[Jaideep Khanna is a Counsel at Chamber 20A, Supreme Court of India and Abhishek Nevatia is a 5th year student at Jindal Global Law School, Sonepat]
The 2019 Amendments to the Arbitration and Conciliation Act, 1996 (Act) introduce section 42A and section 43K to the Act. Once notified, they will bolster data confidentiality in arbitration proceedings. Section 42A imposes data confidentiality obligations upon the arbitrator, the parties to the arbitration, and the arbitral institution. Section 43K enables the Arbitration Council of India (‘ACI’) to be the repository of arbitral records. However, the contours and exceptions to data confidentiality under section 42A remain unanalysed, and the governing regulations of the data security protocols for the ACI are yet to be notified.
Given that the Personal Data Protection Bill, 2019 (‘PDP Bill’) aims to regulate the processing of personal data by individuals, private companies, and the government, amongst others, it will undoubtedly raise questions with respect to confidentiality and data security pertaining to legal proceedings. While the PDP Bill’s applicability to arbitration proceedings remains unclear, robust data protection protocols will be necessary in order to ensure that the rights and interests of parties are protected.
Inadequacy of Section 42A
Section 42A of the amended Act provides: “Notwithstanding anything contained in any other law for the time being in force, the arbitrator, the arbitral institution and the parties to the arbitration agreement shall maintain confidentiality of all arbitral proceedings except award, where its disclosure is necessary for the purpose of implementation and enforcement of the award.” Therefore, the only exception to confidentiality under section 42A, is its non-applicability to the disclosure of the award for the purpose of its implementation and enforcement. However, what remains unclear is the obligations on a party seeking to introduce confidential data from an arbitration to a court.
Such court intervention relating to an arbitration may be initiated by the parties to the arbitration for injunctive relief, interim relief, or for terminating the mandate of an arbitrator, amongst others. Further, third parties may approach the court to seek reference to an ongoing arbitration proceeding. There is a high probability that in each of these situations, parties seeking court intervention may have to rely on confidential data from the arbitration proceedings in the courtroom.
Section 42A does not account for any such possibilities. For example, the Supreme Court of India in Mahanagar Telephone Nigam Ltd. v. Canara Bank. allowed non-signatories to claim reference to arbitration proceedings by establishing their degree of involvement in the role and performance of the contract. Such reference proceedings may require disclosure of confidential information from the arbitration proceedings. Therefore, the courts in India would necessarily have to establish the contours of divulging confidential data in court proceedings. They will have to balance the interests of a party seeking to plead an exception to section 42A, against the overall requirement to maintain confidentiality therein. These interests have been the subject of consideration before the courts in the UK and Singapore.
The Public Interest Test
Absolute confidentiality remains elusive under the international arbitration regime. This is due the lack of imposition of uniform confidentiality obligations on both, the parties to the arbitration, and the arbitral institution itself. For example, article 37.1 of the International Centre For Dispute Resolution (ICDR) Rules imposes an implied duty on an arbitrator, and the parties to an arbitration, to keep all matters relating to the arbitration and the award confidential, subject to specific agreements between the parties. In contrast, article 6 of Appendix 1 and article 2 of Appendix 2 of the International Chamber of Commerce (ICC) Rules are silent on the confidentiality obligations on the parties to the arbitration proceedings, but impose confidentiality obligations upon arbitrators and the arbitral institution.
The contents and scope of such confidentiality clauses remains vague and subject to scrutiny. Further, parties across jurisdictions have the duty to disclose material information of the arbitration proceedings if they approach regulatory authorities or seek court intervention for challenging an arbitral award. In simpler terms, these are the natural exceptions to confidentiality.
However, courts in the UK and Singapore have recognised a “public interest” test in adjudicating matters pertaining to confidentiality of arbitration proceedings. For example, the Singapore High Court, in AAY v. AZV [2012] SGHC 116 decided that the court proceeding emanating from an arbitration were to be held in chambers, and not in an open court hearing. The Court found that an open court proceeding may lead to revealing documents that were of legitimate public interest. The inherent power of the Singapore High Court to grant sealing orders for public access to files of a court proceeding, emanating from an arbitration proceeding, was affirmed in BBW v. BBX and others [2016] SGHC 190.
Similarly, a 2019 decision of the English Commercial Court inThe Chartered Institute of Arbitrators v. B probed the exception of a “public interest” to allow disclosure of confidential information. The Court granted the Chartered Institute of Arbitrators access to confidential documents required in an arbitrator’s disciplinary proceeding. Therefore, the public interest of maintaining the standard and quality of arbitrators prevailed over the need to ensure confidentiality. The court also considered the harm that would be faced by the Institute, if they were unable to access the confidential documents.
This balancing test of legitimate interest, or public interest, forms the foundation of exception within section 42A of the Act. The exception to confidentiality during the enforcement of awards is a testament to the legislature’s intention of balancing the legitimate interest of a decree holder to enforce an award, against confidentiality of the proceedings.
Data Security under Section 43K
The 2019 Amendments seek to constitute the ACI as an independent governing body for arbitrations in India. Section 43K of the amended Act imposes legal obligations upon the ACI to maintain an electronic depository of arbitral awards made in India, along with any other records the regulations may specify. However, the regulations that are eventually notified under section 43K would necessarily have engage with the provisions of the PDP Bill. This is owing to the fact that disclosures of data must pass muster with the standards laid out in the PDP Bill.
Further, the rules framed by the ACI would have to decide the role of data fiduciaries and data principal under the PDP Bill. A data fiduciary under clause 3(13) of the PDP Bill means “any person, including the State, a company, any juristic entity or any individual who alone or in conjunction with the others determines the purpose and means of processing personal data”, whereas a data principal is the person to whom the data relates. It remains unclear whether an arbitrator, or an arbitral institution, is a “data fiduciary” under the PDP Bill.
As we know, data confidentiality concerns are contiguous with concerns of data security. Clause 36(b) of the PDP Bill states that only information necessary to enforce a legal right will be disclosed. However, the grounds of disclosure remain unclear. It is also important to note that arbitration is not explicitly covered by the Bill. Thus, arbitration proceedings will have to be read into the scope of this provision by the courts.
There is a dire need for a data protection protocol in the India. The General Data Protection Regulation establishes concrete data protection standards, and imposes penalties for their violation, for the European Union. This creates an especially pernicious problem in the Indian context, as lax domestic security norms are disjunct with the standards of international arbitrations. We are witnessing an increase in online arbitration proceedings as a means of maintaining efficiency and reducing costs. Even traditionally physical processes such as tendering of evidence have been moved online as a result of COVID-19.
The problems presented earlier with respect to confidentiality of proceedings are exacerbated without the existence of a robust data security framework. The PDP Bill does very little to address these gaps. Even in cases of consent-based ad-hoc arbitrations, it remains to be seen if data security standards will be considered mandatory, or be subject to a mutual agreement between the parties. While it is unclear if certain norms will come into place in the near future, it is necessary to highlight the rising threat of cybercrimes. This can cause major losses to both the parties while undermining the legitimacy of proceedings.
It is unclear how data security, and by extension, confidentiality can be protected in arbitral proceedings in India. Perhaps, the answer lies in moving towards arbitral institutions which can ensure higher standards of compliance, and put in place robust data protection protocols to alleviate the myriad issues that can arise from data breaches and cyber-attacks. The regulations to be formulated for the ACI can contain a data protection protocol to help address some of these concerns.
What lies ahead is a legislative opportunity to harmonize the PDP Bill’s objectives to regulate data security with the regulations (to be drafted) for the Arbitration Council of India. On the other hand, the uncertainty around the exceptions of confidentiality obligations under section 42A merit judicial interference at the earliest.
Jaideep Khanna & Abhishek Nevatia
