JSA Newsletter | Employment | August Edition 2023

Please click here to download the Newsletter as PDF.

This edition of the JSA Employment Newsletter provides an overview of key compliances on handling employee personal data and corresponding obligations under the newly enacted Digital Personal Data Protection Act, 2023 (“DPDP Act”). We also discuss some recent regulatory updates and judicial precedents across several employment legislations.

Processing of employee personal data under DPDP Act

The DPDP Act enacted on August 11, 2023 is a new data protection legislation that regulates the processing of digital personal data (personal data in digital form). Applicability of the DPDP Act extends to personal data processed: (a) within the territory of India, where such personal data is collected in digital form; and non-digital form, which is subsequently digitised; and (b) outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to ‘data principals’ within the territory of India.[1] ‘Data Principal’ under the DPDP Act means an individual to whom the personal data relates.

Provisions of DPDP Act will come into force on date(s) notified by the Central Government. Relevant rules under DPDP Act are also yet to be formulated and notified. Employers, as processors of employee personal data, are likely to be classified as ‘Data Fiduciaries’ under the DPDP Act and therefore, it becomes crucial for them to be prepared in advance for adoption of systemic changes in data processing mechanisms as required for compliance with the DPDP Act, when enforced. Employees are likely to be classified as Data Principals under the DPDP Act.

Notice and consent requirements

DPDP Act broadly sets out the framework for consent-based processing of personal data; and non-consent based processing of personal data for certain ‘legitimate uses’, both for lawful purposes.[2] Among other prescribed ‘legitimate uses’ is processing carried out “for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee.”[3] As such, employers may not be required to obtain express consent to process personal data of employees, for, inter alia, purposes of employment. DPDP Act presently does not qualify or define the terms ‘for the purposes of employment’.

Processing of employee personal data for lawful purposes other than ‘legitimate uses’ including employment purposes, however, will require employers to obtain from employees or Data Principals, consent that is (a) free, specific, informed, unconditional, and unambiguous with a clear affirmative action; and (b) signifying agreement to processing of personal data for specified purposes.[4] For example, employers seeking employee personal data for provision of medical insurance should be cautious that employee consent for processing of personal data collected for this purpose would be valid till the extent the consent relates to processing of personal data for making available medical insurance coverage and related services, and only if consent is procured in line with requirements specified above. A request for such consent, is required to be accompanied or preceded by a notice (format of which is yet to be prescribed under DPDP Act) informing the Data Principal of, inter alia, personal data to be processed, and the purpose for such processing, procedure to revoke consent, raise grievances, and file complaints with the Data Protection Board of India.[5] The notice and request for consent are required to be presented in clear and plain language, providing the Data Principal with an option to access such notice and request for consent in English language or any other language as specified in the Eighth Schedule of the Indian Constitution, i.e., in a total of 22 (twenty two) languages.[6] Further, with respect to personal data of persons with disability, employers will have to obtain verifiable consent of the parent or legal guardian of such person with disability in the manner as yet to be prescribed under DPDP Act.[7]

For consents received prior to the enforcement of DPDP Act, employers will have to notify employees of the processing of personal data based on past consent as soon as reasonably practicable, in the prescribed manner; and can continue processing such personal data until consent is revoked.[8]

Revocation of consent

DPDP Act provides Data Principal with a right to withdraw consent earlier given, and requires Data Fiduciaries to cease processing the personal data within a reasonable time upon withdrawal of consent, unless such processing is required or authorised under DPDP Act or any other law.[9]

Key obligations of Data Fiduciaries

DPDP Act requires Data Fiduciaries to, inter alia, ensure:[10] (a) compliance with DPDP Act, and compliance by Data Processors (i.e., persons processing personal data on behalf of Data Fiduciaries) with provisions of DPDP Act; (b) completeness, accuracy and consistency of personal data that they process, if it is to be used to make a decision that affects a Data Principal; or is to be disclosed to another Data Fiduciary; (c) implementation of appropriate technical and organisational measures for compliance with DPDP Act, and adoption of reasonable security measures to prevent personal data breaches; (d) notification to the Data Protection Board and each affected Data Principal of personal data breach; (e) erasure of personal data upon withdrawal of consent by a Data Principal; or specified purpose for collection no longer being served by its retention; and (f) establishment of effective grievance redressal mechanism to redress Data Principal grievances.

Further, Data Fiduciaries can engage Data Processors to process personal data on their behalf for any activity related to offering goods or services to Data Principals, only under a valid contract.[11] As such, employers engaging or intending to engage third party payroll service providers and other service providers for processing employee personal data, can now do so, or continue to do so only under valid contracts. As liability linked with processing of personal data by third-party data processors or service providers is now on employers appointing such parties, it becomes essential for underlying contracts to, inter alia, provide adequate safeguards to ensure such third-party data processor or service provider’s compliance with DPDP Act.

Noteworthy to see that a Data Fiduciary can be identified by the Central Government as a ‘Significant Data Fiduciary’, based on evaluation of factors including volume and sensitivity of personal data processed and risks to a Data Principal’s rights. Significant Data Fiduciaries are subject to additional obligations and compliances under DPDP Act, including, inter alia, (a) undertaking periodic data protection impact assessment and audits; and (b) appointment of data protection officer based in India, to act as the point of contact for grievance redressal mechanism.[12]

Presently, DPDP Act is silent on implementation timelines for ensuring the above-mentioned compliance requirements.

Rights of Data Principals

Data Principals have the right to, inter alia:[13](a) seek access to information, including a summary of their personal data being processed, processing activities undertaken and information relating to Data Fiduciaries and Data Processors with whom their personal data has been shared; (b) request the Data Fiduciary to correct, complete, update personal data; and to erase personal data in the prescribed manner; (c) grievance redressal; and (d) nominate an individual to exercise rights under DPDP Act in the event of their death or incapacity. Employers are likely to establish adequate internal mechanisms for personal data retrieval, updating, erasure and grievance redressal to facilitate such requests of employees.

Penalties

Prescribed penalties for non-compliance with DPDP Act, including failure to take reasonable security safeguards to prevent personal data breach may range up to INR 2,50,00,00,000 (Indian Rupees two hundred and fifty crore).[14]

Being prepared

While clarity is awaited on the implementation and enforcement of DPDP Act, pending notification of rules and establishment of the Data Protection Board, employers may consider revisiting and reviewing existing data protection systems and documentation, in order to transition seamlessly to the new regime on its enforcement. For employers, it may particularly be relevant to classify and evaluate purposes for which employee personal data would typically be collected, and consequently, ensure deployment of adequate notice and consent mechanisms for employee personal data processed for non-employment purposes.

Regulatory Updates

Notification of Punjab Building and Other Construction Workers (Regulation of Employment and Conditions of Service) (Amendment) Rules, 2023

The Department of Labour, Government of Punjab, vide notification dated August 7, 2023 has notified the Punjab Building and Other Construction Workers (Regulation of Employment and Conditions of Service) (Amendment) Rules, 2023, to amend certain rules of the Punjab Building and Other Construction Workers (Regulation of Employment and Conditions of Service) Rules, 2008 with effect from August 11, 2023. Key highlights of the amendment include:

Certification for individuals applying for membership to the welfare fund can now be issued by “any person or authority or officer, who is authorised by the Board”, in addition to the individual’s employer or contractor. The prescribed format for such certificate, i.e., Form XXVII in the Rules has also been amended accordingly.
Contributions to the welfare fund are required to be remitted by members of the welfare fund in advance for a period of 1 (one) year, at the time of application for registration or renewal of registration in prescribed banks or in cash receipts, in the newly notified format of Form XXXIV appended to the Rules. Earlier, contributions to the welfare fund were required to be remitted in advance once in 3 (three) months in prescribed banks, and there was no provision to make such remittance in cash receipts.

Notification of accessibility standards for health care sector under the Rights of Persons with Disabilities Rules, 2017

The Ministry of Social Justice and Empowerment, Department of Empowerment of Persons with Disabilities, Government of India vide notification dated August 9, 2023 amended the Rights of Persons with Disabilities Rules, 2017, notifying the accessibility standards for the healthcare sector, titled ‘Accessibility Standards for Healthcare’, published by the Ministry of Health and Family Welfare vide notification dated May 4, 2023, which can be accessed here.

Notification of Factories (Karnataka Amendment) Act, 2023

The Government of Karnataka, vide notification dated August 7, 2023, has notified the Factories (Karnataka Amendment) Act, 2023, to amend provisions of the Factories Act, 1948 in its application to Karnataka. Key highlights of the amendment include:

State government may, by way of notification in the official gazette, now extend (a) daily work hours to up to 12 (twelve) hours inclusive of intervals of rest, subject to a maximum of 48 (forty eight) hours; (b) total number of hours of work without intervals up to 6 (six) hours; (c) spread-over up to 12 (twelve) hours inclusive of intervals of rest; in respect of any group or class or description of factories in Karnataka, on conditions as it may deem expedient.
Workers working in any factory (a) for more than 9 (nine) hours a day, or 48 (forty eight) hours in any week, in a 6 (six) day working week; (b) for more than 10 (ten) hours in a day or 48 (forty eight) hours in any week, in a 5 (five) day working week; (c) for more than 11.5 (eleven point five) hours in a day, in a 4 (four) day working week; or (d) on paid holidays, are, in respect of overtime work, entitled to payment of wages at the rate twice their ordinary rate of wages.
State government, or the Chief Inspector may, by written order exempt any or all adult workers in any factory or group or class or description of factories from provisions under the Factories Act, 1947 relating to working hours, subject to ensuring, inter alia, that (a) total hours of overtime work in any quarter do not exceed 140 (one hundred and forty) hours (as against the earlier prescribed 75 (seventy five) hours); and (b) any worker will be required to work overtime “subject to written consent of such worker for such work”.
Women employees may now be allowed to work in a factory between 7:00 PM to 6:00 AM, subject to written consent being obtained from women employees interested to work in night shifts, and other conditions, including inter alia, (a) employer and other responsible persons at the work places preventing or deterring commission of acts of sexual harassment, and provision of procedures for resolution, statement or prosecution of acts of sexual harassment by taking necessary steps; and express prohibition of sexual harassment in any form, including unwelcome physic, verbal or non-verbal contact of sexual nature; (b) provision of appropriate working conditions with respect to work, leisure, health and hygiene to ensure an environment free from hostility against women employees; (c) employer’s maintenance of complaint redressal mechanism at the factory and ensuring time-bound remedial of complaints; provision of complaints committee, special counsellor and other support services including maintenance of confidentiality; (d) allowing women employees to raise issues of sexual harassment to workers at workers meetings and other appropriate forums; (e) provision of proper lighting and CCTV coverage, both inside the factory and places surrounding the factory where women may move out of necessity in the course of work, with CCTV coverage being stored for not less than 45 (forty five) days; (f) employment of women employees in batches of not less than 10 (ten), and having not less than 1/3rd of the strength of supervisory staff as women; (g) provision of sufficient security during night shift at entry and exit points; rest rooms to accommodate women employee arriving in advance and leaving after working hours; (h) provision of transportation facilities from residence and back for women employees working in night shifts, security guards, including female security guards, and equipping transportation vehicles with CCTV camera and GPS; vetting of bio-data of drivers by establishment/service provider (for outsourced drivers); selection of transportation routes in a manner that women employees are not picked up first and dropped last; (i) provision of not less than 12 (twelve) consecutive hours of rest or gap between last shift and night shift; and (j) non-disclosure of mobile phone numbers, e-mail ids and address of women employees to unauthorised persons.

Establishments in Meghalaya permitted to remain open 365 (three hundred and sixty five) days a year

In continuation of its earlier notification dated March 10, 2004, the Government of Meghalaya, Labour Department, has vide notification dated July 19, 2023, permitted all establishments under the Meghalaya Shops and Establishments Act, 2003 to remain open on all 365 (three hundred and sixty five) days of the year for a further period of 1 (one) year, i.e., till December 31 2023, subject to conditions stated therein. Some key conditions include, inter alia, (a) provision of 1 (one) holiday in a week to every employee working in the establishment, without deductions from wages; (b) advance display of list of holidays on notice board for each month; (c) adherence to prescribed working hour limits of 9 (nine) hours per day and 48 (forty eight) hours per week; provision of rest period of 1 (one) hour after every 5 (five) hours of continuous work, with total spread over of work hours not exceeding 11 (eleven) hours a day (for hours worked in excess of these stipulations, applicable overtime provisions apply); (d) provision of adequate safety and security arrangements at establishments remaining open after 10:00 PM; (e) provision of separate locker, security and rest rooms for women employees; (f) consent letter to be taken from employees and kept as record at establishment; written consent of female employees to be taken for work after 7:00 PM; (g) provision of adequate safety and security arrangements for women employees during working hours, and ensuring female employees safely reach home after their work is over; and (h) compliance with provisions of the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 and Prevention of the Child and Adolescent Labour (Prohibition and Regulation) Act, 1986.

Case Law Ratios

Right to paternity leave stems from fundamental right to life of pre-natal/post-natal child

In B. Saravanan v. The Deputy Inspector General of Police, Tirunelveli Region, Tirunelveli,[15] the Madras High Court upholding the petitioner’s right to seek paternity leave, observed that a child’s fundamental right to protection of life under the Indian Constitution, culminates in the “fundamental human right of biological parents/adopting parents seeking maternity/paternity/paternal leave”. The court highlighted the importance of providing maternity/ paternity/ paternal leave to biological and adoptive parents in ensuring proper pre-natal and post-natal care of the child, and consequently protecting the child’s fundamental right to life. The court noted that “the role of both the mother and father during the pre-natal and post-natal care days gains importance from the perspective of the child’s right to survive” and that it is “high time for the policy makers to recognise right to paternity leave/paternal leave to the biological/adoptive parents, as the basic human right of the respective pre-natal/post-natal child”.

Period of entitlement to maternity benefit not co-terminus with employment term

In Dr. Kavita Yadav v. Secy, Ministry of Health and Family Welfare,[16] the Supreme Court upheld a contractual employee’s entitlement to maternity benefit beyond the term of her employment contract and noted that entitlement to maternity benefit is not co-terminus with the term of employment. The court observing that the Maternity Benefit Act, 1961, contemplates entitlement even for an employee who is dismissed/discharged during her pregnancy, who, if but for such discharge would have been entitled to maternity benefits, noted that “continuation of maternity benefits is in-built in the statute itself, where the benefits would survive and continue despite the cessation of employment”.

Women entitled to maternity benefits irrespective of nature of employment, whether contractual or otherwise

In Anwesha Deb v. Delhi State Legal Services Authority,[17] the Delhi High Court noting that the Maternity Benefit Act, 1961 “certainly does not discriminate on the basis of nature of employment of the beneficiaries”, upheld the entitlement of a woman employee in contractual employment to maternity benefits at par with regular or permanent employees. The court observed that both, the choice to carry or not carry a child is a constitutionally guaranteed fundamental right and highlighted the importance providing conducive work environments, “to ensure that a woman who chooses to have both, a career and motherhood is not forced to make an ‘either-or’ decision”.

Provisions of Industrial Disputes Act, 1947 inapplicable to apprentices

In Indian Oil Corporation Limited v. Shri Nagendra Singh Shekawat,[18] the Rajasthan High Court dismissing the challenge instituted by respondents against termination of their apprenticeship contracts under the IDA, upheld the inapplicability of provisions of Industrial Disputes Act, 1947 (“IDA”) to apprentices engaged under the Apprentices Act, 1961 (“AA”). The court noted that AA being a special legislation, would prevail over provisions of the IDA. The court also cited Section 18 of the AA, to highlight that an apprentice under the AA “shall be a trainee and not a worker”, and that “provisions of any law with respect to labour shall not be applicable”.

Employees’ ‘right to vent’; and WhatsApp ‘group privacy’ recognised

In A. Lakshminarayanan v. The Assistant General Manager – HRM,[19] the Madras High Court recognising employees’ right to privacy and ‘group privacy’, noted that posting of objectionable messages mocking administration/higher authorities in a private WhatsApp group with restricted access, cannot be construed as disciplinary infraction by an employee so long as such messages do not fall foul of the law. Coining the term ‘right to vent’ of employees, the court noted the interest of organisations in complaints of employees finding “expression and ventilation”. Further, it noted that if in the process of such expression “the image of the organisation is affected, then the management can step in but not until then”.

This Newsletter has been prepared by: