Data Protection: Impact of Recent Developments on the Future of EU-India Digital Trade

Terms of use

Terms of Use

The use of this site and the content contained therein is governed by the Terms of Use. When you use this site you acknowledge that you have read the Terms of Use and that you accept and will be bound by the terms hereof and such terms as may be modified from time to time.

All text, graphics, audio, design and other works on the site are the copyrighted works of nasscom unless otherwise indicated. All rights reserved.
Content on the site is for personal use only and may be downloaded provided the material is kept intact and there is no violation of the copyrights, trademarks, and other proprietary rights. Any alteration of the material or use of the material contained in the site for any other purpose is a violation of the copyright of nasscom and / or its affiliates or associates or of its third-party information providers. This material cannot be copied, reproduced, republished, uploaded, posted, transmitted or distributed in any way for non-personal use without obtaining the prior permission from nasscom.
The nasscom Members login is for the reference of only registered nasscom Member Companies.
nasscom reserves the right to modify the terms of use of any service without any liability. nasscom reserves the right to take all measures necessary to prevent access to any service or termination of service if the terms of use are not complied with or are contravened or there is any violation of copyright, trademark or other proprietary right.
From time to time nasscom may supplement these terms of use with additional terms pertaining to specific content (additional terms). Such additional terms are hereby incorporated by reference into these Terms of Use.

Disclaimer

The Company information provided on the nasscom web site is as per data collected by companies. nasscom is not liable on the authenticity of such data.
nasscom has exercised due diligence in checking the correctness and authenticity of the information contained in the site, but nasscom or any of its affiliates or associates or employees shall not be in any way responsible for any loss or damage that may arise to any person from any inadvertent error in the information contained in this site. The information from or through this site is provided "as is" and all warranties express or implied of any kind, regarding any matter pertaining to any service or channel, including without limitation the implied warranties of merchantability, fitness for a particular purpose, and non-infringement are disclaimed. nasscom and its affiliates and associates shall not be liable, at any time, for any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communications line failure, theft or destruction or unauthorised access to, alteration of, or use of information contained on the site. No representations, warranties or guarantees whatsoever are made as to the accuracy, adequacy, reliability, completeness, suitability or applicability of the information to a particular situation.
nasscom or its affiliates or associates or its employees do not provide any judgments or warranty in respect of the authenticity or correctness of the content of other services or sites to which links are provided. A link to another service or site is not an endorsement of any products or services on such site or the site.
The content provided is for information purposes alone and does not substitute for specific advice whether investment, legal, taxation or otherwise. nasscom disclaims all liability for damages caused by use of content on the site.
All responsibility and liability for any damages caused by downloading of any data is disclaimed.
nasscom reserves the right to modify, suspend / cancel, or discontinue any or all sections, or service at any time without notice.

For any grievances under the Information Technology Act 2000, please get in touch with Grievance Officer, Mr. Anirban Mandal at data-query@nasscom.in.

New

See all

No notification found.

Data Protection: Impact of Recent Developments on the Future of EU-India Digital Trade

Indrajeet Sircar

@IndrajeetSircar

October 30, 2020

Public Policy

439

Earlier in July 2020, the Court of Justice of the European Union (CJEU’s) in the case of Data Protection Commissioner v Facebook Ireland Ltd, Maximilian Schrems (Schrems-II) invalidated the US-EU Privacy Shield, and led to wide-reaching ramifications in terms of cross-border data transfers outside the EU, conducted on the basis of Standard Contractual Clauses (SCCs).

The Decision of the CJEU

The case owes its genesis to a complaint filed with the Irish Data Protection Commissioner (DPC) in 2015, by Austrian privacy advocate Maximilian Schrems. It was contended, that Mr. Schrems’ fundamental rights to privacy under European Laws were not protected in the course of cross-border transfers of his personal data from Ireland to US pursuant to SCCs, since despite the existence of SCCs, US public authorities could carry out surveillance on EU individuals, without any judicial recourse being available to EU individuals against such unbridled surveillance under US laws. Subsequently, the Irish DPC moved the Irish High Court to refer questions relating to the validity of SCCs to the CJEU.

While in its decision in the Schrems-II case, the CJEU held SCCs to be a valid basis for cross-border transfers pursuant to Article 48 of the European Union General Data Protection Regulation (EU GDPR), it emphasised upon the need for organisations to conduct assessments along the lines of the factors for adequacy listed out under Article 45(2) of the EU GDPR, to determine whether European data subjects are afforded appropriate safeguards, enforceable rights and effective legal remedies in the jurisdiction of export.

The CJEU’s decision has led to significant uncertainty for businesses engaging in cross-border data transfers outside EU, since the CJEU placed: (a) an explicit obligation upon data exporters to assess the adequacy level of remedies in the jurisdiction of export; (b) an obligation upon data importers to represent that their legal systems will enable them to achieve meaningful and substantive compliance with the SCCs; and (c) an obligation upon the relevant Data Protection Authority (DPA) of the exporting national jurisdiction, to investigate and come to a conclusion as to the adequacy of the SCCs in light of national laws, and the parties’ due diligence, in instances where complaints are lodged.

Being outside the scope of a formal adequacy decision under the GDPR, coupled with the possibility of multiplicity of opinions across relevant DPAs, has led to uncertainty in terms of achieving meaningful compliance with SCCs and the provisions of the GDPR. Moreover, while the CJEU’s decision looked at SCCs alone, the underlying basis of the decision could be interpreted to imply that similar assessments might be required in the context of other mechanisms such as Binding Corporate Rules (BCRs).

On the specific point of the validity of the US-EU Privacy Shield, the CJEU concluded that US laws do not limit or effectively oversee public authorities’ access to EU personal data; and the Privacy Shield did not grant EU individuals actionable and effective rights before the courts against such public authorities. Consequently, the CJEU held the US-EU Privacy Shield to be invalid.

NASSCOM and DSCI Interaction with EU Delegation to India and Representatives of DG JUSTICE and DG CONNECT

Against this backdrop, NASSCOM and DSCI interacted with members of the EU Delegation to India and the EC Project on International Digital Cooperation, along with representatives of the European Commission’s Department for Justice and Consumers (DG JUSTICE) and the Directorate-General for Communications Networks, Content and Technology (DG CONNECT) earlier in September. The objective of the meeting was to inter alia discuss developments relating to data regulation in India and Europe, including the Supreme Court’s decision in K.S. Puttaswamy v. Union of India, the provisions of the Personal Data Protection Bill, 2019 (PDP Bill), the decision of the CJEU in Schrems-II, and efforts at defining a framework for the regulation of non-personal data, and to discuss the potential impact of the these developments upon the future of India-EU digital trade.

Participants agreed that privacy being held as a fundamental right under Article 21 of the Constitution of India thereby requiring horizontal application of any potential privacy laws to both private entities and the Government, was a significant factor in inspiring confidence in the future of EU-India data transfers.

Moreover it was agreed that while the PDP Bill is a strong step in the right direction towards positioning India as a responsible data processing destination, going forward, and in the aftermath of the Schrems-II decision, certain aspects of the PDP Bill might require review – in particular the scope of exemptions granted to both the Government, and to processors of foreign data, in order to ensure that the India IT/ITeS industries continues to have ease of access to European markets and customers.

Overall, the discussion was a useful starting point for NASSCOM and DSCI’s future engagement with the EC Project, towards ensuring the sustained growth of EU-India digital trade through responsible and secure cross-border data flows.

GDPR pdp personal data protection PDP Bill Meeting general data protection regulation cjeu court of justice of european union schrems maximilian schrems schrems II standard contractual clauses binding corporate rules eu delegation to india adequacy

Disclaimer

That the contents of third-party articles/blogs published here on the website, and the interpretation of all information in the article/blogs such as data, maps, numbers, opinions etc. displayed in the article/blogs and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party article/blogs published, are provided solely as convenience; and the presence of these articles/blogs should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these articles/blogs , you do so at your own risk.

Indrajeet Sircar

Consultant, Public Policy and Outreach