisprudence on Tortious Interference, as did the ruling in Inox Leisure Limited vs. PVR Limited.

In theory, all contracts qualify for protection from unreasonable interference. In recent times, non-competition contracts are a recurrent source of litigation in this area of law. The employer in these contracts requires an employee to sign an agreement prohibiting the employee from working for a competitor in the same geographic market.

The judiciary has encouraged free trade and the absence of impediment in performing any business activity throughout the country under Section 27 of the Contract Act. 

Taking a similar viewpoint, the court in Modicare Limited Vs. Gautam Bali held that Section 27 of the Contract Act makes every agreement by which anyone is restrained from exercising a lawful profession, trade, or business of any kind – unenforceable.

Thus, even if the defendants or any of them, under their agreement with the plaintiff, had undertaken not to carry on or be involved in any capacity in any business competing with the business of the plaintiff, even after leaving employment with/association of the plaintiff.

The said agreement, owing to Section 27 would be void and unenforceable and the plaintiff on the basis thereof could not have restrained any of the defendants from carrying on any business or vocation, even if the one which the defendant had agreed not to carry on.

Therefore, as observed from past rulings, it’s no surprise that courts are reluctant to provide an injunction that places a cap on doing a business activity or to approach the client of a competitor company as in many cases it deprives an employee of meaningfully pursuing a livelihood.

This decision clears the way for businesses to enter into such agreements so long as the restraints promote competition and do not violate the rule of reason. Given the vague and ambiguous standards, it remains to be seen how courts will apply the interplay of Section 27 of the Contract Act and Article 19(1)(g) of the Constitution to address the multitude of possible business-to-business agreements and their effects on free-market competition.

Ultimately, the door is seemingly wide open for varied commercial collaborations with accompanying restraints on trade, which no doubt will require greater scrutiny on their economic justification to balance against worker mobility and competitiveness.

---

Tags: inducing breach of contract, wrongful interference with a contractual relationship, intentional interference with economic relations, contractual interference, interference with business relations, intentional interference with contract, interference with contractual relations, intentional interference with contractual relations

Fintech In India: An Analysis Of Current Legislation

Most would agree that since the advent of technology, human life has undergone considerable changes that may be perceived as nothing short of magic. We started with the barter system but recently we have transitioned from a cash-dependant country to a country where citizens have moved online for gold, savings, gift cards, loans, investments, etc.

This change can be attributed to the confluence of finance and technology, also known as ‘fintech’. The term is used to describe new technology that seeks to improve and automate the delivery and use of financial services. Fintech innovations have touched upon several areas including – cryptocurrencies, blockchain technology, smart contracts, open banking, cybersecurity, and Robo-advisors, to name a few.

This change can be attributed to the confluence of finance and technology, also known as ‘fintech’. The term is used to describe new technology that seeks to improve and automate the delivery and use of financial services. Fintech innovations have touched upon several areas including – cryptocurrencies, blockchain technology, smart contracts, open banking, cybersecurity, and Robo-advisors, to name a few.

Issues Surrounding Fintech

The innovative products are only the tip of the iceberg. Numerous complexities in the legal perspective crop up under the surface. Thus, the right balance should be maintained between encouraging emerging technological advancements and the need to administer them accordingly.

Cybersecurity And Data Protection

Fintech companies process large chunks of data, analyze the market demands, and customize their offerings accordingly. Hence, companies have to adhere to data protection and cyberspace laws.

Distributed Ledger Technology (DLT) and Smart Contracts

The DLT is regarded as the shared data by the users that have been circulated on various online sites and institutions which are not being administered. For instance, a contract that has been entered into by both parties through digital means may not be imposed in all jurisdictions. Here, the legal scenario will be ambiguous and unclear.

Robo-Advisors And Legal Responsibility

Robo-advisors are digital platforms that provide automated, algorithm-driven financial planning services with little to no human intervention like Aditya Birla Money’s MyUniverse, Fundsindia, and Goalwise. However, in cases where a party acts upon the opinion of a Robo-advisor and suffers an adverse outcome, who is likely to be held liable for unsound investment advice? The robot, the developer, or the financial architect?

Although there are no separate regulations for Robo-advisors, a consultation paper issued by SEBI states that under the current Investment Advisor regulations, there is no express prohibition for use of automated advice tools by SEBI registered investment advisors.

Outsourcing Core Banking System To The Public Cloud

Negotiations between a financial institution and an outsourcer should submit to absolute requirements to ensure more transparency and stricter standards for data protection and penalties thereof.

Biometric Authentication Using Fingerprint Recognition

The authentication of biometrics can give rise to security concerns although collected with customer consent from the objects that they touch every day. They are subjected to being counterfeited by unauthorized third parties for illegal and malicious purposes.

Legislation In India

The rise of innovation necessitates the need for regulation. Realizing this, the Payments and Settlement Systems Act, 2007 (PSS Act) was promulgated which provides for the regulation and supervision of financial transactions in India.

Under the PSS Act, 2007, two Regulations have been made by the RBI, namely, the Board for Regulation and Supervision of Payment and Settlement Systems Regulations, 2008 (BPSS Regulations) and the Payment and Settlement Systems Regulations, 2008 (‘PPS Regulations, 2008’).

The BPSS is empowered for authorizing, prescribing policies, and setting standards for regulating and supervising all the payment and settlement systems in the country and exercises its powers on behalf of the RBI under the PSS Act, 2007.

Further, the PPS Regulations, 2008 lays down the procedural requirements for commencing or carrying on a payment system.  It covers matters like the form of application for authorization for commencing/ carrying on a payment system and grant of authorization, payment instructions, and determination of standards of payment systems.

In furtherance of the same, RBI and SEBI have set up the Working Group on Fintech and Digital Banking and the Committee on Financial and Regulatory Technologies respectively with the task of assessing the opportunities, risks and challenges presented by the rapid growth of fintech in India.

Recent Suggestions By Steering Committee

The Steering Committee on Fintech Related Issues set up by the Ministry of Finance, recently issued its report, in which it takes stock of developments in the fintech space, globally and in India. It makes 45 recommendations to enable fintech, particularly in critical sectors of the economy, and to promote ‘ease of doing business’ in India.

Its focus areas include removing the disparity between the bank and non-bank players, supporting Micro, Small and Medium Enterprises (MSME) and the agricultural sector to promote financial inclusion, supporting the role of data in lending and enabling digitization of key processes.

KYC Reforms

The Supreme Court, in its recent ruling, held that Aadhar can no longer be used for purposes of electronic authentication by fintech companies for KYC purposes. The Committee first recommends exploring alternative KYC models, such as e-Sign, non-face-to-face boarding, use of documents in the Digi Locker, and video-based KYC.

In order to further reduce costs, the Committee also suggests enabling the Central KYC (‘C-KYC’) registry to take off, such as via keeping upload of KYC data free and download chargeable based on the user pays principle, and by naming a deadline for making the C-KYC registry operational.

Open Banking

A large focus of the report is to enable open, real-time, and equal access to data. The Committee thus suggests that open and equal access APIs of relevant datasets be created, such that fintech solutions can be built using them. Data here must be anonymized or included with consent.

An interesting recommendation which borrows from the European concept of open banking is that financial sector regulators study the potential of open data access, to enable better competition in financial services.

The Committee recommends that open banking commences with, for example, opening up rejected credit applications (referral pools) with banks, available on a consent-basis to a neutral marketplace of alternate lenders. Similarly, it suggests that the RBI opens up bank data available to fintech firms this way.

Dematerialisation Of Financial Instruments

To give fintech a boost, it also suggests that regulatory changes be introduced to dematerialize financial instruments, such as those for fixed deposits, small savings certificates, sovereign gold bonds, and so on.

Similarly, it suggests that amendments be introduced to allow paperless legal alternatives for all legal processes having a bearing on financial services, such as permitting alternatives to wet signatures, digital alternatives for power-of-attorneys, wills, cheques, etc.

Inter-Regulatory Coordination On Fintech

The Committee recommends that in addition to the creation of a regulatory sandbox by each regulator, there is a need for inter-regulatory coordination to support hybrid financial products and common distribution, where licensing or regulatory requirements of more than one regulator may have to be complied with, development of common standards on RegTech and SupTech, consumer protection measures, sandboxes, etc.

Regulatory Overhauls To Support Innovative Business Models

As hybrid models emerge, traditional regulations and divides of regulatory authority need a relook. Therefore, SEBI is in the process of implementing two sandboxes under the guidance of the Committee on Financial and Regulatory Technologies (CFRT):

• Regulatory sandbox for limited purpose testing of innovative fintech products and business models in a live test environment on real customers
• Industry sandbox where fintech firms can test their solutions isolated from the live market. The purpose of industry sandbox is to provide a collaborative space accessible to all the fintech participants including the regulators. SEBI envisages the Industry Sandbox Framework as a platform of shared knowledge and data developed, operated, and maintained by the industry wherein fintech firms can test their innovations before rolling out into the live market or approach regulatory sandbox.

Global Framework

Europe

AML Regulations are helpful in detecting and reporting suspicious activities and also for predicting offenses in money laundering and terrorist financing. Bank Payment obligations are a new payment method that is being developed based on data matching, for tackling the problems of risk mitigations and other financial payment obligations. It is an irrevocable initiative that has been undertaken which are conditioned to the rules by the International Chamber of Commerce.

Intraday Liquidity Standards have been introduced by the Basel Committee on Banking Supervision which monitors the data and ensures that they comply with the norms and regulations. P2P Lending Regulations have been designed with a regulatory framework for additional consumer protection.

This mainly deals with transparency and the availability of information in relation to customer protection. Electronic Identification and Trusted Services are a set of regulatory standards for electronic identification and for digital transactions in the European markets.

United Kingdom

There is no particular framework that governs FinTech firms in the UK. The regulation of such firms mainly depends on the nature of the activities that are being conducted by the firms, their nature, and the scale of the business.

The Financial Services and Markets Act, 2000 established the FCA and PRA as the main regulators of the UK for service businesses which provide them with statutory powers to generate rules under the Act. The rules in the FCA and PRA are technologically neutral, the increase in the number of FinTech firms have led to rising in more regulatory developments. It has greater clarity on the regulatory approach to crypto-assets and the second is in the forthcoming changes in the UK’s anti-money laundering regime.

United States of America

All fintech industries in the USA are not subject to a fintech-specific regulatory framework by any single federal or state regulator. Rather, it is based on the various activities undertaken by a fintech company that may be subject to laws and regulations at the federal and state level. The number and complexity of potentially applicable U.S. regulations to any single fintech firm have drawn some criticism as a potential barrier to entry and hindrance to the growth of U.S. fintech.

As regulators work to develop regulations that will govern that fintech space, the uncertainty behind the evolution of fintech regulations remains. Fintech companies have to undergo a rigorous and hold a heavy burden of undergoing licensing and registration with multiple state regulators, subjecting such fintech companies to regulation and supervision by the laws and regulations of each such regulator.

Conclusion

Berkshire Hathaway Inc. invested over $300 Mn for a 3-4% stake in Paytm along with other investors such as Softbank and Alibaba demonstrates the promise of the fintech industry at large. India is on the cusp of the fintech revolution, accelerated in part by the Government’s policy initiatives and development of the Indian Stack.

China Liability Under International Law

The COVID-19 pandemic has engulfed over 100 countries around the world and for the lack of a cure, governments have been compelled to largely depend on social vaccination measures, including lockdown, isolation, and social distancing. This flu-like virus, with origins in China’s Wuhan city, has caused tremendous distress in terms of the health, economic and social well-being of the international community.

Accountability: World economies are in shambles but when the dust settles, fingers will be pointed and responsibility strictly apportioned. Already China is being pushed against the wall by the global community and difficult questions are being asked of it regarding the origins of the virus and the delay in warning the world about it turning into a pandemic.

Predictably, the issue of China’s legal liability for the COVID-19 outbreak will be raised. The US has filed a $20 trillion lawsuit — an amount larger than China’s Gross Domestic Product (GDP) — against Chinese authorities to seek reparation for economic harm. Similar lawsuits have been filed in Germany and India against China claiming compensation for damages.

However, domestic laws are unsuited for this task because the principle of sovereign immunity prevents local courts from ruling on the acts of foreign governments. For the lack of enforceability, we must redirect our attention to supranational legal frameworks for remedies and solutions to this precarious inquiry.

International Health Regulations, 2005: After the spread of the Severe Acute Respiratory Syndrome (SARS) in 2003, the World Health Organisation (WHO) adopted an International Health Regulation (IHR) by making member countries accountable to counter such global pandemics. Article 6 mandates each member country to “notify the WHO, by the most efficient means of communication available, by way of the National IHR Focal Point, and within 24 hours of assessment of public health information.”

Further, Article 7 goes on to state that if a country “has evidence of an unexpected or unusual public health event within its territory, irrespective of origin or source, which may constitute a public health emergency of international concern, it shall provide to the WHO all relevant public health information.”

These regulations are further fortified by Articles 11 and 12 of the IHR which require the WHO to share such data, once verified, with other countries so that they can enact precautionary measures.

It is alleged that China not only failed on both counts but also censored, misled, and suppressed information, from the media and the WHO, about the Coronavirus and its effects. Moreover, China portrayed COVID-19 as a new form of pneumonia that could not be transferred from one human to another, which was later admitted by Chinese authorities as otherwise.

Collectively, these actions made it difficult for countries around the world to adequately prepare for this deadly virus, leading to colossal damages to the health and finances of nations. The destruction of virus strains in Wuhan University also raised suspicions regarding the COVID-19 being a man-made virus to be used as a biological weapon, currently put under experimentation in Wuhan Labs.

Keeping these accusations aside, it is important to note that it is not the first time China is the place of origin of an epidemic of a deadly disease. From the Asian flu and Hong Kong flu to the Swine flu, all had China as their epicenter.

In the case of SARS, China’s exotic wet market was on the radar but Beijing failed to impose restrictions on its billion-dollar industry, overlooking the threat of a repeated catastrophe. China flouted the rules, time, and again and for this, it must be held to account.

Jurisdictional issue: The final and probably the most vital piece in this puzzle is how might China be brought before an international court for its unlawful actions?

The major lacuna is the jurisdiction of the International Court of Justice (ICJ). Cases are referred to the ICJ once consensus between disputing parties has been established and taking into account past records, China has been resistant to authority and may continue on the path of resistance.

An unconventional way of circumventing the jurisdictional issue would be to invoke the provision that empowers an organization to refer disputes to the ICJ. Article 75 of WHO’s Constitution gives the organization the right to refer matters to the ICJ for advisory purposes.

China’s failure to disclose information and disseminate data about the Coronavirus during its preliminary stages, coupled with its wilful negligence in regulating wildlife trade, invariably triggers a breach of the treaty. Though experimental and untested, this route offers a glimmer of hope for invoking the jurisdiction of the ICJ to assess Chinese liability and hold that nation accountable for losses caused to the international community at large.

While the ICJ’s opinion is not directly enforceable, they do provide an authoritative assessment of legal liability around which governments can synchronize their political response by way of seizure of Chinese assets or imposing trade sanctions. China, being Asia’s largest economy, holds an influential place in world politics today.

This, however, shall not be construed as a means to assume absolute power and continue flouting rules of the IHR issued by the WHO.

Measures available to the affected countries are by no means simple. Each requires considerable international collaboration, cooperation, and resolve to implement, particularly considering China’s towering economic influence.

It is evident that China is the originator of the pandemic but it will be an onerous task to classify its action and response as advertent, willful, or a case of gross negligence in its greed to push a lucrative, yet hazardous billion-dollar industry.

---

Tags: south china sea international law, private international law, international human rights law, public international law, international bar association, international trade law, international business law

Right to Burial: Let’s Not Deny The Right to a Decent Burial

At a time when India cheers in unison lauding the efforts of medical professionals, a doctor, who succumbed to coronavirus in Chennai, in Tamil Nadu, was denied his right to a decent burial earmarked for that purpose. In this scenario, we ask: Is clapping hands enough?

The COVID-19 pandemic has not only presented a health, safety, and financial crisis, but also a crisis of faith in the final journey of humans. The Right to Life is an extensive concept, which states that no person shall be deprived of his/her life or liberty or property, except according to the procedure established by law.

A first, the Supreme Court in the case of Kharak Singh, 1963 considered the expanse of Article 21 by hinting at the treatment of corpses in the following words – “it is every kind of deprivation that is hit by Article 21, whether such deprivation is permanent or temporary.”

Cementing this notion, the Madras High Court held that the fundamental right to life guaranteed under Article 21 includes the right to decent burial or cremation. Tamil Nadu went a step ahead by the issuance of an ordinance imposing a three-year jail term on anyone found in violation of the same.

Similar incidents cropped up in Meghalaya and the high court directed the state government to sensitize the public, especially where the burial or cremation grounds are situated, to avoid any further unfortunate incidents. Our judiciary, on several occasions, stood for the right to burial with ‘dignity’ and further clarified that a corpse must be treated with the same dignity as a living being. Moreover, the corpse must be buried according to his/her culture and tradition.

Despite the subsisting right, people dying on account of the pandemic have been denied their fundamental rights with the impending fears that the virus may spread through the burial or cremation of the corpse. Realizing this, the Ministry Of Health and Family Welfare issued guidelines on dead body management to safeguard the right of a human corpse, which are in line with guidelines issued by the World Health Organization (WHO).

The guidelines also permit relatives of the deceased to see the body, albeit subject to adherence to infection prevention control practices, which include a total restrain on physical contact with the dead body.

The right to a dignified burial has raised controversies the world over. Recently, Sri Lanka mandated the cremation of dead bodies of COVID-19 patients or suspects; however, this has been resented by the Muslims, who, by custom, follow the burial method. In response to such protests, the government cited the deadly nature of the virus to override religious customs for dead body management.

Moreover, the United Kingdom introduced the Coronavirus Act 2020 permitting the local authority to disregard Section 46(3) of the Public Health (Control and Disease) Act, 1984, which aimed to preclude local authority from being able to cremate the body against the wishes of deceased overbearing his/her beliefs.

Countries the world over share the sentiment of public health and safety over adherence to religious rituals, which may potentially have dire consequences on the mortality and financial wellbeing of the economy at large.

Apart from a high number of positive cases and mortality rates, the COVID-19 outbreak has led to mass unemployment, stock market uncertainties, and hints at an impending economic gloom worldwide. The loss of loved ones can be disturbing, disconcerting, and difficult to process, particularly with so many unknowns at present.

State government orders overriding religious customs for dead bodies should in no way be deemed discriminatory but is a proportionate measure to curb infections and deaths under the pretext of the virus, while simultaneously ensuring public safety and economic wellbeing of India.

It is important to remember that this is temporary, and is the modus Vivendi to navigating the rough waters of COVID-19, individually but together.

---

Tags: financial crisis, savings and loan crisis, economic crisis, global economic crisis, right to burial, global financial crisis, asian financial crisis

Data Protection And Privacy In The Insurance Industry

The digital revolution in India has disrupted the business environment in all industries and the insurance industry is no exception. Digitization enhances efficiency and reduces the cost of transacting business however there remain several challenges to the adoption of emerging technologies such as disruption to the traditional insurance ecosystem, uncertain consumer adoption, return on investment, and data privacy and security.

Emerging technologies usually deal in customer data which can be used to drive insights related to historical health issues and behavioral patterns of customers. Increasing regulations related to customer personal data around the globe and in India will continue to pose additional challenges for insurers and insurance providers alike.

The Information Technology Act, 2000 (IT Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) set out the general framework with respect to data protection in India.

However, given the nature of the business of insurance companies and intermediaries, the Insurance Regulatory and Development Authority of India (IRDAI) has prescribed an additional framework for the protection of policyholder information and data, which is required to be followed in addition to the general framework under the IT Act.

Regulatory Framework Governing Insurance Companies 

The IRDAI has made it mandatory for all the insurance companies to ensure the protection and maintenance of confidentiality of all the information that they have collected. Below are some of the relevant data protection regulations applicable to insurance companies:

– IRDAI (Maintenance of Insurance Records) Regulations, 2015 – Pursuant to Regulation 3(3)(b), 3(9) insurers are required to ensure that:

• the system in which the policy and claim records are maintained has adequate security features; and
• the records pertaining to policies issued and claims made in India (including the records held in electronic form) are held in data centers located and maintained in India.

– IRDAI (Health Insurance Regulations), 2016 – Pursuant to Regulation 35(c) insurers, third party administrators (TPAs) and network providers (i.e., hospitals) are required to comply with data related matters as may be specified in guidelines prescribed by the IRDAI (if any).

– IRDAI (Protection of Policyholders’ Interests) Regulations, 2017 – Pursuant to Regulation 19(5) insurers are required to maintain total confidentiality of policyholder information unless it is legally necessary to disclose the same to statutory authorities.

– IRDAI (Outsourcing of Activities by Indian Insurers) Regulations, 2017 – Pursuant to Regulation 12 insurers are required to ensure that the:

• the outsourcing service provider has adequate security policies to protect the confidentiality and security of policyholder information;
• information and data parted to outsourcing service providers remain confidential; and
• customer data is retrieved with no further use of the same by the service provider once the outsourcing agreement is terminated.

Regulatory Framework Governing Intermediaries 

Intermediaries in the insurance sector such as – brokers, individual agents, corporate agents, third party administrators (TPAs), surveyors, loss assessors and web aggregators – serve as a bridge between customers and insurance companies, by facilitating the process for selection and purchase of insurance products and assisting in the servicing of policies and assessment of claims.

Therefore, intermediaries are also bearers of confidential information and thus are subject to obligations relating to data protection and preservation of confidentiality prescribed by the IRDAI.

Whilst each intermediary is subject to its own regulations and code of conduct as set out in the table herein, below, the provisions in relation to data protection of the policyholder are common for all intermediaries. Inter alia, they prescribe that insurance intermediaries –

• treat all information supplied to them by prospective clients as completely confidential to themselves and to the insurer(s) to which the business is being offered; and
• take appropriate steps to maintain the security of confidential documents in their possession, including by way of restricting access to such information, execution of confidentiality undertakings, etc.

While a similar regime has been prescribed for insurance surveyors and loss assessors, the extant regulations permit surveyors and loss assessors, as an exception, to disclose information pertaining to a client, employer or policyholder to any third party, only where necessary consent has been obtained from the interested party.

It is however clear that the surveyors and loss assessors are prohibited from using (or appearing to use) any confidential information to their personal advantage or to the advantage of a third party.

Specifically, in relation to TPAs, the IRDAI (Third Party Administrators – health services) Regulations, 2016 (TPA Regulations) requires the TPAs to not share the data and personal information of customers received by them for servicing insurance policies or claims.

A limited exception to this rule has been carved out for disclosure of confidential information to any court of law, tribunal, government, or the IRDAI in the event of any investigation being carried out (or proposed to be carried out) against the insurer, TPA or any other person or for any other reason.

The aforesaid exception is similar to the carve-out under Rule 6 of the SPDI Rules, which permits government agencies mandated under law to obtain information (including sensitive personal data or information) for specified purposes, without obtaining the prior permission of the provider of such information.

Insurance Regulatory Sandbox 

A ‘Regulatory Sandbox’ is a testing environment created by the relevant regulatory authority to provide market players with an opportunity to safely and securely execute and test their innovative products, services, business models, and delivery mechanisms, in an orderly manner, which aims at protecting the customers and at the same time safeguarding the interest of the stakeholders.

Shortly after the issuance of the RBI Regulatory Sandbox, on May 18, 2019, the IRDAI issued the “Draft Insurance Regulatory and Development Authority of India (Regulatory Sandbox) Regulations, 2019” (IRDAI Regulatory Sandbox).

The objective of the IRDAI Regulatory Sandbox is to create a balance between the orderly development of the insurance sector on one hand and protection of interests of policyholders on the other, while at the same time facilitating technological innovation by way of relaxing provisions of any existing regulations framed by the IRDAI, for a limited scope and limited duration.

On approval of an application, the IRDAI chair may relax the applicability of one or more provisions of any regulations, guidelines, or circulars requested in the application, subject to the conditions for approving the application or any other conditions in which the chair deems necessary.

Conclusion 

The underlying objective of the regulation is to encourage good data practices and retain customer trust in the insurance businesses. Instead of treating it as a mere compliance task, companies should welcome the newly introduced regulations as a great opportunity for them to win customer trust and gain competitive advantages.

 

---

Tags: data protection and privacy, data and privacy, data privacy, data security, data protection, data privacy act, personal data protection act, data protection act

A Data-Rich Economy’s Endeavor for Data Protection

Roti, Kapda, Makaan aur Privacy – is an appropriate adaptation in times where people are connected 24/7 through the web.

The prolonging allure of globalization followed by its societal, economic, and technological innovations has altered economies in the most unfathomable ways. A radical by-product of the globalization era is the World Wide Web, which transcends borders and connects individuals worldwide within seconds.

It has quickly become an essential part of daily lives but several countries are faltering to match up to the developments in the World Wide Web giving rise to data protection and privacy concerns. 

Privacy legislation in India 

Presently, the Information Technology Act 2000 and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 govern India’s data protection regime. However, these legislations fail to protect individual interests in today’s time. 

In realizing this, the Electronics and Information Technology Ministry of India tabled the “Personal Data Protection Bill, 2019″ (the Bill), which along the lines of the European Union’s General Data Protection Regulation (EU GDPR), the present hallmark of data protection regime in the world, with one noteworthy contrast being the necessity of data localization and stringent restrictions on the cross-border data transfer.

The Bill largely governs the processing of personal data by the Government, Indian companies, and foreign companies dealing with personal data of individuals in India.

The Bill recognizes three main types of information, namely: a) personal data, b) sensitive personal data, and c) critical personal data and further empowers the Data Principal – a natural person to whom the personal data relates – to obtain confirmation, correction, transferability, and restrictions on disclosure of their data by a fiduciary. 

At the heart of this Bill is – Consent, without which data fiduciaries would be barred from processing personal data of individuals.

However, the Bill exempts certain circumstances which include: (i) when data is required by the State for providing benefits to the individual, (ii) legal proceedings, (iii) to respond to a medical emergency, for which consent is not required. Moreover, the Bill provides for the establishment of a Data Protection Authority to protect the interests of individuals, prevent misuse of personal data, and ensure compliance with the Bill while penalizing violators. 

Potential Issues emanating from the Bill

Heavy fines amounting to Rs 15 crore or 4% of the annual turnover of the fiduciary are prescribed for violation of the proposed law. Certain offenses also attract imprisonment for up to three years in addition to hefty fines. Thus, the Bill may leave several small and medium enterprises starving for revenues in the event of failure to comply with the Bill in the light of said fines and probable lawsuits. 

The Bill obliquely compels enterprises to review their data protection and processing policies, along with IT infrastructure to ensure compliance with the requirements of the Bill, thereby leading to significant costs of doing business in India.

Furthermore, stringent cross-border transfer and data localization restraints may pose a great challenge for foreign investors having operations in India. Although the Bill is likely to cause an array of problems for the law enforcement agencies, its benefits far outweigh the momentary discomfort. 

Conclusion

In the government’s race to match up to the changing dynamics of the world, companies operating in India must gear up for the implementation of the Bill, which is likely to be approved by the Parliament in the Monsoon session of 2020.

These regulatory changes, though onerous to many, are almost a natural and necessary trajectory considering India’s growing digital footprint in the world and the enormous amounts of sensitive information they leave over the web, with or without consent!

The PDP Bill, although highly regulated, may face challenges during implementation as industry and the government tries to pave their way through voluminous data. In light of the aforesaid challenges, the government will be required to put in considerable time and resources to make this Bill turn into ground reality without any unintended consequences.

Therefore, although this data protection regime is a bold, positive policy, shoddy implementation of the policy may further grapple the economy offsetting the crucial advantages of the Bill at its outset.

 

---

Tags: technological innovations, disruptive technology, data protection, technological innovation, technology and innovation, technology inventions, computing innovations, technical innovation, data security