Context

India’s Personal Data Protection Bill, 2019 seeks to protect “the privacy of individuals relating to their personal data”. On the whole, it is not designed to deliver on the promise. 

Provisions

• Global rules – It requires handlers of data to abide by globally-accepted rules on getting an individual’s consent first.

• Wider powers – it gives wide powers to the Government to dilute any of these provisions for its agencies.

• Data Protection Authority – It will be headed by a chairperson and have not more than six whole-time members.

Doubts on data security

• WhatsApp revelation – Recently, messaging platform WhatsApp said that some Indian journalists and rights activists were among those spied using technology by an Israeli company which only works for government agencies across the world.

• Google – it had alerted 12,000 users, including 500 in India, regarding “government-backed” phishing attempts against them.

• Srikrishna committee – Justice B.N. Srikrishna committee’s report forms the basis of the Bill. He has used words such as “Orwellian” and “Big Brother” in reaction to the removal of safeguards for Government agencies. 

• Dangers to privacy – the committee noted that the dangers to privacy originate from state and non-state actors. It called for exemptions to be “watertight”, “narrow”, and available for use in “limited circumstances”.

• Authority – the constitution of the Data Protection Authority of India to monitor and enforce the provisions of the Act is questionable. Members are to be selected by a panel filled with Government nominees. It disregards the fact that Government agencies are also regulated under the Act. They are major collectors and processors of data themselves

• Privacy as a right – the powers to the Government renders the gains from the K.S. Puttaswamy vs. Union of India case meaningless. It culminated in the recognition that privacy is intrinsic to life and liberty, and a basic right.

Way ahead

Srikrishna committee had also recommended that the Government bring in a law for the oversight of intelligence-gathering activities because non-consensual processing of data takes place here.