Personal data misuse: Exemptions to startups only for making compliance easier, says Ashwini Vaishnaw

Minister for Electronics and Information Technology Ashwini Vaishnaw in the Rajya Sabha on August 9

While allaying concerns of possible misuse of personal data by startups, Minister for Electronics and Information Technology Ashwini Vaishnaw on August 9 said that exemptions, if given to such platforms, will only be limited to making compliance with the Digital Personal Data Protection Bill easier.

Vaishnaw was speaking in the Parliament before the DPDP Bill was passed by the Rajya Sabha on August 9. The bill will be enacted into law after it receives the President's assent.

Also read: Explained: What the Digital Personal Data Protection Bill means for you

A copy of the bill which was passed by the Lok Sabha on August 3 says that the Central government can notify exemptions to a certain class of data fiduciaries including startups.

These exemptions include that of giving notice to a user detailing the type of personal data the platform can process; the purpose for which the data can be processed and so on.

A platform can also be exempted from ensuring "completeness, accuracy and consistency" if it is processing personal data that can affect a user and also if that data is being disclosed to another data fiduciary.

While discussing the DPDP Bill in the Rajya Sabha, Biju Janata Dal's Amar Patnaik said, "Carve-out (exemption) can be given to them (startups) to reduce compliance costs. It may not be given from maintaining integrity or completeness of the data."

Yuvajana Sramika Rythu Congress Party MP S Niranjan Reddy said, "Exemption provision to class of data fiduciaries or startups should not be misused, because a potential Big data aggregator could set up, what we call, a data mining startup."

"The only purpose of that startup will be to call itself startup, it will mine data if exemptions are granted to startups and use that data for channelling it for some other purposes," Reddy opined.

In response, Vaishnaw said, "The carve-out is only on compliance. The carve-out is not on violation of basic principles."

He explained that the exemption will be useful in creating a regulatory sandbox which can be used by platforms to develop a product. "...once the the regulatory sandbox is used for proving the product then the entire law can apply," he added.