This Report, based on the initial White Paper submitted in 2017 for public input, is one of the most significant developments in India with respect to data privacy, and is the basis for the current PDP Bill 2019.

The Data Empowerment and Protection Architecture in India is premised on the right of people to access their data and share it with third party institutions, and such informed consent is facilitated through Consent Manager Institutions. Such a system of consented data sharing, the paper argues, should be applied to the financial sector so as to bolster financial inclusion while ensuring secure access to data. It highlights how personal data is compartmentalized in silos, which leads to financial exclusion. It thus argues the need for an interoperable data sharing framework that is predicated on minimizing privacy risks, ensuring user agency over data and a strong system of accountability. Such a framework would form the final layer of the India Stack, which is a series of digital public goods designed to enable private market innovators to improve digital services (this includes KYC, UPI, UIDAI, etc.). 

The Report attempts to regulate non personal data (‘NPD’) while enabling a data-sharing framework. It defines different categories of NPD based on the sensitivity of personal data from which they originate, and apportions risk accordingly.

The Union government constituted a Group of Experts on privacy under the erstwhile Planning Commission that submitted its Report in October 2012, proposing a framework for the protection of privacy concerns. The framework suggested by the expert group was based on five salient features: (i) Technological neutrality and interoperability with international standards; (ii) Multi-Dimensional privacy; (iii) Horizontal applicability to state and non-state entities; (iv) Conformity with privacy principles; and (v) A co-regulatory enforcement regime. After reviewing international best practices, the Expert Group proposed nine privacy principles, namely Notice, Choice and Consent, Collection Limitation, Purpose Limitation, Access and Correction, Disclosure of Information, Security, Openness, and Accountability.

Section 4.4 of the Report highlights data protection issues. Within this section, the Report argues that certain powers of the Data Protection Authority under the PDP Bill, 2019 may be delegated to sectoral regulators in the Financial Industry such as the RBI, SEBI, IRDA etc., in furtherance of their pre-existing obligations and efforts to bolster data security in the Industry.

This Report is the product of the Working Group created in 2016, which was set up with the aim of reviewing the regulatory framework and potential within the FinTech Industry. Of the several recommendations it made, the Report suggested the need for an independent data protection law in India as the existing framework was based on individual contractual agreements between parties that were deemed inadequate to account for the challenges and risks involved in digital transactions. It highlighted the need for the Industry to categorise data on the basis of sensitivity so as to better inform collection, transfer, access and storage processes. It also recommended ‘safe transaction principles’ to strengthen the FinTech Industry.  It also proposed the implementation of a Regulatory Sandbox (see above).