USTR Highlights Challenges in India's DPDP Act and IT Rules

Overview of the DPDP Act: The Digital Personal Data Protection (DPDP) Act is India’s primary legislation governing the collection, processing, and storage of personal data. It introduces key concepts such as data fiduciaries, consent-based data processing, purpose limitation, and accountability. The law aims to balance individual privacy rights with the need for data-driven innovation in the economy.

Impact on Credit Information Companies (CICs): CICs, such as credit bureaus, rely heavily on access to financial data to generate credit scores and reports. The absence of a “deemed consent” mechanism under the DPDP framework means that CICs may need explicit consent from individuals for each data-sharing instance. This could disrupt their traditional operations, where data flows seamlessly from financial institutions to credit bureaus.

Implications: For example, if a bank cannot automatically share borrower data with a CIC, the efficiency of credit assessment may decline. This could affect loan approvals, especially for individuals without extensive credit histories. While the Act strengthens privacy protections, it also raises concerns about operational feasibility and financial inclusion, particularly in a data-driven credit ecosystem.

Concerns Over Regulatory Burden: The USTR has highlighted that certain provisions of the DPDP Act and related rules impose potentially burdensome compliance requirements on data fiduciaries, including foreign firms. These include obligations related to data storage, processing, and disclosure to government authorities, which may increase operational costs and complexity for multinational companies.

Issues of Data Localisation and Cross-Border Transfers: Another major concern is India’s approach to data localisation and restrictions on cross-border data flows. The government retains the power to restrict data transfers to specific countries. Additionally, mandates such as the Reserve Bank of India’s requirement to store financial data locally are seen as barriers to global data integration, affecting fraud detection and network security.

Broader Trade Implications: From a trade perspective, these regulations may hinder the growth of the digital economy and reduce foreign investment. For instance, US-based credit bureaus or tech firms may find it difficult to operate efficiently under such constraints. Thus, the USTR views these measures as non-tariff barriers that could impact bilateral trade and services exports.

Understanding Data Localisation: Data localisation refers to policies that require data to be stored and processed within a country’s borders. While such measures are often justified on grounds of data sovereignty, privacy, and national security, they can have significant economic implications.

Impact on Businesses and Innovation: Restricting cross-border data flows can limit the ability of firms to leverage global data networks. For example, multinational financial institutions rely on integrated systems to detect fraud patterns across jurisdictions. Localisation mandates may fragment these systems, reducing efficiency and increasing costs.

Case Illustration: Consider a global payment company that uses centralized servers to monitor transactions. If required to store and process data locally in India, it may need to duplicate infrastructure, leading to higher operational costs. While this may benefit domestic data infrastructure, it could also discourage foreign investment. Thus, the challenge lies in balancing economic efficiency with regulatory sovereignty.

Key Provisions of IT Rules, 2021: The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, impose obligations on digital platforms regarding content moderation, user data handling, and compliance mechanisms. While intended to ensure accountability, certain provisions have raised concerns among foreign stakeholders.

Specific Issues Highlighted:

• Criminal liability: Individual employees of companies can be held personally liable for non-compliance.
• Strict compliance timelines: Firms must adhere to tight deadlines for content takedowns.
• Content regulation: Increased takedown requests, sometimes perceived as politically motivated.

Need for Data Protection: Strong data protection laws like the DPDP Act are essential for safeguarding individual privacy, preventing data misuse, and building trust in the digital economy. In an era of increasing data breaches and surveillance concerns, regulatory frameworks are necessary to ensure accountability of data handlers.

Challenges for Businesses: However, stringent regulations can impose compliance costs, operational constraints, and legal uncertainties. For instance, requirements such as explicit consent, data localisation, and government access to data may deter foreign firms and complicate business operations. This is particularly relevant for sectors like fintech and e-commerce, which rely heavily on data flows.

Balancing the Trade-off: The key challenge is to strike a balance between protecting नागरिक rights and promoting economic growth. Countries like the European Union, through GDPR, have attempted such a balance, though not without criticism. India must adopt a pragmatic approach that ensures robust data protection while maintaining an enabling environment for innovation and investment. A calibrated, transparent, and consultative regulatory framework is essential for achieving this balance.

Understanding Internet Shutdowns: Internet shutdowns are often imposed by governments for reasons such as maintaining public order or national security. However, they have significant economic and social consequences, particularly in a digital-first economy.

Economic and Trade Impacts: Shutdowns disrupt business operations, e-commerce, digital payments, and communication networks. For example, during prolonged shutdowns in regions like Jammu & Kashmir, businesses faced severe losses due to the inability to conduct online transactions or access digital services. Such disruptions can undermine investor confidence and affect international trade relationships.

Broader Implications: From a global perspective, frequent shutdowns may be seen as barriers to a free and open internet, impacting cross-border digital trade. For instance, IT and outsourcing firms depend on uninterrupted connectivity to serve global clients. Repeated disruptions can damage India’s reputation as a reliable digital services hub. Therefore, while security concerns are valid, the use of shutdowns must be proportionate, transparent, and limited to minimise economic harm.