Jago Grahak Jago

The goal of the system is to provide a “transparent, rule-based, system-driven, user-driven, unbiased mechanism for resolving customer disputes and grievances, with zero or minimal manual intervention.” In other words, the main objective of this system is to enable a dispute resolution system that is not only transparent and unbiased but also provides redressal for consumer grievance with minimal or zero human intervention.

As rightly said by Dave Chapelle “Modern Problems requires modern solutions”. The only good outcome of the COVID-19 pandemic was that the digital economy saw a global revolution. Preventive measures such as lockdowns, social distancing, etc., which limited the scope of human interactions (all of which were a result of the pandemic), led to most forms of trade and communication being shifted online thereby increasing an individual’s dependence on such digital transactions. Each transaction involves a cost which is fulfilled in the form of digital payment. While this can be treated as a great leap forward, such a change is not devoid of certain inevitable issues.

The Patents Act, 1970 provides patent protection in India which is compliant with Trade-Related Aspects of Intellectual Property Rights (TRIPS) and has been adopting and implementing the provisions. To obtain a patent protection in India, apart from the patentability criteria-novelty, inventive step and industrial applicability, the invention must not fall within the ambit of Section 3 and 4 of the Act. As any digital health application works on software and a computer program, Section 3(k) of the Indian Patents Act is relevant which precludes patentability of a computer program per se. Recently, the Delhi High Court has iterated that all computer programs are not barred under Section 3(k) and when such program demonstrates a ‘technical effect’ or a ‘technical contribution’, the invention would be patentable.

The key issues in sharing personal data are primarily, but not limited to: the transparency and control of data exchange; security and privacy; and information, trust, responsibility and accountability. Such considerations can change during data sharing, particularly data protection and privacy, as this is an important concern.

The MoHFW, through the proposed DISHA, plans to set up a statutory body in the form of a national digital health authority for promoting and adopting: e-health standards; enforcing privacy and security measures for electronic health data; and regulating the storage and exchange of electronic health records. In addition, the National Digital Health Authority (NeHA) under MoHFW is a proposed authority that is intended to be responsible for the development of an integrated health information system in India. It is proposed to be a promotional, regulatory and standard-setting organisation to guide and support India’s journey with Digital Health and consequent realisation of benefits of ICT intervention in the health sector. It also spells out the proposed functions and governance mechanism of NeHA. DISHA is the legislation that seeks to formally establish NeHA and facilitate the online exchange of patient information with a view to prevent duplication of work and streamline resources.

Data Privacy is a main concern in the use of personal data. In September 2013, the MoHFW notified the Electronic Health Record Standards (EHR Standards) for India. They were chosen from the best available, previously used standards applicable to international electronic health records, keeping in view their suitability to and applicability in India. Accordingly, the EHR Standards 2016 document is notified and is placed herewith for adoption in IT systems by healthcare institutions and providers across the country. The MoHFW facilitated its adoption by making available standards such as the Systematised Nomenclature of Medicine Clinical Terminology (SNOMED CT) free-for-use in India, as well as appointing the interim National Release Centre to handle the clinical terminology standard that is gaining widespread acceptance among healthcare IT stakeholder communities worldwide.

India has no dedicated cybersecurity law. The IT Act, read with the rules and regulations framed thereunder, deals with cybersecurity and the cybercrimes associated therewith. As discussed in question 1.3, the ‘body corporate’ that handles sensitive personal data or information (SPDI) must implement “reasonable security practices and procedures” by maintaining a comprehensive documented information security programme. This programme should include managerial, technical, operational and physical security control measures that are commensurate with the nature of information being protected. In this context, the SPDI Rules recognise the International Standard IS/ ISO/ IEC 27001 on “Information Technology – Security Techniques – Information Security Management System – Requirements” as one such approved security standard that can be implemented by a body corporate for the protection of personal information.

As mentioned in question 1.1, the RBI has issued several cautionary advisories in the form of press releases (issued on 24 December 2013, 1 February 2017 and 5 December 2017) to users, holders, investors, traders and similar parties that deal in virtual currencies, highlighting the potential financial, operational, legal, customer protection and security-related risks associated with dealing in virtual currencies.

Blockchain came into vogue in 2008 as the underlying technology for Bitcoins, which has been hailed as the world’s first decentralized cryptocurrency. In the words of its creator (who used the pseudonym ‘Satoshi Nakamoto’), Bitcoin was created since there was a need for “an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party“1.

A blockchain, as its name suggests, is a virtual chain made of blocks, where each block contains information. Alternatively, it can be described as a digital ledger, where each block of data represents a distinct transaction on the ledger, with the transactions occurring across a decentralized peer-to-peer network. This peer-to-peer network consists of a network of computers (each called a “node”) connected together, which allows the participants in the blockchain to transfer information across the internet without the need to involve any centralised third party.