Users will need to be notified as Indian names reveal info: Experts

India’s draft data protection bill has a ‘caste’ googly for Indian firms and startups, which could prove to be challenging to abide by, according to several policy makers. Caste has been categorised as sensitive personal data under the draft law. This means users need to be given explicit notice while companies collect their data.The catch, however, according to several lawyers working on the draft law, is that many Indian names reveal the caste of the person. Hence, companies will need to take consent while collecting names every single time — a challenging and painstaking task. This comes at a time when the government has asked for public feedback on the bill by September 10, which some industry stakeholders believe is not enough time.Apart from caste, the draft privacy law also puts tribe, financial data, passwords, health and biometric & genetic information under the sensitive personal data category. Various policy makers and associations are drafting their submissions to the government to enforce changes in the bill before passing the current version as the final draft. A majority of experts working on the new privacy law believe the government should present further clarity on a host of issues, including how to treat data when a person’s name indicates his or her caste.Law firm Trilegal partner Rahul Matthan said, “This is a very tricky area for companies. Indian names, at times, tend to at least give an indication of the person’s caste. Do the companies then have to ask for consent explicitly while processing the name as data? If so, it will be a major challenge for any company.” Surname, which in many cases clearly indicates a person’s caste, has been a sensitive issue in the country where people, at times, out of choice, opt to not put it in their official records fearing unfair treatment in getting jobs and social profiling.The draft privacy law submitted by the Justice Srikrishna Committee has essentially recommended that a user’s privacy should be protected online and that there should be adequate reasoning and notice to process people’s personal data. According to another independent lawyer, startups in the healthcare sector are also trying to figure how to best treat sensitive health data of users without violating the privacy aspect of it.

from Economic Times https://ift.tt/2N6z56l