E-Commerce supported by robust internet & mobile services is flourishing in India. However, E-Pharmacy a part of larger E-Commerce business is crippled by inefficiencies & lack of clarity. The biggest stumbling block in establishment of a flavorful Electronic Pharmacy model is the existence of obsolete laws led by The Drugs & Cosmetics Act, 1940 and its supporting rule that is “The Drugs & Cosmetics Rules, 1945”. Evidently, the Act & Rules were framed at a time when one could not have imagined internet usage or such a sale model which makes medicine available at one’s doorstep with the click of a button. However, even with obsolete Rules, various E-Pharmacies started establishing business in India, some of the notable names are Netmed, Medlife, PharmEasy & 1mg etc. These E-Pharmacies are made to conduct business under the old Act & Rules which were necessarily framed for a brick and mortar stores which have a minimum defined space for holding stock (Rule 61 of the Drugs & Cosmetics Rules, 1945) and has geographical limitations (Rule 62 of the Drugs & Cosmetics Rules, 1945). The Central & State Government do not distinguish between an E-Pharmacy & a Physical Pharmacy, this means every E-Pharmacy has to have a License under Section 18 read with Rule 61 issued in various formats attached with Rules, particularly Form 21, 21-A, 21-B which mandates stocking, exhibition, offer of sale in Retail & Wholesale of drugs specified in Schedules C and C(1) excluding those specified in Schedule X under the supervision of a qualified or competent person as the case may be. Thus, E-Pharmacies are able to run their business by (a) employing a pharmacist with valid License issued by a State Drug Authority to dispense medicines under Rule 65(2) of the Drugs & Cosmetics Rules, 1965 and 9.1 of the Pharmacy Practice Regulations, 2015; (b) by obtaining License of Pharmacy under Rule 61 of the Drugs & Cosmetics Rules, 1965; (c) by not selling, stocking drugs mentioned in Schedule X of the Rules; (d) against a proper prescription by a Registered Medical Practitioner.

A leading business newspaper reported that delay in notification of E-Pharmacy draft Rules is causing concern in the sector, such concern was raised by FICCI. Key figures from Federation (FICCI) opined that there is no violation of any existing act and rules in the current E-Pharmacy model. However, there are certain difficulties that the sector has been facing towards ease of doing business due to regulatory uncertainty. The above statement of FICCI lacks conviction in my humble opinion as the License to run a pharmacy is issued by State Government under Part VI of the Drugs & Cosmetic Rules, 1945. Every License is issued to a particular store having a minimum defined physical area to store drugs and above all the License is restricted to a particular geographical place. Before issuing License the licensing authority takes into consideration number of already existing Licenses in a particular area. Rule 62 of 1945 rules makes it mandatory to seek separate License for separate place in case of drugs being sold or stocked for sale at more than one place. It appears accepting & delivering orders by a single pharmacy outside geographical limitations contravenes the Rules and Pan India presence is practically impossible. Under current scenario, E-Pharmacy has to have separate Licenses for separate stores or have a tie up with local pharmacy for supply of drugs in the area where the pharmacy is located. Thus, the present legal framework is adversely proportional to ease of doing business and leads to bottlenecks and cost escalation. The above discussion has inadvertently lead to differentiating E-Pharmacy from a Pharmacy as former is essentially a marketplace connecting various pharmacies digitally and is more of a digital solution in patient, pharmacy coordination thereby increasing the cost efficiencies leading to win-win situation for both, having nothing to do with actual stock, store, sale of the Pharmaceutical drugs. Thus, FICCI is rightly worried at non-notification of Draft Rules for E-Pharmacy but the reasoning expressed does not articulate the real worries that is the contravention of law in case of direct supply of drugs outside the geographical limit of the licensed drug store of E-portal.

The Government of India came up with proposed amendments by notifying draft of certain rules further to Drugs & Cosmetic Rules, 1945, though Ministry of Health & Family Welfare vide gazette notification no. 602 dated 28.08.2018. The draft Rules seek to insert “Part VIB” titled as “Sale of Drugs by E-Pharmacy” in the existing Drugs and Cosmetics Rules. Rule 67-I deals with Definition, 67-J deals with Registration of E-Pharmacy, 67-K deals with Disclosure of information generated through E-Pharmacy portal, 67-L deals with Application for registration of E-Pharmacy, 67-M deals with Conditions for grant of E-Pharmacy and so on. “E-Pharmacy”, “E-Pharmacy Portal” and “Sale by way of E-Pharmacy” are defined under these proposed amendments. As against a licensed pharmacy store, E-Pharmacy consists of (a) registered “E-Pharmacy” maintaining a E-Pharmacy/ Web Portal for obtaining and verifying orders (b) licensed drug stores for dispensing the drugs to patients after verification (c) shipment service for delivery of order from store to destination.

The Draft Rules are a welcome step in easing the working of E-Portals. Some of salient features are: (A) Compulsory Registration: All the existing and new E-Pharmacies shall apply for registration to Central Licensing Authority in Form 18AA with a fee of Rs. 50,000/-. (B) Protection of Privacy & Data localization: No information concerning customers shall be shared with anyone except the Central & State Drug Authorities and E-Pharmacy has to keep the entire data generated on its portal in India itself and no Data can be sent or stored outside India by any means. (C) Prohibition and Sale of Psychotropic substances: As per draft rules E-Pharmacies are prevented from selling drugs covered under the definition of Psychotropic substance under Narcotic Drugs and Psychotropic Substances Act, 1985, tranquilizers and drugs specified in Schedule X of the Drugs & Cosmetics Rules. (D) Verification by Registered Pharmacist: On receipt of order on E-Portal maintained by E-Pharmacy, the registered pharmacist of the E-Pharmacy shall verify the details of patient, Registered Medical Practitioner vis and vis E-Prescription (not yet defined in the Draft Rules) or Prescription as the case may be. Thereafter the drugs to be supplied to the customer after being procured from a licensed retail or wholesale store within the time specified to the patient at the time of procuring order. (E) Quality Control: All the details shall be mentioned on the sale memo which includes name, address and license number of the licensee dispensing the drugs. Serial number, date of memo, details of drug including quantity, batch number, expiry date, manufacturer name should also be mentioned on the memo. E-Pharmacies are required to maintain and update information regarding the drug availability, types of drugs offered for sale, supply chains or vendor lists, details of registered pharmacists and medical practitioners etc.

The draft rules cannot be said to be exhaustive but an important step ahead in tapping the E-Pharmacy business potential which is currently one percent of total drug sale in India and is expected to grow from 512 million USD (INR 3500 Crores) in 2018 to 3657 million USD (INR 25000 Crores) by 2022 growing @ CAGR of 63%. The sector has immense growth potential, which can be tapped easily, in case the Government moves swiftly. Pendency of draft rules for such a long time is an unlikely trait of the present regime which is known for its quick action. With the notification of rules, new players can conduct their business legally as one PAN India registration would be required for E-Pharmacy. Rules should also give clarification regarding “E-Prescription”/ right of the patient to demand the same from his/her doctor and regarding storage of drugs and its PAN India movement in the light of conflicting rules such as Rule 62 of the Drugs & Cosmetic Rules, 1945 which warrants separate license for separate places of stock, sale even though belonging to a single company. Misuse by drug peddlers is also an important issue as supply of narcotics through courier is not an unheard phenomenon.

With various healthcare measures in the kitty like Jan Aushadhi, TeleMedicine, E-Healthcare coupled with Digital India, Make-in-India, Ease of doing and One India, present regime is well set to perform in the sphere of E-Pharmacy making affordable and cheap medicine a reality, and that too easily accessible to everyone Further delay in notifying the amended draft Rules is unwarranted, not in the interest of growth, modernization as envisaged and promised.

References:

1. The Drugs & Cosmetics Rules, 1945.

2. The Drugs & Cosmetics Act, 1940.

3. Draft Rules to amend The Drugs & Cosmetic Rules, 1945 notified by The Ministry of Health and Family Welfare vide its notification G.S.R. 817 (E) dated 28th August, 2018.

(Online available at: http://egazette.nic.in/WriteReadData/2018/189043.pdf)

The Hon’ble Supreme Court while dealing with the case of Justice K.S. Puttaswami and another v. Union of India, wherein a nine Judge Constitutional Bench, while delivering its Judgment on 24th August, 2017, declared “privacy” as a fundamental right under Article 21 of the Constitution of India. Subsequently, on 26th September, 2018, a five Judge Constitutional Bench of the Hon’ble Supreme Court while delivering its final judgment in the above case impressed upon the government to bring out a robust data protection regime.

This paved the way for introduction of a Data Protection Bill in the Parliament, which is pending in both the houses. The Personal Data Protection Bill 2019 was tabled in the Parliament by the Minister of Electronics and Information Technology on 11th December 2019. The bill within its ambit tries to develop a mechanism for protection of personal data and for setting up an authority “Data Protection Authority of India” for the same.

This bill aims to provide for protection of the privacy of individuals relating to their personal data, specify the flow and usage of personal data, create a relationship of trust between persons and entities processing the personal data, protect the rights of individuals whose personal data are processed, to create a framework for organizational and technical measures in processing of data, laying down the norms for social media intermediary, cross-border transfer, accountability of entities processing personal data, remedies for unauthorized and harmful processing, and to establish a Data Protection Authority of India for the said purposes and for the matters connected therewith or incidental thereto. Among various facets of the bill, an interesting facet is Right to be forgotten.

The Right to be forgotten is distinct from the right to privacy, which constitutes information that is not publicly known, whereas the right to be forgotten involves removing information that was publicly known at a certain time and not allowing third parties to access the information. The Right to be Forgotten allows the individuals to have certain information or data about themselves in the form documents, photographs, videos etc to be deleted from the internet, so that it may not be accessed by internet search engines any further. The grey area lies in the potential undue influence that such results may exert upon a person’s online reputation almost indefinitely if not removed.

This concept has already been put into practice in the European Union and Argentina since 2006. Since in India this will be a relatively new concept therefore I will try to explain its merits and demerits quoting the European Union’s process. To exercise the right to be forgotten and request removal from a search engine, a person requires to complete a form through the search engine’s web sites. Google’s removal request process requires the individual to identify their country of residence, personal information, a list of the URLs to be removed along with the short description of each one, and attachment of legal documents regarding identification. The applicant receives an email from Google confirming the request but the request must be assessed before it is approved for removal. If the request is approved, searches using the individual’s name will no longer result in the content appearing in search results. The content remains online and is not erased. After a request is filed, their removal team reviews the request, weighing “the individual’s right to privacy against the public’s right to know”, deciding if the website is “inadequate, irrelevant or no longer relevant, or excessive in relation for the purposes for which they were processed”. Google has formed an Advisory Council constituting of various professors, lawyers, governments officials from around Europe to provide guidelines for these decisions. However, the review process is still a mystery to the general public. Google began to take action on this much sooner than that, which allowed them “to shape interpretation to their own ends”.

Google form asks people to select one of the twenty-eight counties that make up the European Union, as well as Iceland, Liechtenstein, Norway and Switzerland. The form allows an individual to put in a request for the removal of any URLs believed to be a violation of the individual’s privacy. Regardless of who is submitting the form, he is required to submit photo identification of the person for whom the form is being submitted. The purpose of this is to verify the identity of the person for whom the request is being made, and in fact that person approves of the same.

If Google refuses a request to unlink material, individuals can appeal to their local data protection agency. If Google fails to comply with a Data Protection Agency decision, it can face legal action. Google has applied the right to be forgotten since May 2014, when the European Court of Justice first determined that under some circumstances European citizens could force search engines to delist web pages containing sensitive information about them from queries made using their names.

Indian Perspective:

As per the data available on google since 2009 out of approximately 8400 requests of data removal, Items broken down by decision taken in requests involving a court order or originating from various government agencies. Prior to 2019, Google published removal percentages based on action taken on requests and not found items, is as under:

Removed Legal 45.6%, Removed owing to Policy 5.1%, Not enough information 27.8%, No action taken 15.4%, Content already removed 4.5%, Content not found 1.6%.

Indian Courts have been alive to this concept, as there have been few instances such as:

In January, 2017 the Hon’ble Karnataka High Court upheld the right to be forgotten, in a case involving a woman who originally went to Court in order to get marriage certificate annulled, claiming to have never been married to the man named in the certificate. After the two parties came to an agreement, the woman’s father wanted her name to be removed from search engines regarding criminal cases in the High Court. The Karnataka High Court approved the father’s request, stating that she had a right to be forgotten. According to the Court, its ruling would align with western countries’ decisions, which typically approve of the right to be forgotten when dealing with cases “involving women in general and highly sensitive cases involving rape or affecting the modesty and reputation of the person concerned.” The woman in this specific case was worried that the search results would affect her standing with her husband, as well as her reputation in society. There is another case of similar consequences, which is pending before the Hon’ble Delhi High Court.

The Hon’ble Karnataka High Court considered as follows: “The `right to be forgotten’ or `the right to be erased’ allows an individual to request for removal of his/her personal information/data online. The origin of this right can be traced back to the French jurisprudence on the `right to oblivion’ or droit a l’oubli. The rationale behind it was to allow offenders who had served their sentence to object to the publication of information regarding their crime and conviction in order to ease their process of social integration. It was along these lines that the European Union Data Protection Directive, 1995 acknowledged the right to be forgotten, wherein it was stipulated that the member states should give people a right to obtain from the `controller’ the rectification, erasure or blocking of data relating to them, the processing of which did not comply with the provisions of the Directive.”

There are certain limitations, regarding its application in a particular jurisdiction, which may have practical difficulties, including the inability requiring removal of information held by companies, entities, individuals outside the jurisdiction, because of their being no global legal framework to allow individuals control over their online images, documents, videos etc.

There are industry apprehensions that the bill gives a blanket power to the Government to access citizen data and further that the Central Government can exempt any Government agency from the purview of this bill.

The Data Protection Bill, 2019 is in tune with the modern times, and with the growth and boom of internet, social media, and other platforms, this Data Protection Bill, is a must, which should be implemented at the earliest, though with few changes and a little bit of fine tuning in sync with the present times and scenario.

Views Are Personal Only.

(The author is a practicing advocate in the Punjab and Haryana High Court at Chandigarh)