(Likhita Agrawal and Vatsalya Pankaj, both are Third year students at National Law University, Nagpur)
Featured Illustration – ‘The Gray Tree’ by Piet Mondrain
INTRODUCTION
The current era has seen a switch to virtual platforms with the help of technology which has resulted in privacy emerging as a burning issue. Privacy is considered to be a basic human right which has been enshrined under Art. 12 of UDHR, 1948 and Art. 17 of ICCPR, 1976. The Chairperson of the International Conference of Data Protection and Privacy Commissioners, 2019, Elizabeth Denhamhas said that “privacy became mainstream” throughout the globe. Further, with the increase in literary and legal awareness, people are becoming meticulous regarding the usage and management of their data.
In the domestic legal structure, the notion of privacy has evolved in many cases before the Supreme Court. Sections 43A & 72A of the Information Technology Act, 2000 (“IT Act”), talk about privacy and its violation. Section 43A of the IT Act provides for the punishment for corporations for failure to protect data and calls for “implementing and maintaining reasonable security practices and procedures”, while Section 72A of the IT Act provides for the punishment for disclosure of information in breach of lawful contract. However, even these two provisions were insufficient to ensure that data could be protected and hence the Personal Data Protection Bill (“Bill”) was introduced.
It is noteworthy that even the Apex Court ultimately ushered the Right to Privacy as a Fundamental Right in the case of Justice K. S. Puttaswamy (Retd.) and Anr. v. Union of India and ors (“Judgement”). It accepts privacy as an intrinsic constituent of human dignity and has accentuated privacy as paramount and states “Privacy is the ultimate expression of the sanctity of the individual.”
With the Aadhaar scheme being mandated by the government for availing the government benefits and services, the question of Privacy arose. There were claims that Right to Privacy would come under the ambit of the Right to Life. This issue was earlier challenged before a three-judge bench of the Supreme Court on the contention that it violated the right to privacy. But it did not stand on the argument that, Constitution of India does not mention the specific protection for the conception of the right to privacy and on judgements of M.P. Sharma v. Satish Chandra and Kharak Singh v. Uttar Pradesh.
As there was a need to implement legislation on the same, the Government constituted the Srikrishna Committee under the chairmanship of Justice Srikrishna to recommend a framework for data protection laws in India. The report was quite extensive and made various suggestions such as penalties for violations, criminal proceedings and setting up of a data authority along with a provision for withdrawal of consent of data processing. This was followed by a Draft Bill in 2018. However, provisions conflicted with the international guiding principles and mentioned about giving excessive supervision and scrutiny powers to the Government. Hence, after a span of time, the Personal Data Protection Bill, 2019 has been proposed in December 2019.
HIGHLIGHTS OF THE BILL
The Bill has several unique features. Firstly, it proposes to not only apply to Indian citizens and the Indian Government but also foreign companies dealing with personal data of individuals in India.[i] However, it is pertinent to note that the processing of data which is anonymous i.e. if the company or individual does not know the identity of the person whose data is being processed, then the protection of such data is not covered under the Bill (except when the government has made express policies on the same)[ii] Further, it calls for limitations on the data collected such as a requirement of notice and consent of the individual whose data is being collected, non-retention after processing such data.[iii] Additionally, it calls for certain transparency and accountability measures such as the privacy policy and implementing security safeguards amongst other measures as specified under the Bill.[iv]
As mentioned, the only time the data of the individual can be processed is through the consent of the individual, however, this rule comes with certain exceptions.[v] The Bill provides that data can be processed without consent:
- if required by the State for providing benefits to the individual
- for the prevention and detection of any unlawful activity including fraud
- for recovery of debt
- network and information security
- to respond to any medical emergency involving a threat to the life or a severe threat to the health of the data principal or any other individual
One of the major highlights of the Bill is that it proposes the creation of a Data Protection Authority of India which shall be tasked with protecting the interests of the individuals and prevent unlawful use of personal data and ensure that the provisions of the Bill are being followed.[vi] Further, it also prohibits the transfer of Sensitive personal data to outside of India for processing unless additional conditions are fulfilled. Section 34(2) of the Act states that such data may only be transferred on when such transfer is to a person or entity engaged in emergency services and such transfer is necessary. Further, this information may be transferred to only such a country as the government has notified.[vii]
If there is non-compliance with the provisions of the Bill, then there are two tiers of penalties and compensations. The Bill is quite extensive and provides punishments and fines for failure of the companies and individuals for processing data in breach of the provisions of the Act. Further, it also sets out fines for processing data in violation of the provisions of and prohibits “re-identification” of “de-identified” personal data without consent.[viii] What this means is that when data is made anonymous for the process to avoid misuse, such institutions are prohibited from using any means to identify whose data it is and then processing it.
LACUNAE OD THE BILL
Privacy can be explained by the old phrase “man’s house is his castle” which implies even the King cannot trespass beyond a certain edge. However, Section 35 of the Bill contradicts the said saying. The provision exempts the Government and its agencies from the provisions of the Bill in case of national security, sovereignty and integrity. Additionally, like these terms, are of subjective nature that may be interpreted differently leading to ambiguity in the future.
The US Supreme Court had introduced the ‘Reasonable expectation of privacy test’ in the case of Katz v. United States.[ix] It has been the foundation for many privacy provisions, and it has been passively acknowledged in paragraph 169 of the judgement. If this provision is observed pragmatically in the Bill, Section 14 needs reconsideration. It talks about the processing of personal data without consent for a reasonable purpose and provides for a non-exhausting list of constituents of reasonable purpose. The provision eliminates the core purpose of the proposed law.
Additionally, a major contemporary problem has remained uncovered by the Bill. The world is facing a huge banking and financial crime, especially in the cyber domain. The offenders illegally access the banking details of people and perform the transaction by taking their identity, which is also known as Identity theft. This offence has detrimental consequences because it not only infringes the privacy of an individual but also causes him financial loss. These incidents also exist in India. The Bill does not cover how the problem can be countered and fails to provide for any punishment for the same. The stated issue can be mitigated by imposing an appropriate penalty which can act as a deterrence for the society. Thus, provisions should be included for the same.
SUGGESTIONS
One of the major areas that were untouched by the Bill was regulating how information is to be disposed of after its use. For example, in applications, individuals submit data that is very sensitive. While the application allows the institution to process this data during the pendency of the application, after the process is completed there is no legal obligation on the institution to dispose of the data. Further, there is a need for a regulatory framework which would cover how this data is meant to be disposed of so that it isn’t misused as there’s no such framework existing currently. There’s also a need to relook at the law and cover the places which have grey areas to protect the privacy of the individual which must be of paramount importance.
CONCLUSION
The security and protection of the data is a matter of significance in the current techno-world. The acceptance of the right to privacy in the Case has given a direction to digital data in the country and after a short delay finally, a separate legal structure has been introduced for the same. Though, the Bill has some uncovered topics which are needed to be reviewed again but still the introduction of this law is in itself a new step in accomplishing data privacy.
[i]Personal Data Protection Bill 2019, § 2.
[ii] Personal Data Protection Bill 2019, § 91(2).
[iii]Personal Data Protection Bill 2019, § 11.
[iv]Personal Data Protection Bill 2019, Chapter 6.
[v]Personal Data Protection Bill 2019, § 14 (2).
[vi]Personal Data Protection Bill 2019, § 41.
[vii]Personal Data Protection Bill 2019, § 33.
[viii]Personal Data Protection Bill 2019, Chapter X.
[ix] 389 U.S. 347 (1967)
Leave a Reply