With the Digital Personal Data Protection (DPDP) bill set to become a law soon, software and tech industry is seeking more clarity from the Ministry of Electronics and Information Technology (Meity) on how sectoral laws such as on competition, payments and so on would intersect with the data protection law.
The DPDP Bill was passed by both Houses of Parliament, and will become a law after President Draupadi Murmu gives her assent.
Also read: Explained: What the Digital Personal Data Protection Bill means for you
There are provisions of the bill that currently underline how the DPDP Bill may interact with other sectoral laws. But the lack of clarity on how this intersection would play out, has intensified uncertainty within the software and tech industry.
Specifically when it comes to cross border data transfer, the bill says that if another law provides higher degree of protection than the DPDP Bill, then the sectoral law would be applicable.
So for example, currently, payments or financial data comes under strict data localisation norms mandated by the Reserve Bank of India. Industry is seeking clarification on whether the RBI's laws will prevail over the DPDP Bill which allows cross border data transfer.
"In general overlapping laws exacerbate uncertainty. We would like a little more clarity on how intersection between sectoral laws and DPDP will play out. It would be better to have an overarching law and guidance from the central ministry like MeitY, so that other ministries can work together with MeitY on this issue," Venkatesh Krishnamoorthy, country manager of The Software Alliance (BSA) told Moneycontrol.
The Software Alliance's members include Microsoft, Adobe, Amazon Web Services, Atlassian, Autodesk, Cloudflare, Cisco, Dropbox, IBM, Nikon, Oracle, SAP, Salesforce, Siemens and Zoom.
Anisha Chand, partner at Khaitan and Co, said, "Technology laws have to interact with other. They cannot be seen in isolation. While it is good to have boundaries, there will be situations where the boundaries will blur. We should provide for a mechanism where multiple laws can interact with each other holistically."
Competition and DPDP Bill
On competition issues, experts are divided whether would be a jurisdictional 'overlap' between the proposed Data Protection Board (under the DPDP Bill) and the Competition Commission of India. However, there is a consensus that DPB will interact with the CCI on various common issues, industry experts and lawyers opined.
The DPB will be established to take action in response to personal data breaches, investigate user complaints and also impose penalties.
Similarly, in the past, CCI has taken up cases that intersect with privacy and competition issues, such as the WhatsApp-Meta privacy policy case.
"We could see situation where DPB and CCI may work together on similar cases which have complex data issues, or where a breach in privacy can amount to an abuse of dominant position," Khaitan and Co's Chand, who works on competition issues, said.
Public policy think thank The Dialogue urged for mechanisms to be established to resolve any potential jurisdictional conflcits between DPB and CCI.
"In the past, the Commission has analysed subjects pertaining to data privacy, and the same has led to discussions over its jurisdiction on the issue. With the establishment of the Board, it will be imperative that mechanisms to resolve potential jurisdictional conflicts are established to bring certainty and consistency," Saksham Malik, Programme Manager, The Dialogue said.
"A mechanism for the same was established under a previous iteration of the Bill, which recommended MoUs and consultations between authorities. However, the same has been done away in the latest draft," he added.
Discover the latest Business News, Sensex, and Nifty updates. Obtain Personal Finance insights, tax queries, and expert opinions on Moneycontrol or download the Moneycontrol App to stay updated!
