The intersection of competition law and data privacy aligns closely with user protection and empowerment. While the Competition Act, 2002 is designed to preserve market competitiveness, the Digital Personal Data Protection Act, 2023 (DPDP Act), empowers individuals by ensuring lawful collection and processing of their personal data.
With the enactment of the DPDP Act, it is timely to discuss how the two laws coalesce and complement one another rather than conflict with each other.
Benefits of building robust compliance infrastructure
The DPDP Act has been seen to potentially increase compliance costs for the industry, by mandating significant changes in the way companies collect, use, store, etc. personal data. However, creating a robust compliance framework based on consent not only addresses these concerns but also enhances firms’ competitive capabilities in the market.
Additionally, a business qualifying as a ‘Significant Data Fiduciary’, based on the volume of personal data being processed, risk of harm to the consumers, public order, etc., will need to undertake data impact assessments and appoint a Data Protection Officer based in India.
While compliance costs may be perceived as a potential entry barrier under competition law, building a robust infrastructure focused on safeguarding user privacy encourages and facilitates effective competition in the long run. Notably, the DPDP Act recognises the impetus for innovation in India and offers exemptions for certain notified start-ups (depending on the nature of the handled personal data). This exemption mechanism, in turn, lowers the entry barriers and stimulates competition within the market.
Implementing strong consent mechanisms to establish a level playing competitive market
Aside from specific legitimate use cases where personal data can be processed without consent, the DPDP Act makes the collection and processing of personal data conditional upon prior affirmative consent from the user. The principle of ‘purpose limitation’ is at the heart of the DPDP Act and explicitly provides that personal data can only be used for specified purposes. It emphasises that the provision of a service cannot be contingent on the user consenting to the processing of information for unrelated purposes. This acts as a deterrent for large technology companies, preventing them from promoting and advertising their own products to consumers.
This provision resonates with the Standing Committee’s observations in its Report on ‘Anti-competitive Practices by Big Tech Companies’ which opined that regulation is required to prevent digital gatekeepers (or Systemically Important Digital Intermediaries) from, engaging in the following conduct:
(i) Cross-use of personal data obtained from a relevant core service in other services
(ii) Signing in consumers to other services of the platform in order to combine personal data, unless their consent has been obtained.
The DPDP Act will restrict companies from using their data advantage to create exclusionary effects for competitors or engage in discriminatory practices, thus reducing anti-competitive practices.
Countervailing power to consumers
The DPDP Act introduces a unique ‘Consent Manager’ mechanism which enables users to control their data through an accessible platform. This manager, registered as a third-party under the Data Protection Board, possesses technical and financial expertise, and acts as an agent for users. While the concept of ‘Consent Manager’ is unique to India and is still in its nascent stage, its significance is expected to grow as it garners substantial user base. This will grant the ‘Consent Manager’ considerable bargaining power over businesses, by empowering users and encouraging the industry to develop fair and non-discriminatory terms in their privacy policies.
Conclusion
Implementing the DPDP Act may result in short-term inconveniences and disruptions. However, in the long term, it promises to create an equitable corridor of opportunities for all stakeholders.
As we progress into the digital future, the convergence of competition laws and data privacy is inevitable. Needless to say, the harmonious coexistence of robust competition rules and data privacy protections will play a pivotal role in building a sustainable digital ecosystem that benefits individuals, businesses, and society as a whole.
