Personal data needs a comprehensive shield

Three months after it canned a draft of the personal data protection bill, India’s government has released the Digital Personal Data Protection Bill, 2022, for public comment. The new draft addresses some concerns of tech companies about data localization and other burdens of compliance. But it continues to ignore worries about the privacy of individuals from government intrusion. Opposition members of a joint parliamentary committee who had examined a previous version had warned in dissent notes that it proposed two laws: one that would bring private entities under scrutiny and another that would grant state agencies immunity. The latest one is no different. It lets the Centre exempt its own arms—and even private entities of its choice—from key provisions, a big carve-out attributed to “security of the state”. The government has argued, remarkably, that “national and public interest is at times greater than the interest of an individual”. The review panel had asked for “just, fair, reasonable and proportionate” reasons to be laid out for exemptions, but this bill gives such safeguards a miss. So if this draft becomes law, the government will not need to provide any reason for its unbridled access to our personal data. This would arm the state with excessive power, defy the spirit of an apex court ruling on our right to privacy, and leave us exposed to the risk of mass surveillance.

The draft’s proposal of a regulator is also skewed heavily in favour of the state. The Data Protection Board under this bill would be set up by the Centre and run by a chief executive appointed by it on its own terms and conditions. This is a let-down compared to earlier drafts that had proposed a statutory body. In instances of companies or individuals appealing against the government, will this board have the autonomy to play a fair referee? True, the bill does aim to curb malpractices among private firms. They cannot retain our data if it no longer serves the purpose for which it was collected; they will also have to inform us and the board of any data breach; and we’ll finally get the right to demand the deletion of our personal data stored by them. But, while the draft proposes steep fines on private firms for violations, individuals would not be able to ask companies to compensate them for harm done by data leaks. The bill’s idea of “deemed consent in public interest” also erodes our control over data that relates to us. Bizarrely, the draft imposes a set of “duties” on people and proposes a penalty of ₹10,000 if someone “furnishes any false particulars” or acts to “suppress any material information or impersonate another person”. Read along with stiff provisions of the telecom bill, which asks all licensed telecom services to “unequivocally identify the person to whom it provides services”, this is likely to outlaw online anonymity.

Worryingly, recent legislative and regulatory efforts by the Centre reveal attempts to control our digital lives. The government’s call to break chat encryption for the sake of “national security”, for example, is a clear case of overkill. The benefits cannot outweigh the risks of full network exposure, as doing this will technically entail. Nor have we got a satisfactory response to charges of spyware being installed on the phones of well-known dissenters. Meanwhile, our data continues to be mined all around us, even by political parties. Is true protection too much to ask for? It’s not as if privacy is only sought by shady folks and wrongdoers. Not only is it a legitimate need, but a basic right.