Data Protection Bill: are brands at crossroads between personalisation and privacy?

As the Parliament passes the much anticipated Data Protection Bill, here is how it could catalyse the shift towards first-party data acquisition.

The Digital Personal Data Protection Bill (DPDP) has been passed in the Lok Sabha in a voice vote, and marketers are assessing its potential implications. The Bill lays out the new methodology to be employed by vendors and data collectors in how they operate and leverage consumer data.

The Data Protection Bill’s evolution can be traced back to 2017 when the initial draft was put forward by a special committee. After the withdrawal of the Data Protection Bill from the Parliament in August 2022, the new iteration in DPDP gathered pace post-November 2022, coming to near-fruition this month.

However, the complex provisions of the bill could positively affect the way marketers operate in the country. One of the central aspects of the bill revolves around who it aims to protect - the data principal (DP) or the consumer. An interesting shift is introduced in Chapter III, Clause 11, where DPs gain the right to request summaries of personal data being processed, along with details of data fiduciaries (DFs) sharing their information.

In a surprising move, the previous provision allowing DFs to reject such requests has been eliminated. This grants users the power to rectify and erase their data, as well as a channel for grievance redressal.

With this, the autonomy of third-party data collectors, and their brand partners could lay in jeopardy. In fact, with the entire marketing world galloping towards a first-party data-driven ecosystem, the bill could actively catalyse the shift.

Dr Kushal Sanghvi, head- India and SEA, CitrusAd, opines that in a cookieless world, the introduction of this bill could push brands to optimise their first-party data infrastructure.

He says, “This is really the new internet. With brands now gearing up for a cookieless world, they need to be more careful of how they leverage consumer data. Some of the marketers have been more aggressive in the way they’ve used third-party data. This bill could be a starting point for a lot of brands who are already aiming to reinforce their data acquisition strategy.”

The bill’s emphasis on consumer consent and approval could also mean that the brands will struggle with personalised marketing strategies. In a world where consumers are provided with options to opt out of any promotional engagement with a brand, the efficacy of intrusive ads and push notifications could take a hit.

On the bright side, however, Sanghvi points out, “From a marketing perspective, the new bill could also translate into a refined and filtered consensual audience who are willing to participate in a brand’s consumer outreach strategies.”

Globally, we’ve seen similar bills being passed in international judiciaries, such as the General Data Protection Regulation (GDPR) in EU, and CCPA in the United States, where foreign governments have intervened on behalf of consumers for privacy-safe data management. For India, the bill could spark an ethical overhaul in terms of privacy and consumer safety.

Rajiv Dhingra, founder and CEO of ReBid, a consumer data platform, highlights that the Indian brands who hold international businesses, are already acquainted with such policy changes and can adapt to the new order. He says, “Brands who don’t have business outside of India, aren’t necessarily compliant of protocols pertaining to consumer data. With third-party cookies seeing an end, the bill makes it tougher for brands to acquire data."

Dhingra also adds that with the bill in place, there is a requisite for formidable response strategies that DFs need to prepare in order to accommodate the perceived transparency. The new bill puts the consumer in the front and centre, but there is a caveat.

A paradox emerges as the bill also places duties and penalties on DPs themselves. Clause 15(d) raises concerns, mandating that DPs avoid registering frivolous complaints, backed by a penalty threat. This has the potential to discourage consumers from raising valid grievances.

While Indian consumers have grown in their awareness of marketing and data acquisition, there are still many people who have yet to catch up. While the bill is clearly attempted at empowering the citizens against unethical data management, are the consumers digitally mature enough to make most of the provisions?

Himanshu Arora, who is the co-founder, Social Panga, a marketing agency, reckons that awareness in Indian consumers is still predominantly nascent, but the bill could serve as a starting point.

He says, “We’re still in an early phase. We’ve seen consumers share their data for ten or twenty rupees cashbacks, so it isn’t a priority. But, interestingly, people are appreciating the fact that they can restrict the sharing their data. We’re still in early adopters level, but as more rules and regulations get imposed, people will take note of the developments.”

With how the bill is structured, there is potential for the brand-consumer dynamic to go beyond being merely transactional, and become somewhat collaborative. While the consent-driven consumer outreach strategies is always a move in the right direction, the transparency could lead to some challenges as well, as per Niraj Jain, director of global marketing and alliances for Ethosh, an experiential marketing company.

He says, “The increased transparency (aimed by the Bill) comes with its own set of challenges. If a user engages with an offering on our website but later decides to revoke consent for data tracking, it directly impacts our ability to deliver tailored ads based on their past behaviour. This could potentially lead to a decrease in conversion rates as our ability to retarget effectively becomes limited. Similarly, in our mass email campaigns, users who opt out of data-sharing might receive more generic emails that lack the personalization that would typically enhance engagement.”

While Jain is optimistic about the impact of the bill, he is also wary of the challenges that come with it. “I perceive the Data Protection Bill 2023 as a pivotal shift that underscores the importance of ethical data practices and transparency in our industry. While it encourages us to build more meaningful connections with our audience, it also presents us with the challenge of striking a delicate balance between compliance and maintaining the effectiveness of our marketing strategies in this evolving landscape.”