Why in News:
- At least five of the 30 members of the Joint Parliamentary Committee (JPC) on the Personal Data Protection (PDP) Bill are expected to move dissent notes to the panel’s report on the legislation.
- The dissent is mainly because of the controversial clause that allows the Union Government to exempt any agency under its purview from the law.
- This clause assumes importance in the backdrop of recent revelations in the Pegasus spyware case.
About:
- Personal data is data which pertains to characteristics, traits or attributes of identity, which can be used to identify an individual.
- The bill talks about various types of personal data, such as:
- Sensitive personal data (related to finances, health, official identifiers, sex life, sexual orientation, biometric, genetics)
- Critical personal data (military or national security data defined by government from time to time)
- General personal data- other than sensitive and critical personal data
- The Bill governs the processing of personal data by:
- government,
- companies incorporated in India, and
- foreign companies dealing with personal data of individuals in India.
- Bill seeks to create an independent and powerful regulator known as the Data Protection Authority (DPA) which will monitor and regulate data processing activities to ensure compliance.
- The Bill seeks to give users a set of rights over their personal data and means to exercise those rights.
Legal Principles:
- Information Technology Act, 2000: It provides for safeguard against certain breaches in relation to data from computer systems. It contains provisions to prevent the unauthorized use of computers, computer systems and data stored therein.
- Sec 43A of Information Technology Act 2000 protects user data from misuse but it is applicable to only corporate entities and not on government agency. Also, the rules are restricted to sensitive personal data only — medical history, biometric information among other things.
- Justice K.S. Puttaswami and Anr Vs. Union of India 2012, a nine-judge constitutional bench of the Supreme Court, recognized that “privacy” is a part of fundamental rights under Article 21 of that Constitution that is “Right to Life”.
- Justice (Retd) B.N. Srikrishna Report: Committee of Experts was formed under the Chairmanship of Justice (Retd) B.N. Srikrishna formulated the original draft of the Data Protection Bill, has reportedly called it “a piece of legislation that could turn India into an Orwellian state”.
Issues:
- Exemptions: Open-ended exceptions given to the government in the Bill, allowing for surveillance can lead to breach in privacy.
- Data Localization: Even if the data is stored in the country, the encryption keys may still be out of reach of national agencies leading data localization not effective.
- Non Transparent Appointment Procedure: The appointment of members to the Data Protection Authority (DPA) will not be made through an independent body but by a handful of people, mostly bureaucrats, selected by the government.
- Intellectual Property Rights Concerns: Allowing the government to force companies to transfer non-personal data raises serious intellectual property concerns, and can still threaten users even if they’re not individually identified.
- Fractured Internet: Technology giants like Facebook and Google and their industry bodies, especially those with significant ties to the US, have slung heavy backlash.
- Many are concerned with a fractured Internet (or a “splinternet”), where the domino effect of protectionist policy will lead to other countries following suit.
Way Forward:
- This bill was drafted after the Supreme Court in its judgement in Justice Puttaswamy case made Right to Privacy a part of Right to life under Article 21.
- It is important to strike a right balance between digital economy and privacy protection. The law should encompass all the aspects- data collection, processing and sharing practices and all the issues being pointed out in joint parliamentary committee should be addressed.
- It is important to strike a right balance between digital economy and privacy protection. The law should encompass all the aspects- data collection, processing and sharing practices.
Sources:
