Introduction
A traditional broadcaster generally knew how many people watched a programme. A streaming platform can know considerably more: what a user watched, when they stopped, which genres they prefer, what device they use and which recommendations they accept.
This information has substantial commercial value, but it also creates significant privacy obligations.
Data Collection Should Have a Purpose
Platforms should understand what information they collect and why they need it. Data collected for account administration may raise different questions from behavioural profiling used for targeted recommendations.
Children's Data
Platforms accessible to children require particular caution because children's data may attract enhanced statutory protection and heightened expectations of responsible processing.
Security and Third Parties
Streaming businesses often rely on payment providers, analytics companies, cloud providers and advertising partners. Contracts with these third parties should therefore address security, access, retention and incident management.
India's Legal Framework
The Digital Personal Data Protection Act, 2023 establishes a statutory framework concerning processing of digital personal data, including obligations of data fiduciaries and rights of data principals.
Conclusion
Privacy compliance should be built into the streaming product itself.
A mature platform should know what data it holds, why it holds it, who can access it, how long it is retained and what happens when a security incident occurs.
