INDIA Law and Practice Contributed by: Suvarna Mandal and Rishikaa, Saikrishna & Associates
Upcoming Data Protection Law The DPDP Act prohibits a Data Fiduciary from undertaking tracking or behavioural monitoring of children or targeted advertising directed at them. However, the government can notify pur - poses and classes of Data Fiduciaries that can be exempted from the restriction on tracking or behavioural monitoring of children or targeted advertising directed at children subject to condi - tions prescribed by it. The government can also notify a lower age for children (ie, lower than 18 years, which is the age of majority in India) for processing if it is satisfied that the Data Fiduci - ary has ensured that the processing of personal data of children is carried out in a “verifiably safe” manner. Such Data Fiduciaries may be exempted from compliance with the restriction on tracking or behavioural monitoring of chil - dren or targeted advertising directed at children, among other things. 4.3 Employment Privacy Law Current Data Protection Law The SPDI Rules do not specifically govern employment-related personal data, which would broadly be governed by the require - ments that are applicable to personal informa - tion or SPDI, depending on the nature of such data. For instance, name, address, age, etc, would be considered personal information and would be subject to the requirements applicable to personal information under the SPDI Rules. However, biometric information collected for attendance, financial information, etc, would be considered SPDI under the SPDI Rules, requiring written/electronic consent to be obtained before
nises two bases for the processing of personal data – namely consent and non-consent based “certain legitimate uses”. One of the legitimate uses identified in the DPDP Act is “for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espi - onage, maintenance of confidentiality of trade secrets, intellectual property, classified informa - tion or provision of any service or benefit sought by a Data Principal who is an employee”. The DPDP Act does not define the phrase “employment purpose”, which will become clear once jurisprudence develops on this aspect. This means that the personal data can be processed without seeking consent or providing corre - sponding rights that apply to consent-based processing if such processing can be justified for the purpose of employment or for safeguarding the employer from any loss or liability. 4.4 Transfer of Personal Data in Asset Deals There are no specific guidelines or regulations on the transfer of personal data in asset deals in India. Accordingly, any transfer of personal data in asset deals in India would be governed by the general data protection laws and the applicable sectoral laws. However, the DPDP Act has made certain carve- outs or exemptions for personal data process - ing requirements that would be relevant to asset deals. Under the DPDP Act, the provisions pertaining to the obligations of a Data Fiduci - ary (except the general obligation of comply - ing with the DPDP Act and taking reasonable security safeguards to prevent personal data breach), the rights and duties of Data Principals and transfer-related requirements of personal
the collection of such information. Upcoming Data Protection Law
Unlike the SPDI Rules, the DPDP Act specifi - cally deals with personal data processed for employment purposes. The DPDP Act recog -
200 CHAMBERS.COM
Powered by FlippingBook