{"id":7825,"date":"2023-09-08T12:00:00","date_gmt":"2023-09-08T06:30:00","guid":{"rendered":"https:\/\/ijpiel.com\/?p=7825"},"modified":"2023-09-08T07:03:20","modified_gmt":"2023-09-08T01:33:20","slug":"data-protection-act-2023-shaping-the-arbitration-landscape","status":"publish","type":"post","link":"https:\/\/ijpiel.com\/index.php\/2023\/09\/08\/data-protection-act-2023-shaping-the-arbitration-landscape\/","title":{"rendered":"Data Protection Act, 2023: Shaping the Arbitration Landscape"},"content":{"rendered":"\n

Abstract<\/span><\/strong><\/p>\n\n\n\n

The construction sector is a cornerstone of India's economy, contributing substantially to its\nGDP and set to become a global construction powerhouse. However, the complex disputes\nwithin this sector have made arbitration the preferred method for dispute resolution, with the\nArbitration and Conciliation Act, 1996 serving as the governing framework. While arbitration\nhas thrived in the digital age, the advent of India's Digital Personal Data Protection Act, 2023\nintroduces a significant challenge, raising questions about data protection, privacy, and\nconfidentiality within arbitration proceedings. This article explores the intricate interplay between\ndata protection and arbitration in the Indian context. It, in its first half delves into the\ninternational landscape, highlighting the varying data protection regulations across jurisdictions\nand their impact on arbitration. The next half then deals with the critical dimension that the\nDigital Personal Data Protection Act, 2023 has added to the arbitration landscape in India and\nexplores its positive and negative implications.\n<\/span><\/p>\n\n\n\n

Introduction<\/span><\/strong><\/p>\n\n\n\n

India's construction sector is a major contributor to the country's economy, representing 9% of\nits GDP and poised to become the world's third-largest<\/a> construction market by 2025.\nConstruction contract disputes are unique, often requiring immediate resolution and involving\nnumerous parties. These complex disputes entail high stakes, damage assessment, data analysis,\nand technical expertise. Construction disputes are typically resolved through Arbitration, with\nparties often initially referring disagreements to dispute boards. The Arbitration and Conciliation\nAct, 1996, amended several times, governs Arbitration in India, covering both domestic and\ninternational cases. Arbitration is crucial in the construction sector due to the growing\ninfrastructure projects<\/a> in India. While Construction Arbitrations can be time-consuming, proper planning can expedite the process. Delays often result from parties, including lawyers and\nclaimants, from drafting Arbitration clauses to final arguments. Arbitration has become the\nprimary dispute resolution method in India's construction industry, particularly for infrastructure\nprojects.\n<\/span><\/p>\n\n\n\n

Foreign investors prefer institutional Arbitration, while Indian parties historically favoured ad\nhoc Arbitration, but institutional Arbitration is gaining traction, notably through the Mumbai\nCentre for International Arbitration (MCIA). SIAC is also increasingly chosen by Indian parties<\/a>.\nThe Act also provides for Conciliation, and settlements can be recorded as enforceable Arbitral\nAwards in Court.<\/span><\/p>\n\n\n\n

Thus, Arbitration is indeed crucial for Infrastructure but, what is more important to note is that\nArbitration is going to be significantly impacted with the new Digital Personal Data Protection\nAct, 2023. Thus, a discussion on the implications of the new Digital Personal Data Protection\nAct, 2023 over Arbitration is imperative given its importance in Project Infrastructure Disputes.<\/span><\/p>\n\n\n\n

While the K.S. Puttaswamy Judgment<\/a> was one of the initial steps in regard to concerns of data\nprivacy violations as sensitive data has become more prone to misuse, these steps became only\nconcrete when the Government introduced the \u2018Personal Data Protection Bill\u2019, 2019<\/a>. The\nloopholes in the Bill sent the Bill back for reconsideration, and ultimately, the same was\nwithdrawn. But recently, the Government introduced a revamped version of the Bill and re-\nnamed it as Digital Personal Data Protection Bill, 2022 (\u201cthe Bill\u201d)<\/a>.<\/span><\/p>\n\n\n\n

Digital Personal Data Protection Act, 2023 (\u201cDPDP Act\u201d)<\/span><\/strong><\/p>\n\n\n\n

A comparison of drafts reveals an expanding scope in the 2023 Act, covering digital personal\ndata and overseas data fiduciaries offering services in India. Stricter breach reporting within 72\nhours is introduced, but data portability, right to be forgotten, and harm regulation is omitted.\nThe regulator transitions to the Data Protection Board of India, with Telecom Dispute\nSettlement and Appellate Tribunal (TDSAT) as the Appellate Tribunal. The evolving drafts\nshowcase a changing data protection approach with strengthened and omitted provisions. The\nDigital Personal Data Protection Act, 2023 introduces notable changes to rights, regulations, and\nfocus, requiring careful evaluation for balanced data protection. The DPDP Act builds upon the\n2022 Act, focusing on notice, consent, legitimate data uses, children's data, and dispute resolution. It narrows the scope to safeguard digital personal data, reflecting evolution.\nEmpowering the Board for monetary penalties and shifting the appellate process to TDSAT\nsignifies a recalibrated, efficient approach to breach penalties and dispute resolution.<\/span><\/p>\n\n\n\n

To understand the implications, it is pertinent to assert that there exists a strong relevance of\nData Protection in Arbitration proceedings, stemming from the idea of \u2018Confidentiality\u2019.\nConfidentiality and Privacy act<\/a> as counterparts in protecting the essence of Arbitration. The\nfeature of Confidentiality, which refers to non-disclosure of materials placed during proceedings,\nno Award being passed unless there is express consent of the parties to arbitrate, and the feature\nof Privacy which makes sure that no third party has access to the Arbitration proceedings\nwithout consent of the parties, gives Arbitration an edge over traditional Litigation. However,\nthis edge is under threat as while Arbitration continues to be dynamic in nature and embraces\ntechnology, Data Protection is also becoming a major concern. While Laws like General Data\nProtection Regulation (\u201cGDPR\u201d)<\/a> exist to protect Data in the European Union, the same is not\nthe case in every jurisdiction. This disparity of Laws protecting Data in different jurisdictions is\none of the major concerns that International Institutions face. The same can be highlighted from\nthe fact that most Respondents in the 2018 Queen Mary International Arbitration Survey<\/a> listed\n\u201csecurity of electronic communications and information<\/a>\u201d as an issue that should be addressed in\nArbitration rules. This demonstrates that users of Arbitration mechanisms are concerned about\nData Security. Further, incidents such as the July 2015 hacking<\/a> of the Website of the Permanent\nCourt of Arbitration (PCA) in the midst of an ongoing maritime border dispute between China\nand the Philippines, the reliance on evidence obtained from WikiLeaks in Yukos<\/em> disputes<\/a> and\nConocoPhilips v Venezuela<\/em><\/a> dispute, further reinforce the concerns relating to Data Protection in\nArbitral proceedings.\n<\/span><\/p>\n\n\n\n

In 2019, the ICCA and the IBA established a Joint Task Force on Data Protection in\nInternational Arbitration Proceedings<\/a> and, in 2022, published a Report on the ICCA-IBA\nRoadmap to Data Protection in International Arbitration<\/a>. Apart from this major step,\ninternational institutions have also taken individual steps for mitigation, which this Article will\ndiscuss in detail later.<\/span><\/p>\n\n\n\n

Thus, through this Article, the authors attempt to explore the implications that India\u2019s new Bill\nwill have, considering these international developments in Arbitration for Data Protection, and\nto understand implications further of the same if implemented. The Article will first deal with the International and Indian positions on Data Protection and Arbitration, respectively and then\nmove on to analysing the Bill\u2019s implications and the potential issues arising out of it.<\/span><\/p>\n\n\n\n

International Position on Data Protection and Arbitration <\/span><\/strong><\/p>\n\n\n\n

Data Protection mainly involves the relationship between the collection and dissemination<\/a> of\nData and Technology. It\u2019s objective is to find the optimum balance between individual Privacy\nrights and the use of Data for business activities<\/a>. However, the fact exists that Data Protection\nand Cybersecurity laws vary from country to country. In various jurisdictions, non-compliance\nwith Data Protection regulations can lead to substantial risks and consequences<\/a>. Thus,\nassociations have come together to create solutions to the issue of Cyber and Data Security in\nInternational Arbitration<\/a>. Initially, international regulations on Data Protection were vague, but\nafter the digital shift in International Arbitration, institutions have updated themselves with the\nchange in times.<\/span><\/p>\n\n\n\n

General Data Protection Regulation (\u201cGDPR\u201d)<\/em><\/span><\/strong><\/p>\n\n\n\n

\nGDPR was drafted with the objective of ensuring the free movement of personal data<\/a> of\n\u2018identified or identifiable natural person[s]\u2019. Its scope is not only restricted to individuals but also\nencompasses legal entities, agencies, government bodies, and international organizations as well.<\/span><\/p>\n\n\n\n

The GDPR as aforesaid, has a broad scope of application, reaching entities in the EU as well as\nentities outside the EU which process Data of EU-based individuals<\/a>. As soon as Data with\npersonal content of EU-based individuals is electronically processed (e.g., in emails or in\ndocuments that are stored electronically), the application of the GDPR must be assumed, and\nthus, it becomes applicable to Arbitration too. It must be noted, though, that Data of legal\nentities (for instance, an Organization\u2019s address or telephone number) are not protected by the\nGDPR<\/a>. However, the personal data of those individuals acting for that legal entity are protected\nby the GDPR.\n<\/span><\/p>\n\n\n\n

\nThe information that is transacted or exchanged<\/a> between the parties, the Counsels, the\nArbitrators and third parties during the Arbitration proceedings qualifies as \u2018Personal Data\u2019, and\nthese named entities qualify as \u201cIdentified or Identifiable\u201d Data subjects. Additionally, the Arbitrators can be the data controllers, who essentially are entities<\/a> responsible for compliance\nwith Laws in place for Data Protection. Arbitrators, being the adjudicating authority in the\nprocess, would ideally be the ones responsible for such compliance.<\/span><\/p>\n\n\n\n

\nNo doubt, GDPR has significantly altered the landscape<\/a> of Data Protection. However, several\nloopholes do exist within it. For example<\/a>, although consent is necessary to enter into an\nArbitration Agreement from a Civil Law perspective, consent as a legal ground for Data\nProcessing under GDPR is not appropriate in Arbitration proceedings.<\/span><\/p>\n\n\n\n

ICCA-IBA Road Map to Data Protection in International Arbitration<\/em><\/span><\/strong><\/p>\n\n\n\n

\nThe roadmap identifies the Data Protection<\/a> issues that may arise in the context of International\nArbitration proceedings, as well as solutions that may be adopted to address them. The\nroadmap\u2019s intended scope and purpose consist of identifying the types of proceedings, and\nArbitral Participants (which is defined in the roadmap as, and limited to, the parties, their legal\nCounsel, the Arbitrators and Arbitral Institutions). Furthermore, the roadmap explores Data\nProtection compliance in International Arbitration with reference to general data protection\nprinciples.<\/span><\/p>\n\n\n\n

Changes brought in by Individual International Institutions<\/em><\/span><\/strong><\/p>\n\n\n\n

\nPrinciple 10 of the ICC-NYC Bar-CPR Protocol<\/a>, is an example of recent changes added for\nData Protection. It states that the initial case management meeting must include discussions on\ndata security matters where \u201creasonable informational security measures, issues about the\nwillingness of the parties to engage in specific security measures, and disputes concerning\nreasonable information security measures\u201d should be addressed.<\/span><\/p>\n\n\n\n

\nThe London Court of International Arbitration, in its 2020 Arbitration Rules<\/a>, empowered the\nTribunals to determine the situation when it would be suitable to adopt specific information\nsecurity measures and methods for addressing the processing of personal data procured from or\nduring arbitral proceedings. Again, while institutions like the Indian Arbitration Forum (IAF)\nand the Singapore International Arbitration Centre (SIAC) leave it to the parties to choose a\nsecured sharing platform, the Honk Kong International Arbitration Centre (HKIAC)<\/a> offers a\nprocess where electronic evidence managers are designated to receive and safeguard the documents during proceedings. In the context of the method of giving consent, the method\nvaries with changes in jurisdictions. Under the Seoul Protocol, the discretion lies with the\ntribunal<\/a>, whereas in the case of HKIAC, the parties, as well as the tribunal, exercise their right to\ndecide. SIAC and IAF<\/a> have more stringent requirements regarding the issue of obtaining\nconsent.<\/span><\/p>\n\n\n\n

Indian Position on Dealing with Data Protection and Arbitration<\/span><\/strong><\/p>\n\n\n\n

\nConfidentiality, as a principle, has been a part of The Arbitration and Conciliation Act<\/a>, 1996,\nsince its inception in terms of Section 75 of the Arbitration. However, in 2019 after the\nrecommendation of Justice B. N. Srikrishna Committee<\/a>, the Arbitration and Conciliation\n(Amendment) Act, 2019<\/a> was enacted, which introduced Section 42A wherein the principle of\nConfidentiality<\/a> was extended to Arbitration proceedings as well.<\/span><\/p>\n\n\n\n

\nThe initial draft of the Personal Data Protection Bill, 2018, was put forward by the Justice\nSrikrishna Committee established by the Ministry of Electronics and Information Technology\n(\u201cMeitY\u201d) with the mandate of setting out a Data Protection Law for India<\/a>. The Government\nrevised this draft and introduced it as the Personal Data Protection Bill 2019 (PDP Bill, 2019) in\nthe Lok Sabha in 2019. Due to delays caused by the pandemic, the Joint Committee on the PDP\nBill<\/a>, 2019 (\u201cJPC\u201d) submitted its Report on the Bill after two years in December 2021 and in\nAugust 2022, in response to the Report of the JPC and the \u201cextensive changes\u201d that the JPC had\nmade to the 2019 Bill, the Government withdrew the Bill. Finally, the latest draft of the Digital\nPersonal Data Protection Bill, 2022<\/a> (DPDP Bill, 2022) was released.<\/span><\/p>\n\n\n\n

Although the new draft does not deal directly with Arbitration proceedings, it still carries\nimportance for it as Data Protection Laws<\/a> would apply to any platform dealing with data online.\nThe Bill seeks to regulate the processing of \u2018Digital Personal Data\u2019, i.e., personal data, which is\neither collected online or which, where collected offline, is digitised. The bill does not cover\nprocessing through manual means or by individuals for \u2018personal or domestic purposes\u2019. The Bill\nadditionally aims to exempt personal data \u201ccontained in a record that has been in existence for at\nleast 100 years\u201d<\/a>.\n<\/span><\/p>\n\n\n\n

The bill ,when viewed in its entirety represents a more lenient framework for Compliance<\/a>, and\nproposes several positive improvements (such as the deletion of Non-Personal Data), also puts\nforward several concepts which have wide-reaching consequences.\n<\/span><\/p>\n\n\n\n

Implications of the Act Over Arbitration <\/span><\/strong><\/p>\n\n\n\n

    \u25cf Data Privacy Compliance in Arbitration:<\/u>
Arbitration often involves the exchange of sensitive personal data, especially in commercial\ndisputes. The Digital Personal Data Protection Act would likely require parties involved in\narbitration to comply with its provisions, ensuring the protection of individuals' personal data.<\/span><\/p>\n\n\n\n

    \u25cf Consent and Data Processing:<\/u>
The act may require parties to obtain explicit consent from individuals when processing their\npersonal data in arbitration proceedings. This may involve obtaining consent from all parties\ninvolved in the dispute.<\/span><\/p>\n\n\n\n

    \u25cf Data Minimization:<\/u>
Data protection laws often emphasize the principle of data minimization, which means that only\nthe necessary data should be collected and processed. In arbitration, this could mean limiting the\ncollection of personal data to what is directly relevant to the dispute.<\/span><\/p>\n\n\n\n

    \u25cf Data Security:<\/u>
The act may impose stricter data security requirements on parties involved in arbitration to\nprotect personal data from breaches or unauthorized access. This could entail implementing\nencryption, access controls, and other security measures.<\/span><\/p>\n\n\n\n

    \u25cf Data Transfer:<\/u>
If arbitration involves cross-border data transfers, the act may require parties to ensure that data\ntransfers comply with its provisions. This could involve using specific safeguards, such as\nStandard Contractual Clauses or Binding Corporate Rules.<\/span><\/p>\n\n\n\n

    \u25cf Data Subject Rights:<\/u>
The act may grant data subjects (individuals whose data is processed) certain rights, such as the\nright to access their data, the right to rectify inaccuracies, and the right to erasure. Parties in\narbitration may need to accommodate these rights in their proceedings.<\/span><\/p>\n\n\n\n

    \u25cf Data Protection Officers:<\/u>
Depending on the scale and nature of data processing in arbitration, parties may be required to\nappoint a Data Protection Officer (DPO) to oversee compliance with data protection\nregulations.<\/span><\/p>\n\n\n\n

    \u25cf Sanctions and Liabilities:<\/u>
The act might stipulate penalties for non-compliance with data protection provisions. Parties\ninvolved in arbitration could face legal consequences if they fail to adhere to data protection\nrequirements.<\/span><\/p>\n\n\n\n

    \u25cf Confidentiality and Transparency:<\/u>
Balancing the confidentiality requirements of arbitration with transparency obligations under\ndata protection laws can be challenging. Parties may need to find ways to protect personal data\nwhile still ensuring a fair and transparent arbitration process.<\/span><\/p>\n\n\n\n

The Act operates on a triad\u2014data principal, data fiduciary, and grievance resolver<\/a>. Though\nprima facie, it looks similar to the General Data Protection Regulation (GDPR), and the Bill has\nwelcome changes and grey shades being doubts and\/or necessary considerations. Unlike the\nGDPR, the Bill boldly defines \u201charm\u201d, \u201closs\u201d, and \u201cpublic interest\u201d in small lists. A first in\nIndia\u2019s legislative history, the Bill uses \u201cher\u201d and \u201cshe\u201d for an individual, irrespective of gender.<\/span><\/p>\n\n\n\n

It is to be noted that in the context of online Arbitration proceedings, the Bill, if implemented,\nwould bring these proceedings under its purview as the elements of a Data Principal, Data\nFiduciary, and Grievance Resolver would come into play. Furthermore, the classification of data\ninto critical, sensitive and general<\/a> further finds the relevance of the Bill in reinforcing the\nprinciple of Confidentiality. But one of the biggest concerns that arise from the Bill is that it\nrestricts itself to personal data, which is either collected online or which, where collected offline,\nis digitised. The exclusion of offline data might lead to great concerns as the recognition of\nsensitive data will only be restricted to online Arbitration proceedings, which only form a very\nsmall portion of the total Arbitration proceedings, which, in the opinion of the Authors, is highly pertinent to note. Thus, offline Arbitration proceedings will be excluded from Data Protection\nLaws. Since the underlying principles of establishing legal safeguards<\/a> to check unfair harvesting\nof personal data are the same regardless of the medium, there\u2019s a case to extend the scope of the\ndraft Digital Personal Data Protection Bill.<\/span><\/p>\n\n\n\n

Also, it is interesting to note that the new Bill seeks to adopt Alternate Dispute Resolution in\nclause 23 of the Bill<\/a> for companies arising before the board. It speaks of \u201cMediation and other\ndispute resolution process\u201d. This implies that the Government is seeking to encourage Alternate\nDispute Resolution as a viable mechanism for resolving disputes in matters as sensitive as Data\nProtection. However, the Bill is not comprehensive when it comes to deriving its effect over\nDispute Resolution proceedings or any legal proceeding that uses online or a digital platform for\nconducting proceedings. For example, Commercial Arbitration Proceedings specifically carry a\nlot of sensitive data, and the probability of misuse of such data is extremely high. Thus, some\nguideline is required to directly address such sensitive data and the need to keep their\nConfidentiality under the purview of the Bill.<\/span><\/p>\n\n\n\n

Conclusion<\/span><\/strong><\/p>\n\n\n\n

The 2022 Bill is definitely a positive step towards ensuring data privacy for Indian citizens.\nHowever, the Bill still needs to be refined and tweaked to make it more comprehensive and\nfurther increase its scope of application. While the Laws placed under the Bill will become\napplicable to Arbitration if implemented, its uneven application of data protection might lead to\nthe creation of several grey areas in Law. Also, considering that access to technology remains a\nprivilege in India, the new Bill will be only able to protect data for those who have the privilege\nof accessing digital platforms for Arbitration proceedings.<\/span><\/p>\n\n\n\n

Disclaimer<\/span><\/strong><\/p>\n\n\n\n

The views and opinions expressed by the Authors are personal.<\/em><\/strong><\/span><\/p>\n\n\n\n

About the Authors<\/span><\/strong><\/p>\n\n\n\n

Mr. Yazad Maneck Udwadia is a Counsel practising primarily at the Bombay High Court. After graduating with a B.B.A., LL.B. (Hons.) Degree, he has also completed a Post Graduate Diploma in Business Management (PGDBM, 2022) and a Post Graduate Diploma in Arbitration and Mediation (PGDAM, 2022) while pursuing Litigation and Dispute Resolution before joining Counsel practice.<\/span><\/p>\n\n\n\n

Kaushiki Singh is a 3rd year BALLB Law student in Jindal Global law School.<\/span><\/p>\n\n\n\n

Editorial Team<\/span><\/strong><\/p>\n\n\n\n

Managing Editor: Naman Anand<\/em>
Editors-in-Chief: Abeer Tiwari & Muskaan Singh<\/em>
Senior Editor: Abeer Tiwari<\/em>
Associate Editor: Kaushiki Singh<\/em><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Abstract The construction sector is a cornerstone of India's economy, contributing substantially to its GDP and set to become a global construction powerhouse. However, the complex disputes within this sector have made arbitration the preferred method for dispute resolution, with the Arbitration and Conciliation Act, 1996 serving as the governing framework. While arbitration has thrived […]<\/p>\n","protected":false},"author":263,"featured_media":7908,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":"","wp_social_preview_title":"","wp_social_preview_description":"","wp_social_preview_image":0},"categories":[1,14],"tags":[],"_links":{"self":[{"href":"https:\/\/ijpiel.com\/index.php\/wp-json\/wp\/v2\/posts\/7825"}],"collection":[{"href":"https:\/\/ijpiel.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ijpiel.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ijpiel.com\/index.php\/wp-json\/wp\/v2\/users\/263"}],"replies":[{"embeddable":true,"href":"https:\/\/ijpiel.com\/index.php\/wp-json\/wp\/v2\/comments?post=7825"}],"version-history":[{"count":85,"href":"https:\/\/ijpiel.com\/index.php\/wp-json\/wp\/v2\/posts\/7825\/revisions"}],"predecessor-version":[{"id":7911,"href":"https:\/\/ijpiel.com\/index.php\/wp-json\/wp\/v2\/posts\/7825\/revisions\/7911"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ijpiel.com\/index.php\/wp-json\/wp\/v2\/media\/7908"}],"wp:attachment":[{"href":"https:\/\/ijpiel.com\/index.php\/wp-json\/wp\/v2\/media?parent=7825"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ijpiel.com\/index.php\/wp-json\/wp\/v2\/categories?post=7825"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ijpiel.com\/index.php\/wp-json\/wp\/v2\/tags?post=7825"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}