Report on the implementation of the field survey by the Center for the Promotion of International Economic Partnership (India, February 9-14, 2020)
Finished

Report on the field survey conducted by the Center for the Promotion of International Economic Partnerships
(India, February 9-14, 2020)


1. the state of digital regulation: the Privacy Bill is the biggest concern at the moment

　India, an Asian superpower on a par with China, has long advocated itself as an IT advanced country and has focused on developing its IT industry and fostering human resources such as engineers while attracting foreign investment. In particular, in recent years, under its "Digital India" plan, the Indian government has been actively promoting digitalization in various fields, including the expansion of public digital infrastructure, digitalization of administrative services and procedures, promotion of businesses utilizing artificial intelligence (AI) and big data, and measures to promote startups. In particular, the India Stack, centered on the biometric personal identification number system Aadhaar, has succeeded in attracting about 80% of the population without bank accounts, and is attracting attention from the international community as a groundbreaking system that has led to solutions to financial inclusion issues. Furthermore, in addition to public services such as pension payments, livelihood protection, and public financing through the system, the Ministry of Electronics and Information Technology (MeitY), while playing the role of regulator, is eager to promote related businesses such as cashless and electronic payments, personal information and data management, and data utilization in collaboration with private businesses. The stance on digital promotion measures is expected to remain unchanged under the second government of Prime Minister Modi after the 2019 general elections.

　While smartphone users are increasing, especially in metropolitan areas, and various services via apps are becoming more widespread, traditional analog economic activities are still entrenched in rural areas, creating a disparity. In fact, although the smartphone penetration rate and Internet penetration rate have been growing in recent years, they remain at around 40% each for India as a whole. India has the fourth largest number of unicorns in the world after the United States, China, and the United Kingdom. Local e-commerce platforms, such as Flipkart (now part of Walmart) and Snapdeal, are developing and providing universal services, including e-payment, financial services such as fintech, and delivery services using the latest technology to supplement logistics networks with many problems, such as last-mile delivery. In addition to financial services such as e-payments and fintech, e-commerce platforms will also focus on the development and provision of universal services, such as delivery services using the latest technology to supplement logistics networks that face many challenges, including last mile delivery. Local governments have also established their own digitalization promotion policies and are promoting the development of IT infrastructure, such as the construction of data centers, to encourage startups.

　Against this backdrop, the Indian public is becoming increasingly concerned about the protection of personal information, and the government is working on legislation to address this issue. While the financial, electronic communications, and medical sectors already have domestic storage (localization) obligations for certain protected personal information, a comprehensive Personal Data Protection Bill (PDPB) is currently being debated in Parliament. The PDPB was first drafted in 2017 by a legal expert and was severely criticized for its potential impact on the industry. Based on various domestic and international opinions gathered by February 2020, the finalization will be conducted with the aim of passing the bill in the fall session of the Diet and enacting it by the end of the year. The current draft defines the categories of data to be protected, with sensitive data being subject to mirroring (cross-border access is possible if there is a copy in Japan) and critical data being subject to localization. It is noteworthy that Article 91(2) allows the central government to request anonymised personal data and non-personal data as necessary. This is likely to raise concerns from the industrial sector as allowing unnecessary intervention by the central government.

　In India, in addition to the Federation of Indian Chambers of Commerce and Industry (FICCI), which includes companies from almost all industries, both domestic and foreign, industry associations representing various industries, such as NASSCOM, which includes IT and telecommunications companies, and IBA, which includes banks, routinely engage in dialogue and lobbying with the government, which is reflected in policy. The opinions of foreign-affiliated companies, including Japanese-affiliated firms, are also absorbed through the industry associations, just as they are in the local market.

2. impact on industry and business

Reactions to the Personal Data Protection Bill (PDPB)
　The majority of the respondents shared the common response that industry opinions have been reflected and changes have been made in a favorable direction. In addition, the following comments were received from government agencies, industry associations, and companies (including Japanese companies).

[Claire] Positive feedback.
- This is an important law to promote further digitization policy by the government, and the development of the law in compliance with international rules and standards is also a message to the international community. (Government agencies, industry associations)
- We welcome stricter laws and regulations similar to GDPR. It should make it easier to receive orders for BPO and other services from European companies. (Industry associations, foreign companies)
- Expect comprehensive personal information protection laws to be enacted, as personal information such as phone numbers and birth dates are routinely misappropriated and leaked at commercial facilities and hotels. (Trade associations, local companies, foreign companies)
- Mirroring provisions have been significantly relaxed. Although sensitive data remains, the use of cloud computing requires only one-third of the cost of managing physical servers, so the impact is not so great (local companies, Japanese companies).
- The collection of certain data by the government under Article 91(2) is unavoidable if it is for the prevention and investigation of cybercrime. (Government agencies, local businesses)

[Claire] Negative.
- The language of an 18-month grace period is missing from the latest draft, but we would like to see a sufficient grace period between passage of the bill and its entry into force. (Trade association)
- Critical personal data is not well defined. (Trade associations, local companies)
- Under Article 91(2), the Indian government can require data processors and custodians to disclose non-personal data and anonymized data (anonymous data), and companies have no right of refusal. Although it is supposed to be for government-related matters and investigations, there are concerns that it could be an infringement of intellectual property and patents (industry association, Japanese company). (Industry associations, Japanese companies).
- Lack of clear regulations for data processors (Japanese companies)
- Clarification of definitions is needed, as the original proposal, in which children are defined as under 18 years of age, may restrict educational, entertainment, and other online services targeted to children (industry group).