India Exempts Outsourcers From New Privacy Rules

Personal data sent to India by customers outsourcing work to companies in the country will not be covered under new rules governing the collection of such information, the government said on Wednesday, providing relief to India’s large outsourcing industry.

The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules 2011 introduced in April require companies or their intermediaries to take consent in writing from individuals about the use of the sensitive personal information they collect.

The new rules would make it difficult for Indian outsourcers to operate if they were required to take written consent from individuals in other countries whose data they collect and process through call centers and business process outsourcing operations.

As a result of the new rules, companies that rely on India-based outsourcing service providers will be required to adjust their data collection practices to conform to Indian data protection rules, even though their current practices may comply fully with U.S. or European Union privacy rules, said Lawrence Graham LLP, a firm of London-based business lawyers, in a note earlier this year.

A clarification issued on Wednesday by the Ministry of Communications and Information Technology, through the country’s Press Information Bureau, said that a “body corporate” providing services relating to collection, storage, dealing or handling of sensitive personal data or information under contractual obligation with any legal entity located within or outside India is not subject to the requirement of the new rules.

The government has also stated that “body corporate” referred to under the new rules are Indian companies, removing the interpretation that U.S. and European companies sending data for processing to Indian outsourcers would have to follow Indian rules while collecting data in their countries.

The clarification by the government removes any such confusion, said Kamlesh Bajaj, CEO of the Data Security Council of India, a company set up by Nasscom (National Association of Software and Service Companies) to set standards for data security and privacy for outsourcers.

It is now clear that it is not the outsourcer, but the companies collecting and sending the data that are responsible for protecting the privacy of the data, according to the rules of the countries they operate in, Bajaj said on Wednesday.

Bajaj said in July that the government had reassured Nasscom that a clarification would be issued, after Nasscom represented to the government that the outsourcing industry would be hit if the rules were enforced.

Under the clarification issued by the government on Wednesday, Indian companies collecting data from individuals, known as “providers of information,” will continue to be covered under the new rules governing collection and use of sensitive personal information.

The preferential treatment provided to a section of companies, the outsourcers, could, however, be struck down in court, said Pavan Duggal, a cyberlaw consultant and advocate in India’s Supreme Court.

The clarification has not been issued under any provision of the country’s IT Act, and in fact violates the spirit of the IT Act, which does not limit the jurisdiction of its laws to companies within India, Duggal said. The clarification is also vague and could lead to a variety of companies claiming to be exempt from the personal data rules, he added.

John Ribeiro covers outsourcing and general technology breaking news from India for The IDG News Service. Follow John on Twitter at @Johnribeiro. John’s e-mail address is john_ribeiro@idg.com