Proposed data protection law won’t protect personal data from the government
On December 11, more than two years after the Supreme Court said privacy is a fundamental right, the Personal Data Protection Bill was tabled in Parliament by minister of electronics and information technology, Ravi Shankar Prasad. The bill seeks to establish who can access and benefit from data generated by Indian citizens. Besides being expansive and ambiguous, its provisions could lead to an Orwellian state, warn experts.
Besides the personal data we generate (names, emails etc), there is also non-personal data: for example, traffic data that Uber and Ola have, or data with e-commerce companies such as Amazon and Flipkart. A lot of insights—say, on somebody’s socio-economic status—can be drawn from such data. The bill applies to the purposes and extent to which companies can collect personal data. It has provisions for deletion of personal data post-use and withdrawal of consent by the data principal (the person to whom the personal data relates) in most cases as well. It also mandates the creation of a data protection authority, with one chairperson and six members, capable of imposing fines up to Rs 15 crore for big offences.
The safeguards, however, do not always protect the citizen’s personal and non-personal data from being accessed by the government. It can even direct data processing companies to “provide any personal data anonymised or other non-personal data to enable better targeting of delivery of services or formulation of evidence-based policies by the central government”.
“The bill in its current form will negate people’s data protection when it comes to the government and government agencies,” says cyber-security expert Pawan Duggal. “The State becomes the party, the arbitrator and the judge in the same breath; and judge of its own cause. It will also open a Pandora’s box of legal exposure litigation, because now privacy is a fundamental right. As the government becomes the biggest handler, processor and collector of personal data, it will make sure that none of its operations get covered under this law.”
“The government has always had the power to conduct such surveillance,” says a lawyer who has worked with the government and refuses to be identified. On social media anonymity being at risk, he says the bill isn’t the “right place to bring this in”. “But we don’t have a fundamental right to anonymous speech. You have a fundamental right to speech, but the State can regulate the manner in which that speech is made,” he adds.
The lawyer points out that Google Maps, Uber and telecom operators have non-personal data, “important from a public interest perspective, for the State to plan certain schemes better, for example, in planning urban transport”. But the Collection of Statistics Act, 2008, already empowers the government to collect such data, says the lawyer. He adds that the current bill needs to have “better definitions”, besides stipulating that data should be made anonymous and available only in an aggregate form, not in individual parts that expose the user generating the data.
“Critical personal data”, to be processed only in India, has not been defined in the bill, while “sensitive personal data” has been defined as data that may reveal financial, health, sexual orientation, biometric and genetic data, among others. Section 34 mentions when such data can be transferred outside the country for processing. “This undoes the work of the Reserve Bank of India, which had stood up for the data localisation of banking data,” says Duggal. “The bill takes a U-turn on this. The lobbies have been successful in getting the bill watered down.”
Justice B.N. Srikrishna, author of the white paper that laid the groundwork for the bill, says he is “angry” with the government’s attitude (see interview). The bill has been referred to a joint select committee of Parliament instead of the standing committee—an “unprecedented” move, Duggal says. “The government has found ingenious ways to bypass parliamentary procedure. This is a very significant legislation, which, if not enacted properly, would in the long term harm India’s progress towards becoming an IT superpower,” he adds.