Month: May 2023

India’s Proposed Digital Governance Framework

Back to the Future: India’s Proposed Digital Governance Framework

Insights | May 31, 2023 | Practice Area: , ,

A first draft of the proposed Digital India Act (“DIA”) may be ready by June for public review, while a corresponding bill may be introduced before parliament soon thereafter, pursuant to industry feedback. Meanwhile, further to consultations between the Ministry of Electronics and Information Technology and select stakeholders across Bengaluru, New Delhi, and Mumbai in March and May 2023, the following principles appear likely to define the main thrust of the new law: (1) an open internet, (2) online safety, (3) a revised intermediary framework, (4) the regulation of new technologies, (5) non-personal data sharing, and (6) limited (or no) safe harbor.
This note, the third of S&R Data+ – a multipart series on data governance focused on personal and non-personal information – discusses these principles with respect to the DIA.

Underwriting Framework for Public Issues

SEBI Modifies Underwriting Framework for Public Issues

Legal Updates | May 25, 2023 | Practice Area: ,

On May 23, 2023, the Securities and Exchange Board of India amended the Securities and Exchange Board of India (Issue of Capital and Disclosure Requirements) Regulations, 2018 to effect changes to the underwriting framework applicable to public offerings. Essentially, the SEBI amendment mandates that if an issuer making a public offering through the book-built route desires to have the offering underwritten to cover any under-subscription (referred to as hard underwriting), it is required to enter into an underwriting agreement with the underwriters upfront and prior to filing the red herring prospectus and make necessary disclosures of the underwriters’ commitment in the RHP. This note discusses the key changes made by SEBI to the regulations governing hard underwriting in book-built public offerings in India.

India’s digital governance framework

India’s Proposed Digital Governance Framework: Past Developments and Present Status

Insights | May 24, 2023 | Practice Area: , ,

This is the second note of S&R Data+, a multipart series on data governance focused on personal and non-personal data, including with respect to their separate regulatory, legal, and commercial implications. The previous note summarized India’s existing data protection framework and provided an overview of India’s legislative trajectory in that regard. Here, we provide a snapshot of the gradual build-up to India’s proposed digital governance framework, including by analyzing past trends which have led to present developments.
While a recent flurry of legislative and policy activity promises to transform the country’s digital future, two landmark laws with respect to digital personal and non-personal data, respectively, may attain concrete shape by the end of 2023 itself – thereby replacing India’s existing data protection framework under the Information Technology Act, 2000, as amended, along with its allied rules.
While recent reports suggest that India’s current draft of the Digital Personal Data Protection Bill, 2022 is likely to be tabled before parliament in the month of July (as potentially revised pursuant to stakeholder comments), a proposed ‘Digital India Act’ has simultaneously gathered consultative traction – further to which a draft bill is expected around the same time. Thus, July 2023 promises to be a significant period for the country’s future.
Later in the series, we will examine the possible impact of such present developments on the shape of laws to come.

Personal and Non-Personal Data

Personal and Non-Personal Data in Digital India: Before and After

Insights | May 17, 2023 | Practice Area: , ,

Over the past few years, the ripple effects of GDPR and the EU’s wider data governance regime have spread to, and influenced, the rest of the world – including India – especially with respect to the latter’s ongoing efforts to overhaul its domestic data protection framework. Furthermore, certain recent developments, involving key legislative and policy interventions, promise to fundamentally transform the country’s digital future, much like Europe’s. For instance, by the end of the year, two far-reaching laws – a ‘Digital Personal Data Protection Act’ (“DPDP”) and a ‘Digital India Act’ – may both reach fruition with respect to digitized personal data and non-personal data, respectively.
However, major gaps persist when it comes to distinguishing between the two. This distinction has assumed additional importance today for India – poised as it is on the cusp of a new governance architecture, replete with consequences related to collection, consent, processing, storage, protection, breach, exploitation, sovereignty, ownership, and localization. Accordingly, it is time that the unique techno-legal challenges and opportunities connected with personal and non-personal data, respectively, were separately examined – including to analyze their discrete regulatory requirements and commercial scope. At the same time, paradigmatic boundaries within the personal/non-personal continuum have increasingly blurred on account of the rising use of mixed datasets and de-anonymization techniques, the regulation of which has demanded urgent governmental attention.
In light of the above – ‘Data+’ – a special multipart series on data governance, will focus on analyzing personal and non-personal data separately while exploring the various legal, business, and regulatory issues associated with the two – including with respect to certain extraordinary innovations proposed under DPDP relative to GDPR, such as in respect of ‘deemed’ consent; sensitivity, volume, and harm; and relatedly, ‘significant data fiduciaries’. This note – the first of this special series – is divided into two sections. In Section I, we provide a brief summary of whether, and how, India’s existing data protection framework addresses the definitions of, and the distinction between, personal and non-personal data, respectively. In Section II, we provide an overview of India’s staggered legislative trajectory in this regard. Further into the series, we will analyze India’s proposed digital governance paradigm, including with respect to differences between personal and non-personal data.

Data Embassies

Readying the Law to Host ‘Data Embassies’ in India

Insights | May 8, 2023 | Practice Area: , , , ,

Consistent with India’s stated aims of becoming a data storage and cloud computing hub, as the country seeks to encourage foreign governments and businesses to establish ‘data embassies’ at Gujarat’s GIFT City, a bespoke policy may soon be formulated along the lines of Bahrain’s cloud law, as well as for the purpose of defining a ‘data embassy’ appropriately such that its underlying and/or associated infrastructure qualifies for diplomatic protection under international law. Alternatively, such entities could be instrumentalized through customized bilateral agreements that re-interpret the Vienna Convention (like Estonia and Monaco signed with Luxembourg in 2017 and 2021, respectively) in respect of granting regulatory immunity to potentially both personal and non-personal information (as if it were physical premises), including with regard to non-sovereign commercial digital databases.
Clause 17 of India’s current draft of the Digital Personal Data Protection Bill, 2022 (“DPDP”) permits digitized personal data to be stored overseas, albeit at locations that satisfy the government in terms of political and protectional adequacy. In that regard, a revised iteration of DPDP (or rules framed thereunder) may subsequently include the principle of reciprocity in a way that foreign state or private entities are able to use local cloud ecosystems through state-of-the-art data centers located inside an Indian SEZ, including for the purpose of storing copies of critical government or business information for continuity, backup, and/or recovery-related reasons – in case the main servers back home get compromised – including on account of sustained denial-of-service attacks, a natural disaster, full-scale military invasions, or any other national emergency. 
Nevertheless, since DPDP deals exclusively with digitized personal data, if India’s data embassy policy envisages the storage of non-personal information only, it may need to rely on a different legislation – such as the proposed Digital India Act. Meanwhile, although certain Tier 3 and Tier 4 data centers with business continuity and disaster recovery functions are already operational at GIFT City, data embassies may require a new approach by leveraging diplomatic agreements bolstered by cloud technology solutions. Accordingly, India may want to develop a separate legal framework for the purpose of being perceived as a reliable host with respect to sensitive foreign databases.
With this background, this note examines how countries and companies (especially vulnerable and/or at-risk ones) that want and/or need digital continuity solutions may evaluate available options – given policy, legal, and logistical constraints in this regard.

Emergency Arbitrations in India

Emergency Arbitrations in India: Viability and Enforceability

Insights | May 3, 2023 | Practice Area:

Interim measures are often required at early stages in an arbitration to protect the parties’ respective positions for the duration of the arbitration proceedings, including by way of orders to preserve evidence, prevent dissipation of assets and secure the amount in dispute (including costs of the arbitration). Emergency arbitration offers a disputing party an avenue to obtain urgent interim relief from an arbitrator appointed exclusively for the purpose, on an expedited basis before the arbitral tribunal is constituted and without having to resort to court proceedings for interim relief. We discuss the efficacy of, and challenges in relation to, decisions of an emergency arbitrator in disputes involving Indian parties or where any relief granted is required to be enforced in India.