Leading with purpose creates wins for consumers, community and country: Hina Nagarajan of Diageo India

'Largest employer in the world is inefficiency': CRED's Kunal Shah at Storyboard18 Global Pioneers Summit

Unheard tales of Maggi’s redemption: How poetry and nostalgia revived an iconic brand

Content creator Raj Shamani’s journey: Prioritizing substance over virality

MIB’s Ashwini Vaishnaw at Storyboard18 DNPA Conclave: Govt working for fair compensation for media houses

Nobody’s Perfect Retro Porsche Ad

In Conversation With Raja Rajamannar, Mastercard

Shahid Kapoor And Varun Ganjoo Speaks On PokerBaazi's Campaign

In conversation with IHCL’s Puneet Chhatwal & GroupM’s Kate Scott-Dawkins

Why are brands including e-sports in their sports marketing itinerary?

Storyboard18 x The English Nut: How to pronounce these 10 brand names

Experts' Take On Reinvention Of Ad Campaigns Through Technology

Experts Speak On Key Emerging Trends In Cannes Lions Entries

Leaders of the future have to be outstanding human beings: Nestle MD

In conversation with VMLY&R’s Hari Ramanathan

The Ministry of Electronics and Technology (MeitY) on Friday released draft rules of Data Digital Personal Data Protection Act (DPDPA) for public consultation. The policy think tanks and civil society members are raising concerns over multiple aspects of the draft rules. The government will seek feedback from stakeholders till February 18. 

In an overview of the draft rules of DPDPA, personal data has been mandated to be localized in India, barring in cases and countries as exempted by the Centre. Further, the rules state that the parents and guardians will have to verify their identity before an individual under 18 years of age can sign up for online platform or on social media. 

Experts suggest that the parental consent rules are likely to add a heavy compliance burden on all parties involved. E-commerce, social media and gaming platforms will all come under the category of data fiduciaries.

The DPDP Act was passed by Parliament on August 9, 2023 — about six years after the Supreme Court upheld privacy as a fundamental right. Despite being announced last year, the Act has not yet taken effect since its rules and regulations are still have not been released or finalised.

Dhruv Garg, Partner - Indian Governance & Policy Project said, “The public consultation on draft DPDP rules is likely to see expansive and critical discussion on multiple aspects. Provisions relating to data localisation for certain specified personal data when being processed by significant data fiduciary will definitely take centre stage. Additionally, restrictions and requirements imposed on sharing of personal data with foreign state and their agencies will see concerns from data fiduciaries operating across jurisdictions.” 

The draft rules of DPDPA states that, "A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child and shall observe due diligence, for checking that the individual identifying herself as the parent is an adult who is identifiable if required in connection with compliance with any law for the time being in force in India."

This is in reference to reliable details of identity and age available with the Data Fiduciary. It further refers to the details voluntarily being provided identity and age or a virtual token mapped which is issued by an entity entrusted by law or the Central Government or a State Government. 

Garg said, “The language and intent of provisions in relation to verifiable parental consent and proof of adulthood of parents will need greater clarity in due course. Civil society may stress on the need to create balance between privacy and power of government to access data on ground of national security/state function.”

Multiple think tank policy consultants have raised concerns over the challenges posed by emerging technologies like Artificial Intelligence. Civil Society members have raised severe concerns over government's intent to demand and collect data of Indian citizens citing national security concerns. 

Aparajita Bharti, Founding Partner, The Quantum Hub Consulting said, “DPDP Rules have been much awaited and a draft gives broad direction to the industry to start preparing for compliance. However, from the rules it is still not clear what the implementation timelines are likely to be.” 

Bharti further said, “On Children’s data, while the government has left room for innovation on age estimation, there are more specific obligations for verifying parents identity. This may lead to a high compliance burden on platforms. There are also some positives around allowing tracking of children's data and behavioural monitoring for their safety and ensuring that they do not encounter inappropriate content. One key concern in the rules is potential room for bringing data localisation requirements for significant data fiduciaries as they mention that a committee may do so in the future. The draft rules also do not explicitly address exemptions, processing grounds, or other frameworks specifically tailored for AI model training purposes.” 

Experts argue that the central government retains the authority to restrict the cross-border transfer of specific personal data by significant data fiduciaries while Rule 15 does not explain the exemptions under Section 17(2)(B) related to research, archiving, or statistical purposes, leaving ambiguity around whether AI models trained on personal data for research are covered by these exemptions. 

Kazim Rizvi, Founding Director, The Dialogue – a thinktank – said, “The DPDP Rules provide essential guidance for implementing the legislation. However, advancing the framework requires multi-stakeholder discussions to offer deeper insights into its application, fostering innovation while safeguarding the rights of data principals. Key areas that demand further attention include verifiable consent mechanisms, cross-border data transfers, and breach notification processes."

<a href="https://www.storyboard18.com/digital/dpdp-act-meity-releases-draft-data-protection-rules-for-public-consultation-52286.htm" rel="noopener" target="_blank">DPDP Act: MeitY releases draft data protection rules for public consultation</a>

The DPDP Act has a provision to impose a penalty of up to ₹250 crore on data fiduciaries which are bodies responsible for determining the purpose and means of processing of personal data.

The DPDPA rules, which have been delayed for several months, will reinforce the existing data privacy law, while amendment to the IT rules will address crucial issues like artificial intelligence-driven misinformation and deepfakes until a comprehensive Digital India Act is formulated.

Policy think tanks, civil society call DPDP draft rules 'vague', raise concerns

The Ministry of Electronics and Information Technology (MeitY) in its recent workshop held on October 14 informed the stakeholders that the government will not be exempted from obligations for Data Fiduciary under Digital Personal Data Protection Act, 2023. The government will be equally subjected to penalties in case of a data breach. 

The inaugural workshop was attended by around 100 stakeholders on the government’s invitation at the India Habitat Centre in New Delhi. Senior officials from MeitY were present during the workshop. The MeitY officials also informed that the government is conducting training for its subsidiaries for data protection and streamlining compliance mechanism. 

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), data fiduciaries, i.e., entities determining the purposes and means of processing personal data (either alone or in conjunction with other persons), are largely responsible and liable for compliances. Data Fiduciary’s primary role is to put in place SOPs and organizational and technical measures to ensure data safety. 

A stakeholder on condition of anonymity said, “Government is one of the largest entity which collects and stores personal data of citizens in the country. The Meity officials were clear that the government agencies are not exempted from the DPDP Act. Infact, the government is training its subsidiaries such as NIC, NICSI, CDAC among others to streamline their compliance mechanism for DPDP Act.” 

The government has also informed the stakeholders that the rules will have incremental changes to and the companies must be compliant to the DPDP Act. 

Another stakeholder told Storyboard18 that “The government has said that the companies must have technical and organizational measures in place and not wait for clarity to be outlined in the rules which will be out soon for consultation.” 

Transfer of Data offshore 

Dr. Aruna Sharma, Policy Advisor and Practitioner Development Economist "The stakeholders have clearly stated that while the government insists on local storage of data, there is a need to allow aggregated data to be processed offshore for analytics.” 

Sharma said, “Currently, multiple agencies are permitted to access personal data, a practice that stakeholders have objected to. They argue that only one agency, following a strict regime, should have access to personal or any data without prior consent.” 

E-commerce and fintech companies are urging the government to allow aggregated data to be processed offshore for analytics, as it plays a crucial role in expanding exports. She added. 

Sources have said that the government will notify stakeholders on aggregated data being taken offshore. The government will share the list of countries which are banned from storing data of Indian citizens.

Government not exempted from DPDP Act, MeitY informs stakeholders

Business and employment-focused social media platform LinkedIn is reportedly using account holders' data to train its Artificial intelligence (AI) models.

As per the updated policy of LinkedIn, launched last week, the company issuing people's interactions with its generative AI features for training purposes. The company said that whenever it relies on user data for training purposes, it seeks to minimize personal information. The company relies on privacy-enhancing technologies to redact or remove personal data.

Notably, users can opt out of having their data shared for training AI models. Users can access information about what data LinkedIn has used for training through its data access tool. However, the company holds people's data for training purposes till they delete it.

Like Meta, LinkedIn also uses a 'silent approach' wherein users have no idea that their data would be used for training AI models, Medianama reported.

An advocacy group None of Your Business (NYOB) flagged this concern in June. It filed a complaint against Meta in multiple countries in the EU for using people’s data since 2007 to train AI models. This data includes things like posts or photos and their captions. 

If a user doesn’t actively watch out for updates in the companies’ privacy policies, they wouldn’t know that the companies are using their data to train AI models. 

At present, LinkedIn is not using users' data for training purposes in the EU, the UK, the European Economic Area, and Switzerland.

LinkedIn uses users' data to train AI models

The Indian government is taking a proactive approach to the digital age by establishing five working groups under the Ministry of Electronics and Information Technology (MeitY). According to media reports, these groups will delve into critical areas like data anonymization, zero-trust architecture, and security for internet-of-things (IoT) devices and mobile devices.


Their primary objective is to develop and implement clear guidelines that will streamline the implementation of e-governance projects across various ministries and departments. Additionally, existing guidelines for mobile security and online learning systems will be revised to reflect advancements in technology.


The Ministry of Information Technology is actively working alongside all relevant ministries for the project. According to ministry officials the idea of proactive approach ensures they stay ahead of potential challenges by anticipating them and developing solutions before they arise.


Currently, reports on data anonymization and mobile security guidelines are undergoing review. Meanwhile, work continues on crafting guidelines for zero-trust architecture, online exams, and IoT devices. These efforts will ultimately contribute to an updated India Digital System Architecture, a project whose initial draft was released in 2022 for public feedback.


MeitY forms five new working groups for data privacy, security, and e-governance efficiency

The Union cabinet has cleared the personal data protection bill which clears its way to be tabled in the Parliament during the upcoming Monsoon session, CNBC Awaaz reported quoting sources.


This is the version of the bill that was published by the government in November last year for public consultation.
By just focusing personal data, the new bill has done away with regulating the use of non-personal data. It has also removed the need to locally store all user data by businesses, and instead allowed the leeway of storing such data in 'trusted geographies'.

The draft bill requires a data fiduciary -- i.e. an entity which processes user data -- to give an itemised notice to user on data sought to be collected, in clear and plain language. It also mandates that the user should be allowed the right to give, manage, withdraw consent from sharing his/her information.

For example, when a person closes their savings bank account, the bank has to delete his/her data pertaining to the account. Similarly, if a user deletes their social media account on a particular platform, their data has to be deleted as the bill mandates that a data fiduciary must retain personal data only so long as it is required for the purpose for which it was collected.

The bill states that a data fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children. Before processing any personal data of a child, the fiduciary has to obtain verifiable parental consent. Moreover, non-fulfilment of these obligations relating to children can lead to penalties of up to Rs 200 crore.

A few months back, Minister for Electronics and Information Technology Ashwini Vaishnaw courted controversy after, in an event, he claimed that the Parliamentary Standing Committee on IT had "approved" the bill. Soon after, members of the committee such as Karti Chidambaram, John Brittas and others refuted these claims.



Union cabinet clears personal data protection bill

When one steps in, the other one takes leave – that’s what the cycle of AdTech and MarTech is all about. Today, consumers have the option of interacting with brands through a surfeit of channels and they expect a seamless experience. It has become even more essential for brands to acquire the right set of customers at the minimal acquisition cost, engage with them, retain them, and maximize their lifetime value.

For businesses to be able to achieve this, traditional ways of approaching Month In Focus Int Logo voottechnology investments do not suffice. Companies need new technologies that can help navigate the complex customer journeys.

Shedding light on this convergence called MadTech, Neeraj Pratap Sangani, CEO, Hansa, Cequity says, “AdTech and MarTech projects are interdisciplinary and collaborative but very few organisations and senior leaders understand or act on this with any urgency. Today everyone talks about delivering a connected customer experience, but a customer experience is not only about AdTech, MarTech and automation. The piece that all organisations need to also focus on equally is about data - its availability, quality, architecture and much more.”

“Both AdTech and MarTech need to work in unison to deliver a superlative customer experience. I keep saying – it takes a lot of hard work to make your customer’s life easy. The fact is that technology has changed the business of marketing forever. Effective calibration of AdTech, MarTech and Data together is a potent combination to enable business impact,” he adds.

Marketing and advertising have been on a trajectory of convergence for a while now - they’ve moved from two sides of the same coin to being ever present in each other’s lives. Pooja Jauhari, Group CEO, VMLY&amp;R Network, India, and Sunder Madakshira, CEO, Rezolve India and ex-CMO, Adobe, cannot help stressing on MadTech being about hyper personalisation.

Jauhari says, “While what we’re termed marketing technologies were always focused on personalised and targeted efforts, broader ad tech was focused on broader data sets to communicate with. In its simplest form, the combination of the two, aka MadTech, is about personalisation at scale.”

Madakshira opines, “The constant search for one source of truth, building a unified profile across channels, a desire to have hyper personalisation and maintaining a strong brand essence are drivers for this.”

From a brand point of view, Arpanarghya Saha, chief digital officer, Nippon India Mutual Fund, says, “Well, we are in the business of money and that puts us in a space where we have to be very, very responsible. So, while brands in other categories are getting gung-ho about MadTech, our endeavor is to build SmarTech. We believe in creating lucid digital solutions and immersive experiences that have intelligence embedded at the core and those which empower our investors to take smarter and well-informed decisions related to their investments.”

With the antitrust lawsuit being filed against Google and Google being asked to segregate its ad business from its other businesses, what kind of a reality check or threat does it provide to other AdTech and MarTech platforms?

Sangani of Hansa Cequity likes to look at this issue differently. “I believe that it is a logical progression, and it brings to fore the monopolistic ecosystem that Google has created, curated, and meticulously cultivated over the years.”

Data went through many years of unregulated usage, and with both the Google lawsuit as well as the privacy measures that Apple has taken, the ability to use data freely has taken a major hit. “And while the focus on first party data by brands has negated this to a certain extent, the only way to move beyond this threat for AdTech and MarTech is to combine forces and focus as much on broader brand building as data driven personalisation. This will drive a growing focus on using brand connections with consumers without over reliance on cookies and will scale the growth of MadTech,” says Jauhari.

At the heart of the matter is a subject of great relevance – how does one reduce data domination of Google? How do we enable transparency in pricing? And, how do we ensure that privacy and personalisation co-exist?

This calls for a huge change in approach and mindset across the ecosystem. Sangani and Madakshira reiterate that brands and organisations will have to recalibrate some pieces of their data and tech strategy to meet their business objectives – customer privacy needs to be preserved, total transparency needs to be ensured in the way technology is deployed, data collected and protected and used to engage with the consumers.

Madakshira points out, “This means that some of the past paradigms and assumptions that platforms made will have to be changed. For instance, you need to follow the most stringent of the laws on the topics and make them global standards for the companies and not try and use different approaches by country that they operate in. This is the time to relook at the business models which served in the past but will simply not work in the future owing to the lack of societal trust in platforms anymore.”

“The lawsuit may come up for hearing in 2023 and nobody knows the outcome but it’s time that we work towards creating a more level playing field,” brings out Sangani.

With the exchange of digital and consumer data, and the blurring lines between AdTech and MarTech, privacy infringement is a major concern for most consumers. How do brands deal with this matter?

Brands believe that such concerns are rooted in the way the commercialization of consumer data has shaped up over the past years and how everyone in the ecosystem has tried to leverage available touchpoints to reach out to their customers.

“However, as can be seen today, the ecosystem is also evolving and appropriate checks and controls are being brought in and there is soon going to be a balance with the power finally resting with the consumers on how, when and where they want to be reached or not reached at all. Taking consent and abiding by it has been our fundamental construct with respect to our consumers. As a brand, our focus is to build our own capabilities which will help us assimilate, analyze, understand and utilize our proprietary data in such a way that we are able to serve our investors in the best way possible and make their investment journeys more fruitful,” says Saha of Nippon Mutual Fund.

Note to readers: Storyboard18’s new Month In Focus initiative spotlights themes and topics that are pushing marketers to reshape and rethink how brands interact with today’s customers. Our theme for this month is Stacks &amp; Strategies, a martech and adtech spotlight on how decision makers and marketers are advancing the adoption of new technologies and tech-driven strategies in the brand marketing ecosystem. From the defining trends and preparing for a cookiepocalypse to how progressive martech strategies help fast track business and brand growth. Catch this special on Storyboard18.

Stacks & Strategies | The Game of MadTech and Data

Just a few weeks back, one of the leading social media platforms agreed to pay $150 million over the misuse of consumer-consented data. Since the GDPR took effect in May 2018, we’ve seen over 900 fines issued across the European Economic Area (EEA). If we carefully analyze the nature of the fines and how it could have been avoided, it broadly falls across two areas:

Get Data: Ensure that when you can accept consent in one click, you should enable refusal in one click as well; not once but session-based, with real-time control.

Use Data: Commit to protect it well, clarify the purpose of usage and be transparent about it; above all, never process sensitive information on health, religious belief, etc.

While data owners and processors are making significant investments towards technologies that help them get data, very little is being done by them today that mitigates risks while using it. Not just social media platforms, many brands have failed to uphold their consumers’ privacy while using them.

Getting data is just the start. A good start, that is. It is the usage that needs to be safe, secure, and transparent. It is important to note that most of the fines awarded by GDPR and FTC in the recent past are towards misusing the data and not while getting the data.

Platforms need consumer data for one and only purpose. Gain better insights so that they can nurture and grow their user base. And while doing so, grow the economic value of the relationship through offering personalized experiences.

How can we personalize content to our consumers without using their data? All things being equal, it is the personalization of the user experience that differentiates one platform from the other. How can we incentivize them to come to our platform again and again? Will they pay for our content? Should we look for sponsors (read advertisers) to manage this value exchange till we reach a critical mass? What can we offer our sponsors in return for their support? And so began the invisible contract between brands, platforms, and consumers in exchanging value with each other.

- Give me quality content for discounted prices or for free in return for using my data

- Give me quality reach for my brands in return for sponsoring this value exchange

- Give me quality yield per consumer in return to produce good content

This three-way relationship between brands, platforms and consumers is the most critical part to understand in digital marketing today. Personalization that upholds privacy compliance needs to recognize this three-way relationship, and constantly update the purpose of using the consumer data and be transparent about it.

This means, not just the platform, the brand that is exchanging value with the platform needs to jointly work together in managing consent and permissions. Systems of engagement need to re-architect their technologies to be able to do this. While data encryption is already becoming table stakes, advertising technologies will quickly need to ensure that the efforts towards personalization do not explicitly trace it back to the consumer during the engagement.

There are very many approaches towards the same, but the jury is still out on which one succeeds.

Note to readers: Storyboard18’s new Month In Focus initiative spotlights themes and topics that are pushing marketers to reshape and rethink how brands interact with today’s customers. Our theme for this month is Stacks &amp; Strategies, a martech and adtech spotlight on how decision makers and marketers are advancing the adoption of new technologies and tech-driven strategies in the brand marketing ecosystem. From the defining trends and preparing for a cookiepocalypse to how progressive martech strategies help fast track business and brand growth. Catch this special on Storyboard18.

DATA PRIVACY