By Sarosh Bana, Mumbai Correspondent
The manner in which the Narendra Modi government is seeking to hustle the Personal Data Protection Bill through Parliament without heeding growing calls for amendment, is perceived to be in line with its authoritarian approach to policy-making.
While the Bill is meant to safeguard and validate personal privacy, it is also viewed to be legitimising the government’s pursuit of divisive politics that had anyway been the case till now. The Bill extends to the whole of India and governs the processing of personal data also by the government, yet reserves the right to the government to exempt any government departments or official agencies from its purview, thereby diluting its own provisions.
Another aspect being contested is the Bill’s inclusion of “non-personal data” within its ambit, which changes the nature of the Bill from personal data protection to mere data protection. It was feared that the inclusion of certain clauses relating to non-personal data carried a high risk of re-identification and could lead to legal complications for stakeholders. Personal data are defined as data that pertain to “characteristics, traits or attributes of identity, which can be used to identify an individual”.
The Bill besides considers all social media companies as publishers, and fixes their accountability for the content on their platforms if they are not acting as intermediaries. It disallows a social media company from operating in India unless its parent company handling the technology sets up an office in the country.
The Personal Data Protection Bill, 2019, was introduced that year in the Lok Sabha, Lower House of Parliament, by then Electronics and Information Technology Minister Ravi Shankar Prasad. It also prescribes a seven-member ‘Data Protection Authority of India’ as a regulatory body with adjudicating powers to ensure compliance with the legislation. The Authority’s rulings can be appealed before an Appellate Tribunal, and the Tribunal’s orders can, in turn, be appealed before the Supreme Court.
The Bill failed to get enacted in 2019 owing to various concerns raised by Opposition members, leading to the constitution of a Joint Committee of Parliament (JCP) comprising 30 members to review the draft. After prolonged deliberations with various stakeholders, including Opposition members, various Ministries, Reserve Bank of India, and even social media platforms like Facebook India, Twitter India, Amazon Web Services, Amazon India, as well as Visa, MasterCard India, and Google India, the Committee upheld the draft despite the objections.
The Bill is now set to be tabled in Parliament’s winter session starting on 29 November.
Its introduction has been compelled by the rapidly increasing online activities and digitalisation, especially in the services, and financial and banking sectors. Amid the proliferation of the internet, consumers are generating vast data, which enable companies to ply them with personalised advertisements and announcements, based on their browsing patterns and other online behaviour. Companies are known to store these datasets without the knowledge of the users, and deny all responsibility when the data are leaked. The Bill seeks inter alia to hold such companies accountable.
The Bill categorises certain personal data as ‘sensitive’, which include financial data, biometric data, caste, religious or political beliefs, or any other category of data specified by the government, in consultation with the Authority. It also permits personal data to be processed only for “specific, clear and lawful purpose”, and calls for mechanisms for age verification and parental consent when processing sensitive data of children.
In their submissions before the JPC, representatives of cab aggregators Ola and Uber supported the data localisation norms, while Google India representatives spoke against data localisation being made a requirement.
Of the seven Parliamentarians from three Opposition parties who submitted dissent notes to the JCP, Congress MP Jairam Ramesh maintained that the Bill “gives unbridled powers to the central government to exempt any agency from the entire Act itself” and creates “certain exceptions for governments and government agencies from the provisions of consent”. His party colleague, Manish Tewari, opposed the Bill in its entirety on grounds that it suffered from an “inherent design flaw”.
Trinamool Congress MPs Derek O’Brien and Mahua Moitra felt the Bill lacked adequate safeguards to protect the right to privacy of data principals, namely, the individual, company, or any entity whose information was being collected. Their party colleague Gaurav Gogoi expressed concern over the lack of attention paid to harm arising from the government’s relentless efforts to establish a modern surveillance network and the lack of parliamentary oversight in this regard.
It is also because of its penchant for bringing the Indian population under mass surveillance that the government’s intent in pushing this Bill is suspect. Among the several cases brought before the Supreme Court on this very aspect, a nine-judge Constitutional bench of the apex court, in one such case in 2017, had unanimously ruled privacy to be a fundamental right as being intrinsic to the right to life and personal liberty guaranteed in Article 21 of the Constitution.
By this pathbreaking verdict, the highest court of the country had bolstered efforts by citizens to legally counter the rightwing Bharatiya Janata Party-led government’s moves to mine personal data for putting a mass surveillance system in place, and its rules on personal and public behaviour, speech and expression, and also on individual dietary habits. For instance, with the nationwide ban on consumption of beef from cows has empowered the police to enter homes in search of cow beef, stoking vigilantism where those even suspected to be transporting cow beef or having it at home have been thrashed and occasionally lynched. Most such instances have involved buffalo beef, which is not banned.
Vigilantes also intimidate and manhandle those behind posts on the social media that they deem critical of the government and its policies. The government too has countered some critics with the severe charges of sedition and of waging war against the state. Much to the consternation of the public, government representatives have at times lauded the vigilantes and have also blamed rape victims, urging for sensitivity in attire or for the timings they venture outdoors.
The government lost its argument in the Supreme Court that privacy is a common law right, and not a fundamental right. In its ruling, the court overturned past verdicts of its own eight-judge and six-judge benches delivered in 1954 and 1961 that had held that privacy was not protected under the Constitution.
Acknowledging that the present times are regarded as “an era of ubiquitous dataveillance, or the systematic monitoring of citizens’ communications or actions through the use of information technology”, the judges held that these data sets have linkages with other data sets and can be easily searched.
