Trai recommendations on data privacy may affect app-based business: IAMAI

The Internet and Mobile Association of India (IAMAI) today said Trai's recent recommendations on data privacy are based on a 'voice and SMS regime' and may affect data-driven businesses. The industry body also pointed out that the Sri Krishna Committee (which is working on a detailed data protection framework for the country) under the IT Ministry -- the nodal body for apps and handset manufacturers -- is already looking into the issue of consent.

In a statement, IAMAI said the recommendations, in-principle, are around users' ownership of data, no use of meta data to identify individuals and 'privacy by design' principle coupled with data minimisation should be made applicable to all the entities in the digital ecosystem. "...The Sri Krishna committee, set up MeitY, is already examining them and other principles," it noted.

IAMAI said the Trai recommendation to formulate standards of anonymisation and de-identification is "akin to putting the cart before the horse". "...Till such time the Sri Krishna committee is out and a notification or a law is passed, making these standards would be groping in the dark," it asserted. Yesterday, the Telecom Regulatory Authority of India (Trai) came out with its recommendations to Department of Telecom (DoT) related to privacy and said firms collecting user data don't have a right over it.

Terming the existing data protection framework as inadequate, the sectoral regulator had also stated that companies should not use meta-data to identify users and should disclose any data breaches. "The Trai recommendations on privacy are premised on a voice and SMS regime. It is not meant for data driven business, which the app companies are. App companies use pseudo anonymous data and app companies do not give call detail records," IAMAI said today.

It added that Trai's assertion that existing framework is not sufficient to protect telecom consumers and current rules applicable to telecom service providers is prima facie, contradictory. The regulator warned that if the same rules are applied, "then there is a possibility that we will never be able to build data businesses in India".