Contemporary Issues

[By Aayushi Choudhary & Bhanupratap Singh Rathore] The authors are students of Gujarat National Law University, Gandhinagar. Three months after the withdrawal of the Digital Personal Data Protection Bill from the Lok Sabha, the government has come up with revamped legislation. This is the fourth time the government has proposed a bill on digital data protection. The first bill was introduced in 2018 based on the recommendations of the Justice BN Srikrishna Committee. After making some modifications, the government introduced the Personal Data Protection Bill in 2019, which was referred to the Joint Parliamentary Committee. The Committee submitted its report along with a draft for 2021 titled “Data Protection Bill, 2021.” After the committee made extensive changes to the draft, the government withdrew the bill. The purpose of the upcoming bill, as mentioned in the draft, is to provide for the processing of digital personal data. This is done in a manner that recognises both the right of individuals to protect their personal data and the need to process personal data for lawful purposes. Some of the highlights of the bill are: Regulatory Body: The proposed regulatory body framework resembles the European Union’s General Data Protection Regulation. Although the functions and duties of the board are not clearly explained in the bill, the present Data Protection Board has simpler functions than the earlier bills. Child Protection: Every person below the age of 18 years will be considered as a child under the Act. The bill prohibits the tracking of children or targeting advertisements. The bill provides a penalty up to Rs 200 crore for non-fulfillment of any obligation provided under it. Penalties: In the previous draft, penalties were proportional to the company’s global turnover. It was 4% per breach and 2% per breach for non-compliance with any provision. This is done away with in the proposed draft, which provides a fine up to 500 crore instead. Many experts have expressed reservations about such a high penalty. In reality, it would be in the range of 50 to 500 crores. It would be in proportion to the kind of breach, kind of impact that it can create on the end user, and the involvement of the company. The Data Protection Authority and Board will analyse the breach and determine whether a penalty will be imposed. In fact, these penalties are low for tech giants. For example, if the Board fines Google $500 million, it is a very small sum in comparison to the penalties imposed on it by various jurisdictions around the world. If companies can justify that they have managed data well and, despite all the safeguards, a breach has happened, they will not be penalised because there is a finite probability that despite all the security provisions, a breach can happen. Twitter, for example, can be hacked despite spending billions of dollars on security and adhering to numerous security protocols. There should always be room for improvement, and any such industry should be given flexibility. Difference from previous bill: The previous bill was drawn from the EU General Data Protection Regulation (EU GDPR), whereas the present bill is drawn from Singapore’s Personal Data Protection Authority. This is a shorter version with only 30 provisions, whereas the earlier draft had 90 or more. The thirty sections cover areas that are needed for the enforcement of the right to privacy and data protection in a holistic way. It keeps the bill short and simple with simple language to make it understandable. The previous bill lost its essence as cumbersome amendments kept on happening. Data portability, which allowed users to view quotes from one platform to another, has been eliminated under the new bill. The earlier draft also included non-personal data, a concept that is not clear even at the global level, hardware certification, or algorithmic accountability. The revised proposal eliminates all of this and focuses solely on personal data regulation. The “right to be forgotten” is likewise not specifically mentioned in the present bill. Cross-border data flow: The bill eliminated previous restrictions on the flow of data from one jurisdiction to another. In any case, the flow of data is restricted to countries that the government has designated as friendly to the flow of data. Therefore, this will apply to all personal information, not just sensitive and critical data. Centre’s uncontrolled power: Placing a large portion of the important functional section of the legislation for future regulation by the national administration and some sections of the act is indicative of the administration’s unrestrained authority. For example, section 19 of the draft mentions the Data Protection Board of India. Under the bill’s rules, the regulator, which will be granted the same control and authority as a civil court, will be established by the government. Instead of that, the regulator should operate separately from the state and be capable of implementing individuals’ basic liberties while safeguarding due process. Moreover, the measure empowers the government to exclude any government institution from it that it considers appropriate. This power will blatantly contradict natural justice principles. Analysis: For the first time, the government has introduced legislation that makes the person providing the data responsible for its accuracy. It is not only the duty of the data processors or those who are keeping the data to protect it; it is also the primary duty of the individuals to provide accurate data and not file frivolous complaints. The Constitution includes a chapter on citizen responsibility, which has yet to be implemented. This bill has made those duties a part of the law. Section 30(2) of the bill proposes an amendment to Section 8(j) of the RTI Act. As per the present Act, information that relates to personal information is exempt from the Act. However, if the Central Public Information Officer finds that it would serve a larger public interest, the exemption can be revoked. If the proposed bill is approved, personal information will be completely exempt, even if the CPIO otherwise finds that disclosure to be consequential

[By Tanish Gupta and Shubham Gandhi] The authors are students at the National Law University, Jabalpur. In an intriguing case of Lifestyle Equities CV v Hornby Streets (MCR) Ltd., the English Court of Appeal, in addition to other issues, was called upon to decide the applicable law in determining the binding effect of the arbitration agreement on a non-signatory, arising out of a trademark assignment,  viz. the law governing the arbitration agreement or the law governing the assignment of the trademark. While the majority ruled in favour of the former, Snowden LJ, in his dissent, found the latter to be the applicable law since the contractual consensus of the parties to the agreement does not answer the issue raised. In this article, the authors aim to elucidate the controversy, the cogent dissent of Snowden LJ, and the inadequate analysis provided in the majority opinion. Facts of the Case The present suit has been instituted against the alleged infringement of the registered trademark by Santa Barbara Polo & Racquet Club (“Respondent”). Lifestyle Equities C.V. (“First Appellant”) and Lifestyle Licensing B.V. (“Second Appellant”) is the registered proprietor and licensee, respectively, of the concerned trademarks, which include the figurative mark – the “Beverly Hills Logo” and a wordmark – “Beverly Hills Polo Club” in the UK and the EU. The above-stated trademarks were originally owned by a California-based company, BHPC Marketing Inc. After many assignments in 2007 and 2008, the concerned trademarks were ultimately assigned to the first appellant in 2009. The respondent owns and uses the “Santa Barbara Logo,” similar to the appellants. Given the similarity between the two logos, a dispute arose between the original owner and the respondent in 1997, and to resolve the same, both parties entered into a co-existence agreement. The agreement, in its Clause 7, provided for an arbitration clause and laid out the Californian law as the governing law: “Any controversy, dispute or claim with regard to, arising out of, or relating to this Agreement, including but not limited to its scope or meaning, breach, or the existence of a curable breach, shall be resolved by arbitration in Los Angeles, California, in accordance with the rules of the American Arbitration Association. Any judgment upon an arbitration award may be entered in any court having jurisdiction over the parties.” In 2015, the first appellant obtained a consent letter from the respondent to register the concerned trademarks in Mexico. The Reasoning of Lower Court The Appellants, earlier reached the courts of the United Kingdom and the European Union, praying for relief for infringement of their trademarks by the respondents. The arguments advanced by the appellants in support of their claim were that they were not parties to the 1997 Agreement, that they were not aware of its existence at the time of undertaking assignments of trademarks, and that they were not bound by the arbitration agreement by virtue of Article 27(1) of Regulation 2017/1001 on the EU Trade Mark, and Section 25(3)(a) of the Trade Marks Act 1994. The provisions state that until the agreement is registered, it would remain “ineffective as against a person acquiring a conflicting interest in or under the registered trademark in ignorance of it.” On the other hand, the respondent presented an application for a stay and referred the matter to arbitration, pursuant to Section 9 of the Arbitration Act, 1996. The respondent, while relying on Californian law and the doctrine of equitable estoppel in regard to the 1997 Agreement to obtain the consent letter in 2015, contended that the 1997 Agreement bound the appellants as assignees of the trademarks. In light of the arguments of both parties, Hacon J, who delivered the Lower Court’s judgment, decided to stay the claim and reasoned that under English law, the appellants had become parties to the 1997 agreement by virtue of having dealt with the respondent in 2015. Alternatively, with the application of the governing law, i.e., the Californian law, the parties were bound by the 1997 agreement as it was a burden attached to the trademark assignment and thus passed with it. Lastly, the doctrine of equitable estoppel precluded the appellants from disputing the binding effect of the 1997 Agreement on them. The Judgment of the Court of Appeal The three-judge Bench, though while granting a stay, disapproved of the reasoning of Hacon J. with regard to the first issue. The Bench affirmed that since neither party had argued on the matter of the appellants being parties to the 1997 Agreement under English law, the Judge should not have decided on the same. On the issue of equitable estoppel, the Bench agreed that reliance on the doctrine was misplaced since the appellants did not rely on the 1997 agreement but rather on the consent letter, and their conduct was not “inextricably intertwined with the obligations imposed by” the 1997 Agreement. The second issue pertained to whether the parties were bound by the 1997 Agreement on account of the applicability of Californian law. It is at this point that the Bench had divergent opinions. Though the Bench agreed that the issue was not of ‘interpretation’ of the arbitration agreement, the majority characterized the issue of whether a non-signatory is bound by the arbitration agreement “as an aspect of the scope of the agreement.” Referring to Kabab-Ji SAL v Kout Food Group (“Kabab-Ji”), wherein the U.S Supreme Court held that the governing law of arbitration agreement also governs the question of who are parties to the agreement, the majority opined that the logical corollary would be that the question of who is bound by the arbitration agreement is governed by the governing law as well. The Compelling Dissent of Snowden LJ Snowden LJ’s dissent is premised on the distinction between the issues, namely, who is a party to an arbitration agreement and who is bound by it. The questions pertaining to ‘interpretation’ and ‘scope’, which deal with matters covered under the arbitration agreement, are to be resolved based on consensus between the parties to the agreement. The parties’

[By Rajeev Dadhich] The author is a student at the Institute of Law, Nirma University. The Digital Lending route has acquired prominence, which raised Reserve Bank of India’s  (“RBI”) concerns over the unbridled engagement of third parties, mis-selling, breach of data privacy, unfair business conduct, charging of exorbitant interest rates, and unethical recovery practices. To curb these concerns, on November 18, 2021, RBI released the Report of the ‘Working Group on digital lending including lending through online platforms and mobile apps’ (“the Report”), which targets the enhancement of customer protection and making the digital lending ecosystem safe and sound while encouraging innovation. Moving a step forward, on August 10, 2022, RBI issued a Press Release ‘Recommendations of the Working group on Digital Lending’ (“the Press Release”), which targets implementing the recommendations the Working Group gave. Against the backdrop, this article provides the scope of the Press Release and analyze the recommendations. Further, this article provides a detailed discussion on key factors of the Press Release like the cooling-off period, data privacy, reporting mechanism, and framework on FLDG. Lastly, the article provides concluding remarks and suggestions. Scope of the guideline issued The guideline comprises three Annexures which broadly illustrate three types of entities included in the digital lending process: Annexures I: Entities regulated by the RBI and permitted to carry out lending business; Annexures II: Entities authorized to carry out a lending as per other statutory/regulatory provisions but not regulated by RBI; and Annexures III: Entities lending outside the purview of any statutory/ regulatory provisions. First, the recommendation envisaged under Annexure I is implemented with immediate effect. This guideline will regulate not only Regulated entities (“REs”) but also the Lending Service Providers (“LSPs”)/ Digital Lending Apps (“DLAs”) engaged by REs to extend various permissible credit facilitation services. The entities included in the ambit of REs have been defined under Regulation 3 of KYC Direction, 2016. Second, in furtherance of Annexure II, the respective regulator/ controlling authority still requires some deliberations before implementing them. The non-regulated entities are defined in question 4 of FAQ published by RBI as stock exchange, and housing finance companies. Third, with respect to Annexure III, the Working Group has suggested specific legislative and institutional interventions for consideration by the Central Government. Recommendations implemented with immediate effect Operational Conduct and Customer Protection The disbursement of the loan, repayment of loan, etc. shall directly take place between REs and borrowers, and there shall be no intervention of any third party viz LSPs in transferring the loan or repayment amount. LSPs will operate as an agent of RE and will carry out functions like customer acquisition, underwriting support, pricing support, etc. RE shall monitor the activities of LSPs and be accountable for the same. Further, REs shall be liable to pay any fees applicable to LSPs, and no fees can be directly charged on borrowers by LSPs. Annual Percentage Rate (“APR”): The APR is required to be disclosed to the borrowers. The APR means all-inclusive cost and margin including the cost of funds, processing fee, maintenance charges, etc., except contingent charges like penal charges, late payment charges, etc. The borrowers should be provided with a cooling-off/ look-up period, which means an exit opportunity without the levy of any penalty for a certain period by just paying the principal and APR amount. A Grievance Redressal Officer (“GRO”) should be appointed who will be dealing with borrowers’ complaints regarding FinTech and digital lending. The details of the GRO shall be published on the website of the RE, its LSPs, and on DLAs. The responsibility of engaging GRO lies on REs. Key Facts Statement (“KFS”) is required to be disclosed. KFS includes a recovery mechanism, cooling-off/ look-up period, details of grievance redressal, and APR. Further, the consent of the borrower is required to increase the credit limits. Data Protection of the borrowers DLAs should obtain absolute consent from the borrowers before collecting any data with an option to accept or deny the consent and a right to be forgotten. LSPs are prohibited from storing any personal data of borrowers except the primary data viz name, address, contact details of the customer, etc. REs will be held accountable for data privacy and security of the customer’s personal data. Regulatory framework In cases where REs is extending credits through new digital products such as ‘Buy Now Pay Later’ (“BNPL”) need to report to CIC and adhere to outsourcing guidelines issued by individual Banks. Analysis This guideline is just the first installment in a three-series process. Till further instructions, the present Press Release will be the operative guideline for Res, LSPs, and DLAs. Cooling-off/look-up period As stated above, the Press Release provides the borrower with the option of a cooling-off/ look-up period. However, it does not specify the timeframe allowed to borrowers under this period, and the same has been left on the deliberation of the board approval policy. It is noted that a cooling-off period is a right of the borrowers to save them from paying the entire interest for the facility period, and the same should be reasonable. Inference can be drawn from Master Direction – Reserve Bank of India (Transfer of Loan Exposures) Directions, 2021, which state that a cooling period shall not be less than 12 months from the date of such transfer. Therefore, a similar timeframe should be allowed for the borrowers in the present digital lending regime. Data Privacy The Report highlights an exponential increase in complaints regarding the operations of DLAs. The Report explained DLAs as mobile and web-based applications with an interface that facilitate borrowing by a financial consumer from a digital lender. Subsequently, on December 23, 2020, RBI through Press Release cautioned borrowers regarding illegal players, excessive interest rates, hidden charges, breach of data privacy, and regressive recovery process by DLAs. Moreover, DLAs largely being mobile application poses a potential threat to data stored in mobiles viz sensitive personal data, etc. For instance, the recent data breach of CashMama leaked the personal information of thousands of people bearing

[By Sarthak Virdi] The author is a student at the National Law School of India University, Bangalore. Introduction Regulatory Sandboxes (RS) are artificial environments used to test innovations and have been relied on in the fintech sector. The RBI defines them to be testing environments with regulatory relaxations, the purpose of which is to gauge the viability of products by estimating benefits and risks. The benefits of RS have generally been that first, they help in foreseeing the risks of emergent technologies and the appropriate legal strategies to contain them; second, they are cost-efficient methods of testing products before a market roll-out and third, they enable financial inclusion and help regulators maintain control. The current literature on RS analyses their viability from two perspectives – first, the role of regulators as promoters of innovation or ‘opportunity-based regulation’[1] and second, the shift towards a principles-based regulation instead of a rules-based regulation.[2] However, there is a dearth of literature addressing RS in the Indian fintech market, especially in the context of cryptocurrencies. This paper fills this gap by arguing for RS for cryptocurrencies by first, taking the two perspectives to show that RBI is already operating with an opportunity-based and a principle-based regulatory approach. Second, it shows that across the RS models employed worldwide, the legalization of cryptocurrencies is not a prerequisite to promoting innovation in cryptocurrencies through RS, while protecting consumers. India by not allowing RS for cryptocurrencies and conflating the question of legalisation with experimentation can miss out on a big opportunity in the fintech market. Regulatory Approaches Opportunity-Based Regulation & Experimental Legal Regimes The role of regulators is generally understood to not be one that engages in active promotion of innovation and supporting entrepreneurs, but rather one that controls market disruption.[3] RS problematize this conception by making them active participants in the creation and promotion of market disrupters.[4] The benefits of RS however make it worthwhile for regulators to engage with them. They activate and increase the inflow of venture capital while simultaneously reducing the regulatory uncertainty and risk that can arise as a result of disruptive technology. The success of RS in kickstarting innovation has been well-documented, especially in the context of the UK, where RS have increased average venture investment amounts by 6.6 times.[5] The RBI has already made a shift towards opportunity-based regulation by promoting competition in Payments and Settlement Systems in India through sandboxes. It recognized the role sandboxes can play in promoting innovation while avoiding systemic risks. In the absence of any principled opposition to such an approach to regulation, the justification for not excluding cryptocurrencies from RS lies in a mistrust of the technology in itself. However, the question of the legality of cryptocurrency as a form of legal tender needs to be separated from the promotion of blockchain technology, for as Imelda Maher argues, competition has entered regulatory domains and the role of regulators has shifted to that of ‘steering’ from that of ‘rowing’[6] and the RBI must not miss the opportunity of experimentation. Rules-Based Approach v. Principles-Based Approach Strict, rule-based regimes post compliance costs that act as barriers to entry and thus discourage innovation, which is highly disadvantageous because fintech can drive growth in other industries while simultaneously addressing concerns like financial inclusion.  Principle-based regulation, which implies adherence to broader principles instead of hard rules, provides regulatory flexibility which reduces compliance costs while creating a collaborative relationship between regulators and private firms. RS employ the principle-based approach, for regulators exempt them from adherence to legislation while agreeing on principles they must comply with. Principle-based regulation helps contain the disruptive effects of unanticipated innovations for it provides regulators sufficient exposure to the technology to develop a legal framework to respond to it, instead of completely distancing themselves from emerging technologies. Further, given that innovations in fintech are fast-paced, RS create temporary regulatory frameworks that can help contain disruptive effects, instead of disincentivizing innovation. In the context of RS, the principles regulators generally require adherence to include consumer protection, market competition, and investor protection.[7] The table below summarizes the approach worldwide to show a move towards opportunity-based regulation, with regulators involved in promoting disruptive technologies, even cryptocurrencies. Further, the principle-based approach employed in RS does not lead to ignorance of consumer interests, for as shown, all jurisdictions build strong measures to protect consumer interests. Jurisdiction Conditions to Apply for Inclusion in a Regulatory Sandbox Is the regulator promoting disruptive technologies? Is Cryptocurrency a part of the RS Program? Legal status of cryptocurrency Protection of Consumer Interests Hong Kong Innovative technologies need to be utilized along with an increase in the range and quality of products. Yes Yes No law to regulate cryptocurrency; not accepted as legal tender. Compensation for financial losses and the option to exit the trail lies wits consumers.[8] United Kingdom The product must support businesses in the financial services market or any regulated activity, it must significantly differ from existing products and must produce consumer benefits.[9] Yes Yes Cryptocurrency exchanges are legal. Compensation for losses and the business must prove adequacy of capital to cover the losses. Australia The product must be new in itself or an adaptation or an improvement of an existing service or product. Applies the Net Public Benefit Test and the Innovation Test. Yes Yes Cryptocurrency exchanges are legal. Consumers are to be compensated for losses.[10] Singapore The financial service should include a new or emerging technology or use the present technology in an innovative way while bringing some benefits to consumers. Yes Yes Not accepted as legal tender, but can be legally exchanged. Boundary conditions are to be clearly defined in order to protect consumer interests. Arizona, United States of America The product must be innovative and should be based on an emerging technology or be a reimagination of existing technology. Yes Yes Not accepted as legal tender, but can be legally exchanged. Arizona consumer protection laws remain applicable and laws relating to consumer lending are incorporated within the RS.[11] Lessons From Foreign Jurisdictions This