The Personal Data Protection Bill, 2019, introduced by government in the Lok Sabha, has raised eyebrows for the manner in which authorities have carved out exceptions for themselves. The legislation is supposed to provide a comprehensive data protection architecture for the country. However, the version introduced by government is far removed from that goal. Instead of shoring up data privacy, government has given itself the power to exempt any enforcement agency from the purview of the law. This means that investigative agencies will have the power to snoop on personal data in the interest of sovereignty, integrity of the country, security of the state, maintenance of public order and having friendly relations with other countries.
This militates against the fundamental right to privacy as part of Article 21 of the Constitution. What’s surprising is that the current bill diverges significantly from what was suggested in the draft bill produced by the Justice BN Srikrishna committee last year. The latter had envisaged scrutiny of personal data as a rare exception and proportionate to the interests for which they were being obtained. But the bill tabled in Parliament offers no such safeguards.
Further, it proposes a Data Protection Authority comprising only government bureaucrats, without any outside representation or parliamentary or judicial oversight. There is a clear conflict of interest if such a body becomes an arbitrator for data privacy, in a case where the government itself is involved. This has compelled even Justice Srikrishna to comment that the present bill can turn India into an Orwellian state. After the Pegasus WhatsApp hack that targeted 121 Indians, including journalists and human rights activists, the need for strong data protection and building in government accountability is paramount.
Another flaw is that the bill builds in provisions for non-personal data too, where the government gives itself the right to acquire it from businesses. This runs counter to the notion of intellectual property, and will send a chill down the spine of investors in a climate where investments are already down. It could also cut the Indian internet economy off from the global one, which would be an error as the Indian IT industry has benefited immensely from globalisation. The government must review this flawed bill. It could do worse than adopting the Srikrishna draft.
This piece appeared as an editorial opinion in the print edition of The Times of India.