The Daily Fix: Where is the personal data protection law that Indians were promised?

The Aadhaar Amendments and the Economic Survey envision government monetising data by selling access to it. What about privacy? 

    

Narinder Nanu/AFP

Rohan Venkataramakrishnan

There is a small portion in the Economic Survey, tabled in Parliament on Thursday, that reveals something quite important: In a chapter dedicated to treating data as a public good, meaning government would have the freedom to use it, the Survey says, “Even if not explicitly mentioned every time data is talked about in this chapter, it is assumed that the processing of data will be in compliance with accepted privacy norms and the upcoming privacy law, currently tabled in Parliament.”

Those italics are in the document itself, and this is the only portion of the body text that is highlighted. Why is this significant? Because the survey seems to believe that India has laid down some “accepted privacy norms” and that a privacy law has been tabled in Parliament. Unfortunately, these norms remain nebulous. Though the government told the Supreme Court years ago that it would pass the privacy law, more commonly referred to as the Personal Data Protection Bill, there is no sign of one.

The absence of such a law is important because the government is making strenuous efforts to do all sorts of things with the data of Indian citizens. Remember, it is the Bharatiya Janata Party-led government that argued in the Supreme Court that Indians have no fundamental right to privacy, a contention that was unanimously rejected by the judges.

Since then, the government has paid lip service to the idea of privacy, even as it doubled down on the idea of data as a “national resource” rather than individual property. This view has been put forward in a number of draft pieces of legislation over the last year and a half, all of which make the argument that the government ought to be the custodian of data – which can even be handed over to private organisations for monetisation.

Commercial use

On Thursday, for example, the Lok Sabha passed the Aadhaar Amendment Bill, which would permit the commercial use of Aadhaar, India’s biometric unique identification system, originally developed to be used only to deliver welfare benefits. The Supreme Court, in a 2018 judgment, had struck down the use of Aadhaar by commercial entities but left open the door for Parliament to pass a new law regulating this, all under the pernicious fiction that use of the biometric ID could be “voluntary”. 

The very same day, the Economic Survey chapter on data went even further. “Datasets may be sold to analytics agencies that process the data, generate insights, and sell the insights further to the corporate sector, which may in turn use these insights to predict demand, discover untapped markets or innovate new products.” In other words, the Survey envisions the government making money off information often mandatorily extracted from citizens, with the benefits of this going to corporations and with no question of whether this will be done with the consent of the individual. 

This is where the Personal Data Protection Bill comes in. A panel headed by Justice Srikrishna put forward a draft bill last year. Although many had questions, comments and criticisms of the draft, it laid out one approach for how Indians can lay claim to their own data, which is something that each one of us generates, unlike a resource like oil or coal that may just happen to lie on land belonging to a citizen. 

Yet there has been almost no discussion from the government itself about this law since then, though it has gone ahead in discussing things like the E-Commerce Bill, Cloud Computing regulations and so on. The Economic Survey, in a section that one can only surmise was tentative (and hence in italics), recognises the elephant in the room and tries to address it by saying that the privacy law is on its way. 

But this is untrue. The government has made no indication that it plans to bring the law anytime soon. Simply put, this should count as a violation of our fundamental rights. Before the government can think about starting a data war with the United States or trying to monetise datasets of citizens by handing them over to the private sector, it must pass a strong data protection law built on the idea that privacy is a fundamental right and consent belongs to the citizen. 

Also read:

Explainer: All you need to know about the Srikrishna panel’s draft data protection law

Source: scrollin