Blog

DIGITAL PERSONAL DATA PROTECTION BILL, 2023 In August 2023, the Rajya Sabha passed the Digital Personal Data Protection Bill (DPDP), marking a crucial shift in India’s data protection framework. Once enacted, it will replace the dated provisions of the Information Technology Act, 2000, establishing a comprehensive regime focused on safeguarding personal data. This is timely, as artificial intelligence is rapidly becoming indispensable in daily life. The DPDP Act ensures that AI systems, which depend on vast amounts of personal data, adhere to strict privacy standards, driving a move toward privacy-centric AI development. NAVIGATING PRIVACY CHALLENGES IN AI CONSENT MECHANISM Implementing consent mechanisms across diverse languages and literacy levels. DATA LOCALISATION Ensuring localisation data for sensitive information BIASES Addressing biases in AI decisions TRANSPARENCY while complying with new regulations TRANSPARENCY Balancing transparency requirements with AI complexity. In fact, the Global tech body Information Technology Industry Council (ITIC), a Council representing 80 technology firms including giants like Apple, Amazon, Google, and Microsoft, has urged the Indian government to strike a balance between individual privacy and innovation in the country. INDIA’S DATA PROTECTION FRAMEWORK Under the DPDP Bill, handling sensitive personal data—such as biometric or health data—requires more stringent controls. AI developers must implement robust mechanisms to classify and secure sensitive information, ensuring that it is only used for lawful and appropriate purposes. The Data Protection Board of India (DPBI), which will be established once the Bill is notified, will monitor compliance and investigate any potential violations, imposing penalties up to INR 250 cr. if regulations are breached, thus making sensitive data protection a top priority for AI companies. CONSENT AND PURPOSE LIMITATION The DPDP Bill requires explicit, informed consent from data principals before collecting or processing their personal data. Consent must be in plain language and specify the intended purpose. The Bill emphasizes the principle of purpose limitation, which mandates that data can only be used for the purposes disclosed at the time of collection. If companies wish to use data for new purposes, fresh consent is required. LEGAL FRAMEWORK FOR DATA LOCALISATION The DPDP Bill introduces data localization rules, particularly for sensitive data like health and financial information, which must be stored and processed within India. AI systems relying on global data infrastructure will need to restructure their operations. Cross-border data transfers are allowed only under strict conditions, such as adequate protection in the recipient country or government-approved safeguards. These requirements force AI companies, particularly those with cloud-based or international operations, to restructure their data management systems to meet localization mandates. Therefore, ITIC has requested an 18–24 month grace period after the Act is notified to make their systems fully compliant with the localization mandates. TRANSPARENCY & ACCOUNTABILITY The DPDP Act will enforce strong transparency and accountability measures. Companies must clearly inform users about the collection, use, and sharing of their personal data through comprehensive privacy notices. Regular data audits, impact assessments, and reporting will be required to ensure compliance. Companies will be required to implement data governance frameworks and appoint Data Protection Officers (DPOs) where necessary. These measures will ensure that companies handle personal data responsibly while building user trust by fostering transparency in data processing activities. CONCLUSION The DPDP Act, 2023, once enacted, will mark a significant shift in India’s data privacy landscape. It will provide a robust framework for protecting personal data, impacting sectors that rely heavily on data processing, such as AI. By prioritizing privacy rights and setting high compliance standards, the DPDP Act will encourage companies to adopt more responsible data practices. For AI developers and businesses, the Act will demand a balanced approach, promoting innovation while ensuring that personal data is handled lawfully, ethically, and transparently. Stay tuned for more legal insights.

– Mandeep Singh, Associate The emergence of crypto-currencies has transformed the global financial landscape, and India is no exception to the rapid increase in crypto currency investors entering the market. With a growing market there is a dire need for clear regulations. However, despite, the rapid growth in the cryptocurrency market in India the Government’s ambivalence towards cryptocurrencies has resulted in a regulatory vacuum, leaving exchanges to operate in a grey area. India’s regulatory approach to crypto-currencies has been cautious yet unclear, reflecting concerns about security, money laundering, and financial stability. In 2013, the Reserve Bank of India (“RBI”) issued a warning about the risks associated with virtual currencies, highlighting the potential for volatility, fraud, and illicit activities. The sui-generis nature of crypto-currencies makes it fall out of the conventional definition and ambit of a financial instrument and asset. The RBI has already expressed its concern and suspicion on the feasibility of crypto-currencies published a Circular bearing No. RBI/2017-18/154 dated 06th April 2018 (“RBI Circular”) which banned banks from dealing with crypto exchanges in any manner. However, the Hon’ble Supreme Court in 2020 was pleased to set aside the RBI Circular in the judgement dated 04.03.2020 passed in Writ Petition (Civil) No. 528 of 2018. Despite, the Ruling of the Hon’ble Supreme Court in Writ Petition (Civil) No. 528 of 2018, the RBI Circular has continued to have an impact on the future of the crypto-currencies and resulted in various crypto-exchanges to shut their operations in India, leaving the investors in a state of confusion and uncertainty. Pursuant to the Hon’ble Supreme Court quashing and setting aside the RBI Circular, the Cryptocurrency and Regulation of Official Digital Currency Bill, 2021 (“Crypto Bill’) aimed to prohibit mining, holding, selling and dealing in private crypto-currencies and issuing/trading in crypto-currencies related in derivatives and aimed to create an official digital currency issued by the RBI and vesting the powers to regulate, issue, supply and manage crypto-currency. This was introduced as a measure to protect consumer interests, prevent money laundering and promote financial stability in crypto-currencies. The Bill was introduced in the 2021 winter session, however, the Bill has not come into operation making its current status uncertain. Due to the lack of regulations and the fluctuations in the status of cryptocurrencies in India, certain alarming revelations have unfolded in India regarding cryptocurrency, which have resulted in hardships for the investors and the exchanges, such as destressed closures of operations and investors forced to divest funds in grave paucity of time, Coinome, a Billdesk backed cryptocurrency Exchange, suspended its operations in India in 2019 due to the prevailing uncertainty on cryptocurrency guidelines and regulations in India. In another instance, Zebpay, one of the leading Cryptocurrency Exchanges in India, was constrained to shut down its operation in India in 2018, pursuant to the RBI ban on banks dealing with cryptocurrency. Currently, crypto-currencies are not recognized as legal tender in India, the treatment of crypto-currencies in India for the purposes of taxation are also ambiguous as there is no law and/or regulation, which is regulating the taxation for crypto-currencies. there is no specific law governing taxation of cryptocurrency or definition of ‘income’ from cryptocurrency, the Indian Government vide the Finance Bill, 2022 has introduced 30% Income tax on Cryptocurrencies and subjected cryptocurrency to the grasp of GST as well. Furthermore, crypto currency is subject to income tax and Goods and Services Tax (“GST”). Crypto-currency exchanges must also comply with Anti-Money Laundering (“AML”) and Know-Your-Customer (“KYC”) norms, ensuring that transactions are transparent. These regulations demonstrate the government’s willingness to acknowledge the existence of crypto-currencies while ensuring they operate within established financial frameworks however, the government’s approach may be counterproductive, driving crypto activity underground and making it even harder to regulate. A more nuanced approach, recognizing the sui generis nature of crypto assets, is needed. The lack of clarity surrounding crypto-currency legality has led to confusion among investors, traders, and financial institutions. Furthermore, the absence of clear guidelines has created regulatory ambiguity. A clear regulatory framework would enable businesses to operate with confidence, attract foreign investment, and drive economic growth. Public awareness campaigns would educate users about the risks and benefits associated with crypto-currencies, promoting responsible trading and investment. In conclusion, the crypto industry in India is navigating a complex regulatory landscape, the government and regulatory bodies in India must address the regulatory ambiguity surrounding Exchanges, the lack of specific regulations leaves the industry in a state of uncertainty. By doing so, India can establish a robust framework for the growth of crypto-currency. The Indian government and regulatory bodies must address the regulatory ambiguity surrounding crypto-currency and the impact it has on the investor’s mindset, protection and confidence as well as the survival of the crypto-currency exchanges operating within India. Indian investors have displayed their interest and intrigue, which is growing stronger each year with more and more investors investing in crypto currencies, the Govt. ought to realize the growing trend and the need to provide certain safeguards to many investors investing in the crypto markets. Moreover, the Indian government should consider establishing a specialized regulatory body to oversee the crypto-currency market and maintain vigilance, much like how Securities and Exchange Board of India (“SEBI”) maintains vigilance over the stock market. This entity would provide dedicated expertise, monitor market trends, and respond to emerging challenges. Ultimately, the future of crypto-currency regulation in India will depend on the government’s ability to strike a balance between regulatory oversight and innovation. By embracing this challenge, India can unlock the potential of crypto-currencies, enhance its financial landscape, and cement its position as a hub for technological innovation.

Indian Evidence Act & BSA Until recently, the Indian Evidence Act, 1872 (IEA) was the primary legislation governing the admissibility and evaluation of evidence in both criminal and civil cases in India. However, with effect from 01.07.2024, this landmark legislation has been superseded by the Bharatiya Sakshya Adhiniyam, 2023 (BSA), marking a significant shift in the country’s evidentiary framework. The BSA aims to establish a comprehensive legal framework for electronic records, tackling the intricacies of digital evidence in India. This entails introducing novel definitions, benchmarks, and protocols to validate and confirm the authenticity of electronic records, thereby rendering them trustworthy evidence in judicial proceedings. Key Changes The IEA’s territorial application was explicitly limited to India (Section 1), whereas the BSA’s Section 1 omits this geographical restriction. This omission appears to be a deliberate move to facilitate the admission of digital evidence originating from outside India, potentially broadening the Act’s scope to accommodate international digital evidence. Document – Section 2(d), BSA (Sec 3(e) IEA): The BSA broadens the definition of documentary evidence to explicitly include digital and electronic records. The term ‘document’ has been redefined to encompass modern forms of data storage and communication. Notably, an illustration has been added to clarify that ‘electronic records on emails, server logs, documents on computers, laptops or smartphones, messages, websites, locational evidence, and voice mail messages stored on digital devices are documents.’ This expansion is further supported by changes in the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS). Challenges in Ensuring Data Integrity Inclusion of Electronic and Digital Records: The revised definition of a document now explicitly encompasses electronic and digital records, expanding its scope to include any information conveyed, described, or stored electronically through devices like computers, smartphones, or other digital tools. Expansion of Means of Recording: The revised definition takes a more comprehensive approach, acknowledging that information can be recorded in various forms beyond traditional written symbols, numbers, or marks. It now includes any method of capturing information, such as audio or video recordings, or other innovative means of documentation. Intended Use: Both definitions emphasize the purpose of a document is to record information, but the newer definition explicitly includes electronic and digital formats as intended uses. Evidence: The revised definition of ‘evidence’ broadens its scope to encompass electronic oral statements and explicitly includes digital records as documentary evidence, acknowledging the modern shift towards digital information storage and communication in contrast to the old framework, which mainly focused on traditional oral testimony and physical documents, potentially restricting its relevance in today’s digital landscape. Section 57 of the BSA significantly expanded the definition of ‘primary evidence’ to include various forms of electronic and digital records, providing clarity on what constitutes primary evidence in the context of electronic or digital records, addressing a significant gap in the previous legal framework. Interplay of BSA & IT Act Conflicting Definition and Scope of Electronic Records: The BSA introduces a broader definition of electronic records compared to the IT Act. Under the BSA, electronic records now include information stored in semiconductor memory, communication devices, and various digital formats. In contrast, the IT Act defines electronic records more narrowly as “data, record or data generated, image or sound stores, received or sent in an electronic form or microfilm or computer-generated micro fiche.” The BSA broadens the definition of electronic records, potentially creating legal ambiguities with the IT Act’s narrower definition. This discrepancy may lead to inconsistent court applications in cases involving new technologies or digital formats not explicitly covered by the IT Act. Conclusion Admissibility Procedures & Evidentiary Standards: The BSA’s electronic evidence admissibility approach conflicts with IT Act procedures, potentially causing confusion and inconsistencies due to differing requirements and authentication processes. The BSA treats electronic records as primary evidence while simultaneously retaining provisions for certificate authentication. This dual approach may create confusion in court proceedings. Authentication and Integrity of Digital Evidence: The IT Act provides a robust framework for verifying the integrity of certain types of electronic records, whereas the BSA acknowledges the significance of integrity but adopts a more expansive approach, enabling courts to seek expert opinions from Examiners of Electronic Evidence and accepting electronic records from ‘proper custody.’ However, the BSA lacks clear technical guidelines for maintaining the integrity of digital evidence throughout the collection and storage processes, leading to potential risks concerning chain of custody and tampering. The BSA’s modernization efforts, despite initial challenges, will pave the way for a more efficient and effective justice system, as jurisprudence adapts to electronic and digital records.