“I think it’s a very pragmatic way to resolve the problems,” said K&S Digiprotect’s S. Chandrasekhar on provisions in India’s data privacy law that allow the forthcoming Data Protection Board to refer privacy complaints to alternate dispute resolution mechanisms, instead of resolving them through Board-led investigations.
Chandrasekhar was speaking at the “Data Protection Board” session of MediaNama’s PrivacyNama conference last week. During the panel, experts raised concerns that the Board—set up under the Digital Personal Data Protection Act as the apex data protection regulator—may struggle to singularly rule on the privacy complaints of 1.4 billion people.
Chandrasekhar’s co-panellists Anirudh Burman (Carnegie India), Alok Prasanna Kumar (Vidhi Centre for Legal Policy), and Meghna Bal (Esya Centre) explored why referring complaints to mediation may ease the Board’s functioning, and smoothen the privacy dispute resolution process. Arya Tripathy of PSA Legal chaired the session.
“Corporates, for instance, would be very happy not to go through a very long adjudication process,” Chandrasekhar continued. “Their first preference would be alternate dispute resolution. I suspect that most of the cases will be resolved at the grievance officer level [of the company] itself. And if it goes to the next level [of alternate dispute resolution], it will be resolved. I think it’s a very practical way of doing things because there is also a tendency to go after the large MNCs with frivolous complaints just to make money or [for] the possibility of making money. So, this will avoid this kind of thing.”
Section 31 of the Digital Personal Data Protection Act states that “if the Board is of the opinion that any complaint may be resolved by mediation, it may direct the parties concerned to attempt resolution of the dispute through such mediation by such mediator as the parties may mutually agree upon, or as provided for under any law for the time being in force in India.”
This discussion was organised with support from Meta, PhonePe, Google, and Salesforce, and in partnership with CUTS and the Centre for Communication Governance.
Can conflicted parties be expected to settle conflicts on their own? “I’m going to be that horrible lawyer and point out that what will kill this clause is ‘by such mediator as the parties may mutually agree upon’,” Vidhi’s Alok Prasanna Kumar drily noted. “You’re already in a conflict[ed] relationship. How are you ever going to agree or who’s going to be the mediator? I mean, it’s possible. I’m not going to dispute it. Usually, [when bodies refer disputes to mediation] there is some reference to an institution. You refer to the institutional mediation, the institution picks up the mediator, or the court or the body appoints a mediator, and says, ‘we know we vouch for this person, this person will be good’.”
“[On the one hand] This [provision] takes the problematic part of arbitration, where everyone thinks if they choose the arbitrator, that arbitrator has to work for them,” Prasanna Kumar continued. “And on the other hand, it sort of says, this is how mediation will take place. You’re already upset at this MNC for good or bad reasons. How will you ever agree on who will be the mediator for this? Who are the pool of people from whom you’re going to pick a mediator? It can’t be the entire population of the country. It has to be a trained mediator. There has to be a certain certification. There are courses, there are strict rules about this [qualification aspect] in a lot of places. There has to be a certain set of rules which guide mediation [proceedings]. Mediation cannot be so open-ended that we’ll take the next 15 years to decide this mediation without letting you go forward with this case. This is not a clause which is designed to be realistic or applicable or even provide a sufficiently effective alternate dispute resolution.”
Lawyer and audience member, Rahul Ajatshatru pointed out that mediation references by the Board may very well be time-bound. “[In] Mediation, unlike arbitration, the outcome is not necessarily that I’ll participate,” Ajatshatru explained. “Anybody can walk out [of the proceeding at] any point in time. So, it does not mean that if something is referred to mediation, it’ll lead to one way or the other. [This is] Unlike arbitration where the arbitrator will give an award, [and will] either allow or disallow the claim. There’s a six months guideline, you have to close the complaint six months. So, whatever reference is made to mediation [by the Data Protection Board] probably will be with the reference that you must close it in a time-bound period.”
Could mediation lead to data principals being financially compensated for privacy complaints? “The Act doesn’t provide for compensation to data principals for any breach,” said an audience member. “[But] The mediation provision says that any complaint can be referred to mediation, and if there’s an out-of-court settlement, of course, that’s going to be honoured. Do you see this mechanism enabling some form of compensation to come into the picture, where data principals are compensated for breaches?”
“The way I look at it, it definitely will lead to some kind of compensation,” Chandrasekhar said. “It could be monetary, it could be an apology, it could be a publication, or something like that. But, definitely, compensation will be there.” MediaNama’s Editor Nikhil Pahwa reiterated that compensation to data principals wasn’t mentioned in the Act.
While agreeing with Pahwa, Chandrasekhar held his ground, pointing out that “when there is adjudication happening between a service provider and a customer on a data privacy issue, it is between the customer and the service provider on what will satisfy the customer. It could be a TV, it could be Amazon vouchers, it could be money, or whatever.”
PSA Legal’s Arya Tripathy added that mediation is “the only way actually the data principal could say that ‘I need X amount of money because you breached my rights’. But, there is otherwise no statutory way of getting it.”
Can the Board use its own discretion to award compensation? Section 27(2) of the data protection law allows the Board to issue directions that it considers necessary. An audience member asked if this could lead to the Board awarding compensation to data principals through its orders.
“They can’t award compensation through directions,” Esya Centre’s Meghna Bal clarified. “I think the idea [behind the law’s reference to mediation] is to kind of disincentivize frivolous complaints, though I don’t think it really will because the people who are motivated to make those complaints for the sake of harassment are not going to be deterred by a 10,000 rupee penalty.”
Under the law, data principals breaching their “duty” of not filing false or frivolous complaints with the Board can be fined up to Rs. 10,000.
STAY ON TOP OF TECH NEWS: Our daily newsletter with the top story of the day from MediaNama, delivered to your inbox before 9 AM. Click here to sign up today!
- “India needs a risk-based approach for data breach notification”: Varun Bahl, NASSCOM #PrivacyNama2023
- Fifteen Major Concerns With India’s Digital Personal Data Protection Bill, 2023
- India’s Digital Personal Data Protection Bill, 2023: What Privacy Rights Do Individuals Have?
- How Does India’s Digital Personal Data Protection Bill Address Data Breaches?