Digital Personal Data Protection Act 2023: Impact on Indian Healthcare Industry

The Digital Personal Data Protection Act, 2023 (DPDP Act) is a new law that regulates the processing of personal data in India. It aims to protect the privacy rights of individuals and create a framework for data governance and accountability. The DPDP Act will have a significant impact on the Indian healthcare industry, which is still in its early stages of digital evolution. Some of the key impacts are:



·         The DPDP Act will require healthcare providers and entities to obtain explicit consent from data principals (individuals whose data is processed) before collecting, using, or sharing their personal health data, which is classified as sensitive personal data under the law.

·         The DPDP Act will also mandate healthcare providers and entities to implement appropriate security measures, conduct data protection impact assessments, appoint data protection officers, and comply with the codes of practice and standards issued by the Data Protection Board of India.

·         The DPDP Act will enable data principals to access, correct, erase, port, and restrict the processing of their personal health data, as well as seek redressal for any grievances or violations of their rights.

·         The DPDP Act will create new opportunities for innovation and collaboration in the healthcare industry, as it will facilitate the use of personal health data for research, public health, emergency response, and other purposes, subject to certain conditions and safeguards.


Implications of Digital Personal Data Protection Act 2023 in Healthcare Sector

 The Digital Personal Data Protection Act, 2023 (DPDP Act) will have various implications in healthcare sector in India, such as:

·         It will require healthcare providers and entities to adopt privacy-conscious and data-responsible practices, such as obtaining explicit consent, implementing security measures, conducting data protection impact assessments, and appointing data protection officers.

·         It will enhance patient trust and confidence in the use of their personal health data, which is classified as sensitive personal data under the law.

·         It will create new opportunities for innovation and collaboration in the use of personal health data for research, public health, emergency response, and other purposes, subject to certain conditions and safeguards.

·         It will also create challenges for the development and adoption of data-driven technologies, such as artificial intelligence and machine learning, which may require balancing the protection of patient privacy and the potential of these technologies.

·         It will interact with other existing or proposed laws and policies related to health data, such as the Ayushman Bharat Digital Mission (ABDM), which aims to create a unique health ID named ABHA and a digital health record for each person.

Government Initiatives to Protect Patient data

The Information Technology Act 2000 governs provisions related to Protected Health Information (PHI) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Patient data, including health information, is treated as sensitive personal data or information and, under the IT Act, offers some degree of protection to the collection, disclosure, and transfer of sensitive personal data.

Also, long before DPDP Act 2023, the Government introduced the Digital Information Security in Healthcare Act (DISHA), India’s counterpart of the Health Insurance Portability and Accountability Act (HIPAA), aimed at providing healthcare data privacy, security, confidentiality, and standardization and establishment of the National Electronic Health Authority (NeHA) and Health Information Exchanges. While this act aims to encourage the pan-India adoption of e-health standards, DISHA has not yet come into force.

Penalties in Digital Personal Data Protection Act 2023

Under the DPDP Act, 2023, you have the right to file a complaint with the Data Protection Board of India (DPB), which is the enforcement body established under the act, if you suspect or experience any non-compliance by a third party that collects or processes your personal data. The DPB can inquire into the complaint, direct any remedial or mitigation measures, inspect any document, summon and enforce attendance of any person, and impose penalties for non-compliances. The act allows only monetary penalties for breaches or non-compliance, ranging from INR 50 crore to INR 250 crore, with a maximum penalty of INR 500 crore for significant data breaches. You can also seek compensation from the DPB for any harm caused to you due to the non-compliance by the third party. However, the act does not provide for any criminal liability or imprisonment for non-compliances.



Data Principal

A key ingredient in laws in other countries is the power to impose penalties up to a particular amount as prescribed for offenses or as a percentage of total worldwide turnover, whichever is higher.

A data principal is under an obligation to not register a false or frivolous complaint with a data fiduciary or the Board, not to furnish any false particulars or suppress any material information.

DPDP Act 2023 has introduced a penalty of up to ₹10,000/- (Rupees Ten Thousand) on the data principal for failure to comply with its proposed obligations.

 The proposed DPDP Act 2023 introduces the concept of ‘Deemed Consent’, where the data principal is deemed to have given consent for processing their personal data.

Consensual processing of personal data may be done in case of medical emergencies involving a threat to life or an immediate threat to the health of the Data Principal. In the context of such processing, a parallel may be drawn with India’s draft Health Data Management Policy by ABDM released in April 2022, which also envisages provisions relating to the processing of Personal Data in case of medical emergencies.

 Notably, the ABDM contemplates the appointment of a nominee to provide valid consent on behalf of the Data Principal in case such Data Principal becomes seriously ill or mentally incapacitated or where the data principal is facing a threat to life or a severe threat to health and is unable to give valid consent.

Unlike the DPDP Act 2023, the ABDM does not propose Deemed Consent in the absence of a nominee but instead shifts the right to give valid consent on behalf of the Data Principal to an adult member of the family of the Data Principal.

Despite the recommendation under the JPC Report, the DPDP Act 2023 has kept the 'Non-Personal Data' of the individuals, such as information collected by the Government, NGOs, and other private sector entities, outside its ambit. The usage of phrases 'as it may consider necessary' and 'as may be prescribed' can lead to administrative ambiguities. The autonomy of the Data Protection Board, which is entrusted with overseeing the protection of individual's personal data and ensuring compliance with the provisions of the law, is not reassuring. Further, the Government and its instrumentalities can retain personal data for an indefinite period irrespective of whether the purpose for which data was processed has been fulfilled.

Conclusion

By 2030 India is projected to be the world’s third-largest economy and will have one of the world’s largest digital personal data footprints in motion and at rest.

The DPDP 2023 Act’s essentiality shines in our strengthening role in the global order. With the G20 Presidency and multiple Free Trade and Regional Trade Agreements in place, we must find solutions for Data Free Flow with Trust and cross-border data flows.



Comments

Post a Comment

Popular posts from this blog

Comprehensive Guide to Conducting a Detailed Data Audit for GDPR Compliance

Image
  Conducting a data audit is a crucial step in implementing GDPR or any other data privacy law like Digital Personal Data Protection Act, 2023. A thorough audit helps organizations understand what personal data they hold, how it is processed, and ensures compliance with relevant regulations. Here’s a step-by-step guide to conducting a detailed data audit: Step-by-Step Guide to Conducting a Detailed Data Audit 1. Establish the Scope and Objectives Objective: Define the scope of the audit and its goals. Actions: Identify the departments, systems, and processes that will be included in the audit. Determine the objectives, such as compliance with GDPR, identifying data flows, and assessing data protection measures. Outcome: A clear and defined scope and objective for the data audit. 2. Assemble an Audit Team Objective: Create a cross-functional team to conduct the audit. Actions: Include members from IT, legal, compliance, HR, marketing, and any other relevant departments. Assign roles...
Read more

Understanding Record of Processing Activities (ROPA) and Its Role in Global Privacy Compliance and DPDP Act 2023 Implementation

Image
  A Record of Processing Activities (ROPA) is a detailed documentation that organizations are required to maintain under various privacy regulations, most notably the European Union’s General Data Protection Regulation (GDPR). It serves as a comprehensive record of all personal data processing activities carried out by an organization. Key Elements of ROPA under GDPR Data Controller Details: Name and contact details of the organization and its representatives. Purposes of Processing: Clear description of the purposes for which the data is processed. Categories of Data Subjects and Personal Data: Types of data subjects (e.g., employees, customers) and categories of personal data (e.g., contact details, purchase history). Recipients of Personal Data: Any third parties with whom the data is shared, including contractors and service providers. Transfers to Third Countries: Information on data transfers to countries outside the EU, including documentation of appropriate safeguards....
Read more

Data Protection Officer: Roles and Responsibilities under DPDPA & GDPR

Image
With the recent enactment of the Digital Personal Data Protection Act, 2023 (DPDPA) in India, there's a heightened emphasis on ensuring the privacy and security of personal data. This has propelled organizations to align their operations with the new legal framework. Central to this adaptation is the consideration of appointing Data Protection Officers (DPOs) to oversee and ensure compliance. The Data Protection Officer (DPO) is pivotal in ensuring that an organization adheres to its data protection obligations. Their responsibilities span across compliance with the data protection mandates and reporting directly to the organization's apex leadership. The appointment and role of a DPO are entrenched in Section 10(2) of the DPDPA. The GDPR leans towards ensuring the DPO's independence from the organization's executive board. However, under India's DPDPA, the DPO must report to the highest echelons of management and represent significant data fiduciaries. This raises...
Read more