Reshma Vaidya-Gupte, Author at S&R Associates

The Implications of India’s New Data Protection Law on Internal Investigations

Insights | August 21, 2024 | Practice Area: Anti-corruption; Fraud and Investigations, Data, Employment

Internal investigations may need to be carried out in India by employers in relation to a wide range of issues and/or situations. In case of Indian subsidiaries of MNCs, investigations may be carried out for the purpose of satisfying compliance requirements under law(s) applicable to the parent entity, like the Foreign Corrupt Practices Act of 1977 of the US or the UK’s Bribery Act 2010.
In the course of such internal investigations, large amounts of personal data related to accused persons and other relevant individuals may need to be processed by the employer – either by itself or through its advisors and agents. Accordingly, an informed assessment of the rights of such individuals, as well as the obligations of the employer and its advisors/agents, becomes crucial from the perspective of applicable data protection law.
This note specifically discusses the processing of personal data in the context of internal investigations, including with respect to allegations or suspicions of economic and criminal offences. While necessary rules under the Digital Personal Data Protection Act, 2023 are yet to be notified, provisions of this new law, as published in August 2023, indicate key considerations for employers (each of which is likely to be treated as a “data fiduciary”), including with respect to consent, legitimate use and potential exemptions.

India’s New Data Protection Regime: Tracking Updates and Preparing for Compliance

Insights | July 1, 2024 | Practice Area: Data, Regulatory, Technology; Media and Telecommunications

The Digital Personal Data Protection Act, 2023 (the “DPDP Act”), published in India’s official gazette last year, is a new law regulating the collection, storage, use and processing of personal data. The DPDP Act will take effect from the date(s) notified by the Indian Government, and different dates may be notified for different provisions of the DPDP Act. Further, several provisions of the DPDP Act require specific rules which are yet to be notified.
According to a recent statement made by the new union minister of the Ministry of Electronics and Information Technology, the new rules are in advanced stages of drafting and are expected to be released for industry-wide consultation in the near future. Given that both rules and provisions of the DPDP Act are likely to be notified over the next few months, all entities need to check whether and to what extent the DPDP Act applies to them and their operations.
For the purpose of preparing for, and complying with, obligations under the DPDP Act, it would be advisable for all organizations to undertake data mapping exercises and data audits inter alia in order to facilitate the identification and determination of ‘personal’ information from mixed or legacy databases and/or organizational datasets.

A New Code for Pharmaceutical Marketing Practices: From Symptoms to Diagnosis

Insights | June 18, 2024 | Practice Area: Anti-corruption; Fraud and Investigations

Pursuant to a notification dated March 12, 2024, the Department of Pharmaceuticals under India’s Ministry of Chemicals and Fertilizers issued a new uniform code for pharmaceutical marketing practices (the “New Code”), replacing a decade-old version of the same code (the “Old Code”).
The New Code applies to both pharmaceutical and medical device companies and aims to provide operational clarity around promotional activities undertaken by such companies. Although several key themes of the Old Code have been retained, a more balanced approach with respect to educational events and items has been introduced. Further, while it has been generally strengthened relative to the Old Code – including in respect of penalties, complaints and appeals, along with the possibility of future standing orders – the New Code remains voluntary, although an explicit reference to its voluntary nature has now been omitted.

AI-Generated Inventions: New Questions for Patent Regimes

Insights | May 29, 2024 | Practice Area: Intellectual Property, Technology; Media and Telecommunications

Since patent regimes around the world are primarily designed to reward “human” innovation, such norms may need to be revisited for the purpose of protecting inventions that are generated by artificial intelligence (“AI”).
In most jurisdictions, existing patent laws contemplate an “inventor” to (only) mean a natural person. Further, recent authoritative interpretations have been reluctant to extend the concept of inventorship to AI systems.
However, with the growing use of AI, modern technology has arrived at an inflection point where an AI algorithm can play a determinative role in the inventive process. Accordingly, the question of granting patents to AI-generated inventions has assumed additional importance, including in terms of incentivizing innovation and investments into future AI models.
Subject to new developments and priorities, legislators may want to consider options such as amending extant patent regimes, introducing a bespoke framework especially for AI-generated inventions, allowing human beings to be named as inventors to the extent of their involvement in the use or development of the AI system concerned, or even doing away with the requirement of naming an inventor for AI-generated inventions.

The EU’s New Law on Artificial Intelligence: Global Implications

Insights | February 19, 2024 | Practice Area: Data, Regulatory, Technology; Media and Telecommunications

Pursuant to ‘trilogue’ negotiations among major institutions of the EU, an agreement on a proposed regulation with respect to artificial intelligence (“AI”) was arrived at in Brussels a few months ago, the text of which may be approved, published, and subsequently enter into force later this year. This is the world’s first comprehensive law on AI (the “AI Act”). According to the current draft, the AI Act should apply two years after its entry into force, likely from the second quarter of 2026.
The broad focus of this new law is a risk-based approach, based on an AI system’s capacity to cause harm. Compared to prior legislative proposals, additional elements of the current agreement include rules on high-impact general-purpose AI models that can cause systemic risk in the future, as well as on high-risk AI systems. The AI Act may set a global standard for AI regulation in other jurisdictions, just like the EU’s General Data Protection Regulation (“GDPR”) did with respect to personal information. Moreover, similar to the GDPR, one of the most important effects of the AI Act will be its extraterritorial scope, involving obligations for non-EU businesses as well.

Can Deepfakes be Leveraged Responsibly?

Insights | February 1, 2024 | Practice Area: Data, Regulatory, Technology; Media and Telecommunications

‘Deepfakes’, which involve the creation of highly realistic content (images, video, audio) by harnessing the power of artificial intelligence (“AI”), raise important concerns related to misinformation, identity theft, fraud, privacy infringement and electoral democracy – including as recently witnessed in India via incidents involving media personalities and politicians. However, deepfakes also promise exciting possibilities in various fields and business applications, including for personalized marketing, virtual training simulations and operational efficiency.
As of date, India does not have a specific law to regulate deepfakes or AI. However, certain provisions under the Information Technology Act, 2000 and its corresponding rules (together, the “IT Act”) may be invoked by appropriate authorities in this regard, including with respect to potential misuse and related penalties. In addition, new legislation – such as the proposed Digital India Act and the recently published Digital Personal Data Protection Act, 2023, respectively – which, when acting together, remain poised to overhaul the IT Act in its entirety – may introduce bespoke rules on regulating AI and deepfakes in India.
As organizations navigate this transformative techno-legal landscape, the responsible use of deepfake technology – including through a combined adoption of ethical frameworks, transparent policies, security measures, technical collaborations and awareness campaigns – is necessary to ensure a positive impact on the business ecosystem.