February 1, 2021
For the third consecutive year, following the publication of Gibson Dunn’s ninth annual U.S. Cybersecurity and Data Privacy Outlook and Review on Data Privacy Day, we offer this separate International Outlook and Review.
Like many recent years, 2020 saw significant developments in the evolution of the data protection and cybersecurity landscape in the European Union (“
EU”):
CJEU” or “
Court”) struck down as legally invalid the EU-U.S. Privacy Shield, on which some companies relied to transfer personal data from the EU to the U.S. While companies are turning to other frameworks to transfer personal data, such as Standard Contract Clauses (“
Key takeaways:
No end-use restrictions on data requesters: There are no audit mechanisms to see if entities that seek data are, in fact, using it for stated purpose (public good or sovereign).
Businesses don’t have a say in data sharing: There is no proper mechanism for data businesses to reject requests for data from data trustees.
Businesses will have to deal with high compliance costs: Businesses, small and big, will have to think about compliance mechanisms for both PDP and NPD frameworks.
Proxy issue a real concern: A company could theoretically set up a Section 8 company to set up a HVD, and seek data from other data businesses.
Friday, January 15, 2021
2020 was the year in which the world went more digital than ever before, owing to the pandemic that altered life as we knew it. One of the silver linings of the year was the spotlight on the importance of data and data flow. Taking this cue, the Indian Government took significant steps in tech policy and data regulation in 2020, viz. non-personal data, health data, financial data, and data related to e-commerce and other consumer facing services. The judiciary has also made observations on individual rights regarding data privacy, and the ever-deliberated
Personal Data Protection Bill, 2019 (“
PDP Bill”) was a moving piece under Government deliberation during the year.
5.2.1.
According to the draft UTM Policy, the DigitalSky Platform will
also act as a pan-India UTMSP, apart from being a central data
archive and a central regulatory platform. DigitalSky s UTMSP
will be hosted on the DigitalSky Platform and offer services
similar to other UTMSPs. The DigitalSky UTMSP will be available to
government and non-government stakeholders for the same services
being offered by private UTMSPs.
We recommend that the draft UTM Policy provide clarity on
whether the DigitalSky UTMSP will be operating based on the data
provided by UTMSPs, whether there will be a data sharing
arrangement with the private players and whether they will be