Data Deletion — A Key Compliance under the Digital Personal Data Protection Act, 2023

Introduction

The phrase “data is the new oil” has created a misconception that all pieces of data have value and so it should be stored. Thinking that there is value in data, all types of data collecting entities such as individuals, companies, government departments and professionals, etc. are in the habit of storing data indefinitely, beyond their regulatory obligations or operational needs, leading to data bloating. There are three primary reasons why they become data bloated: (i) the fondness to accumulate; (ii) the inertia to throw things; and (iii) procrastination. Humans have had a hoarder’s mentality to store all types of digital data coupled with indolence, this has resulted worldwide data to reach an astounding 175 zettabytes as per the International Data Corporation (IDC’s) Report¹. A zettabyte is equal to a trillion gigabytes. Just to understand the magnitude, as per David Reinsel (Sr. VP of IDC)² if 175 zettabytes data were put in discs, then we would have a stack of discs that could get us to the moon 23 times.

Data retention and absence of maximum period of retention in India

Maintaining data records as a legal requirement has existed for quite some time in India. Many Indian laws contain provisions with expressions such as “maintenance of record” or “preservation of register”, which mandate retention of data. Retention of data is a pan-sectoral practice, from the Minimum Wages Act, 1948³ to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021⁴, an entity is required to retain a data for a minimum time-frame, however, such laws and rules are usually silent on the maximum time-frame for retention of data and the consequences of indefinite retention, etc.

Regulations such as the New Drugs and Clinical Trials Rules, 2019⁵ require biotech companies to retain all data, records related to such bioavailability or bioequivalence study for a period of 5 years; the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002⁶ mandate medical doctors to maintain medical record of patients for 3 years. Such data retention regulations were usually designed in absence of concerns regarding privacy aspects of the individuals concerned, which led to data being stored indefinitely.

What the Digital Personal Data Protection Act, 2023 has to say about data retention?

The Digital Personal Data Protection Act, 2023 (DPDPA)⁷ which is India’s novel privacy law, regulates processing of digital personal data and prescribes data protection rights of data principals.⁸ It applies homogenously to all entities which process⁹ personal data, including storing such data. The DPDPA like the global privacy laws such as General Data Protection Regulations (GDPR)¹⁰ in Europe or the Health Insurance Portability and Accountability Act, 1996 (HIPAA)¹¹ in USA imbibe the principals of storage limitation¹² and data minimisation.¹³ These principles pose a duty on the data processing entity (or the data fiduciary¹⁴) to collect only minimum amount of personal data which is required to deliver the service and erase such personal data when all purposes relating to its existence is discharged. Many entities are already retaining data as per the requirement of their sectoral regulations. Usually such data sets also have “personal data” component such as name, age, contact details embedded, which brings it within the purview of the DPDPA and the data erasure compliances enshrined in it. Since the DPDPA’s objective and legal framework relating to privacy is entirely new with no direct predecessor, a lack of continuity or lineage from an already existing Indian law, the unheard data erasure mandate of the DPDPA will pose a challenge for all entities.

Data slimming for companies, an inescapable task for future

Entities have been used to storing excess data due to the ease associated with storage of such data. The plummeting cost of storage has resulted in massive data junkyards in all organisations. The risks of leakage of old and archived data sets are much higher today due to the advent of the DPDPA. Prospectively, all entities will not only have to abide by the prescribed timelines but also craft exhaustive data retention policy for their organisation/office. Jumping the signal here could lead to the entity being fined up to 5.2 million EUR¹⁵ in Indian jurisdiction. In foreign jurisdictions such as the GDPR, the implementation of storage limitation is approached with seriousness and rigour, for example, the Finnish Data Protection Authority (DPA) fined¹⁶ EUR 0.8 million to an online retailer after investigations revealed that it had not specified storage period of the data collected for the customer account of its online shop, and was storing such data for indefinite periods in its systems.

Conclusion

Data erasure is a legal right¹⁷ provided to the data principals and so its casts a duty towards all data fiduciaries.¹⁸ Data erasure can be achieved by data deletion, anonymisation or destruction. Deletion should not be confused with merely hiding data or putting the same in the trash bin. Data deletion effectively includes a proof of deletion. Globally, presence of standards such as National Institutes of Standards and Technology (NIST)¹⁹ SP 800-88 or the Department of Defence (DoD)²⁰ 5220.22-M or ever evolving practices such as cryptographic shredding, auto deletion triggers bring to light the importance attached to letting go of data. Around the world, letting go of excess data has become a process owing to operational needs and privacy laws, in India also, entities will have to imbibe the idea of letting of excess data for smooth data governance.