On August 3, 2023 Prime Minister Narendra Modi passed the DPDP (Digital Personal Data Protection) Bill in the Lok Sabha and it is changing the way companies function. Especially while handling data. The advertising sector is no different.
On the sidelines of the launch of ‘Privacy & Progress: Pillars of Digital Bharat’ report, Storyboard18 caught up with Manisha Kapoor, chief executive officer and secretary-general, Advertising Standards Council of India (ASCI), where she spoke about the DPDP Bill, its impact on the advertising space, the importance of consumer consent and more.
Edited Excerpts
It’s been more than a year since the Digital Personal Data Protection Bill (DPDP) was passed. How has the passage of the bill impacted the Indian advertising sector?
It’s still early days, because the rules have not yet been notified.
But yes, directionally, they know that it’s coming and they know the broad areas that they have to work on. So at least, the preparedness part of it is something that most of the industry has started in different phases. Some have really moved ahead, some have not, which is basically on the current audit of how their data is coming, where it is going, how it is getting stored, how consent is sought today, etc.
The other aspect is also a massive amount of training, both internally and externally, because a lot of companies also work with external partners with whom data is shared, or who are collecting data on their behalf.
So far, it was not really designed for privacy. Privacy was an afterthought. And now you have to correct some of the things that have been there in the past. Whether companies are designing campaigns or designing any kind of communication or any kind of interface with the consumer, privacy needs to be built into the design which allows for consumers to choose their privacy.
One of the things that the act talks about is consent and informed consent.
As consumers, we also want the internet to work smoothly. We are also used to a certain way in which everything is customised for us. So, that is a balance that has to be sought. Advertisers are essentially, to a great extent, funding the internet through online advertising.
Now, a lot of the advertising is also from medium and small enterprises who otherwise may not have been able to advertise on TV or print either, but digital because it’s affordable. So again, how do you balance the need of the funders of the internet as well?
Let’s say, it was difficult for them to target certain people and advertising became ineffective. Then again, that money may not come in. And therefore, progress in that sense may also dive. So it’s a tricky issue with several moving parts.
The thing is that all stakeholders need to find an equilibrium and balance in terms of all their needs getting fulfilled. So, it’s also an evolving conversation. Technologies will continue to develop. Consumers will start to also get used to the way in which they’re interacting with the internet.
They will have more information in their hands. So I think the Act has really come at the right time, but it is still an evolving conversation. What the Act is today versus the requirements five years from now could be quite different because the technology may evolve in such a way that what we are saying today may or may not be fully relevant at that time.
So, we have to kind of keep pace with what is happening.
When you spoke about preparedness, in what way are brands or advertisers prepared or taking steps to be prepared? Could you provide examples?
A lot of internal training has started. A lot of audit work in terms of how the consumers’ current data is being used and not being used. Are they compliant with other regulations across the world? For example, MNCs may also learn from their GDPR (General Data Protection Regulation) journeys and how they are working on compliance towards that.
So, I think that level of preparedness is starting. But, it is not across the board and not the same across sectors. Medium and small enterprises may not have training departments, legal teams and compliance teams, etc.
So for them, I think the challenge is in terms of, how do they also familiarise themselves with the new law? So, it’s the entire ecosystem, which has to be trained and retrained. Hence, several people will have to play a role in doing that whether it’s the government, whether it is regulatory bodies like ASCI, whether it’s advertisers etc. Everyone has to come together to increase the capacity of the entire industry to be able to be compliant with this.
Has the passage of the DPDPA bill made or is making it difficult for advertisers to personalise their offerings or cater to their target audience?
It comes down to informed consent, right? If I am giving you the consent to do that, then it’s fine. But, if I am not giving you the consent, it should not be done.
So, I think, it is not whether something will completely go away or something will not go away, but it is about whether I give the permission to do that. I’ll give you an example.
I have downloaded DigiYatra (a digital initiative to transform travel experience) because it’s very convenient. It saves me time because I can just go in with facial recognition. But yes, I’ve given my face recognition. I have linked it to my Aadhaar card. So I have given away some of my data.
I’ve given it for a convenience that I’m getting. Now, supposing that data is taken and is used in some other way, which is unconnected with let’s say my travel, then yes, I would feel that, it is not a fair use of my data.
But maybe, I have signed that away. I don’t know fully, right? So again, it’s a question of me being informed about what my data is going to be used for. And as long as I have knowingly and in a meaningful way, given that consent, then it’s okay. But if I have not given that consent, I would not like my data to be used.
But that also means that I will not get that express entry into the airport. So at the end of the day, consumers make the trade off and choose what works for them. So I think that’s the key thing that the Act is also trying to talk about, which is ‘informed consent’.
Before the passage of the bill, how was the scenario in advertising?
Nothing was illegal, but as consumers, we may not have fully understood what was happening with our data. So it’s not like, what was happening was not legal, but there was no legal framework for brands to be compliant or even advertising to be compliant.
Hence, they were compliant with the existing laws. Now they have to be compliant with the new laws. Whatever changes the new law is suggesting, companies will have to build it into their systems now. I think that’s the way it will be, and again, these things will keep changing and especially with technology, the change is very rapid. So it has to keep changing over a period of time.
Moving forward, how will this bill change the ad landscape?
There will always be an adjustment period. But I think the organisations will also build their capability in managing campaigns and being compliant with the law.
There are new technologies called privacy enhancing technologies which will come into play, which will allow the organisations to do what they would like to, but without compromising consumer data. So I think it’s a learning curve for all the stakeholders.
Read More: Explained: Digital Personal Data Protection Bill, 2023. What does it mean?