The Personal Data Protection (PDP) Bill, 2019, has been approved by the Cabinet and is slated to be placed in Parliament this winter session. 

What do we mean by data?

• Data usually refers to information about messages, social media posts, online transactions, and browser searches.

• The individual whose data is being stored and processed is called the data principal in the PDP Bill. 

• This large collection of information has become an important source of profits, but also a potential avenue for invasion of privacy because it can reveal extremely personal aspects. 

Companies, governments, and political parties can use it to find the most convincing ways to advertise online.

Who handles data and how?

• Data is stored in a physical space similar to a file cabinet of documents, and 

• It is transported across country borders in underwater cables that run as deep as Mount Everest and as long as four times the Indian Ocean. 

• To be considered useful, data has to be processed, which means analysed by computers.

• Data is collected and handled by entities called data fiduciaries. 

• The fiduciary controls how and why data is processed, 

• The processing itself may be by a third party, the data processor.

• For example, in the US, Facebook (the data controller) fell into controversy for the actions of the data processor — Cambridge Analytica.

• The physical attributes of data — where data is stored, where it is sent, where it is turned into something useful — are called data flows. 

• Data localisation arguments are premised on the idea that data flows determine who has access to the data, who profits off it, who taxes and who “owns” it. 

• However, many contend that the physical location of the data is not relevant in the cyber world.

How does the PDP Bill propose to regulate data transfer?

• To legislate on the topic, the Bill trifurcates personal data. 

• The umbrella group is all personal data — data from which an individual can be identified. 

• Some types of personal data are considered sensitive personal data (SPD), which the Bill defines as financial, health, sexual orientation, biometric, genetic, transgender status, caste, religious belief, and more. 

• Another subset is critical personal data. The government at any time can deem something critical, and has given examples as military or national security data.
• The approved Bill requires individual consent for data transfer abroad. 
• The Bill also requires sensitive personal data to be stored only in India. 
• It can be processed abroad only under certain conditions including approval of a Data Protection Agency (DPA). 
• The final category of critical personal data must be stored and processed in India.
• The Bill mandates fiduciaries to give the government any non-personal data when demanded. Non-personal data refers to anonymised data, such as traffic patterns or demographic data. 
•  The Bill requires social media companies, to develop their own user verification mechanism. 
• While the process can be voluntary for users and can be completely designed by the company, it may decrease the anonymity of users and “prevent trolling”.
• The Bill includes exemptions for processing data without an individual’s consent for “reasonable purposes”, including security of the state, detection of any unlawful activity or fraud, whistleblowing, etc. 
• The Bill calls for the creation of an independent regulator DPA, which will oversee assessments and audits and definition making. 
• Each company will have a Data Protection Officer (DPO) who will liaison with the DPA for auditing, grievance redressal, recording maintenance and more. 
• It also grants individuals the right to data portability, and the ability to access and transfer one’s own data.
• It legislates on the right to be forgotten. With historical roots in European Union law, this right allows an individual to remove consent for data collection and disclosure.

The two sides of the debate:

For data localisation

• A common argument from government officials has been that data localisation will help law-enforcement access data for investigations and enforcement. 
• As of now, much of cross-border data transfer is governed by individual bilateral “mutual legal assistance treaties” — a process that almost all stakeholders agree is cumbersome. 
• In addition, proponents highlight security against foreign attacks and surveillance. 
• The government doubled down on this argument after news broke that 121 Indian citizens’ WhatsApp accounts were hacked by an Israeli software called Pegasus.
• Many domestic-born technology companies, which store most of their data exclusively in India, support localisation. Eg: Paytm and Reliance Jio.
• Many economy stakeholders say localisation will also increase the ability of the Indian government to tax Internet giants.

Against the Bill

• Civil society groups have criticised the open-ended exceptions given to the government in the Bill, allowing for surveillance. 
• Moreover, some lawyers contend that security and government access are not achieved by localisation. 
• Even if the data is stored in the country, the encryption keys may still be out of reach of national agencies.
• Technology giants like Facebook and Google and their industry bodies, especially those with significant ties to the US, have slung heavy backlash. 
• Many are concerned with a fractured Internet (or a “splinternet”), where the domino effect of protectionist policy will lead to other countries following suit. 
• Much of this sentiment harkens to the values of a globalised, competitive internet marketplace, where costs and speeds determine information flows rather than nationalistic borders. 
• Opponents say protectionism may backfire on India’s own young startups that are attempting global growth, or on larger firms that process foreign data in India, such as Tata Consulting Services and Wipro.

Conclusion:

• Without an enabling law, the exemptions provided in the bill will fall short of securing accountability from the state for activities such as dragnet surveillance. The grey areas must spark public and parliamentary debate before a final legislation comes to fruition.